There are various paths of control in md5_crypt_verify that do
if (passwd) pfree(passwd); if (valuntil) pfree(valuntil);
Isn't this now pfree'ing part of the saved pre-parsed pg_pwd data?
regards, tom lane