symbol_closure uses free directly

[silentbicycle]

This is allocated with f_malloc but calls free directly.

It may be worth auditing the whole codebase and/or using an allocator that checks for this in tests.