Upon closer inspection of libstirshaken it doesn't seem to care about freeing the certificate chain in many cases which could explain it regardless if any of the recent PRs are applied.
Correct. libstirshaken didn't make a use of `xchain` only after your PR @mrtrev
in particular this was never used https://github.com/signalwire/libstirshaken/blob/e8289b0967a7b008dd666ee8880...
so it is on your behalf to make sure it's correctly initialised and freed