First, it looks like `pkg_free` has to be done on `tmp`.
Then I think this needs to be tuned, otherwise can affect performances for forwarded subscribe requests, because the operation will be done twice. The execution of the callback for `TMCB_RESPONSE_SENT` should be done only when `param->rpl==FAKED_REPLY` (which is when a local response is generated).