The p_prev->p_next was never set to NULL, but instead the p_pmt->p_next pointer was.
This resulted in never freeing additional PMT entries from the PAT.