Duh! Don't leak all the transient storage we use for pass requests.

bin/varnishd/cache_hash.c

@@ -683,16 +683,22 @@ HSH_Deref(struct worker *w, struct objcore *oc, struct object **oo)
 			return (r);
 	}
 
+	if (oc != NULL) {
+		BAN_DestroyObj(oc);
+		AZ(oc->ban);
+	}
+
 	if (o != NULL) {
-		if (oc != NULL) {
-			BAN_DestroyObj(oc);
-			AZ(oc->ban);
-		}
 		DSL(0x40, SLT_Debug, 0, "Object %u workspace min free %u",
 		    o->xid, WS_Free(o->ws_o));
 
 		if (oc != NULL)
 			oc_freeobj(oc);
+		else {
+			STV_Freestore(o);
+			STV_free(o->objstore);
+			o = NULL;
+		}
 		w->stats.n_object--;
 	}
 

bin/varnishtest/tests/b00002.vtc

@@ -23,6 +23,7 @@ client c1 {
 delay .1
 
 varnish v1 -expect n_object == 0
+varnish v1 -expect SMA.Transient.nobj == 0
 varnish v1 -expect client_conn == 1
 varnish v1 -expect client_req == 1
 varnish v1 -expect s_sess == 1