diff --git a/libfrog/fsprops.c b/libfrog/fsprops.c
index 88046b7..a25c272 100644
--- a/libfrog/fsprops.c
+++ b/libfrog/fsprops.c
@@ -69,13 +69,14 @@
 	void			*priv)
 {
 	struct attrlist_cursor	cur = { };
-	char			attrbuf[XFS_XATTR_LIST_MAX];
-	struct attrlist		*attrlist = (struct attrlist *)attrbuf;
+	struct attrlist		*attrlist;
 	int			ret;
 
-	memset(attrbuf, 0, XFS_XATTR_LIST_MAX);
+	attrlist = calloc(XFS_XATTR_LIST_MAX, 1);
+	if (!attrlist)
+		return -1;
 
-	while ((ret = attr_list_by_handle(fph->hanp, fph->hlen, attrbuf,
+	while ((ret = attr_list_by_handle(fph->hanp, fph->hlen, attrlist,
 				XFS_XATTR_LIST_MAX, XFS_IOC_ATTR_ROOT,
 				&cur)) == 0) {
 		unsigned int	i;
@@ -96,6 +97,7 @@
 			break;
 	}
 
+	free(attrlist);
 	return ret;
 }
 
diff --git a/scrub/phase5.c b/scrub/phase5.c
index f6c295c..d298d62 100644
--- a/scrub/phase5.c
+++ b/scrub/phase5.c
@@ -190,30 +190,40 @@
 	struct xfs_bulkstat		*bstat,
 	const struct attrns_decode	*attr_ns)
 {
-	struct attrlist_cursor		cur;
-	char				attrbuf[XFS_XATTR_LIST_MAX];
-	char				keybuf[XATTR_NAME_MAX + 1];
-	struct attrlist			*attrlist = (struct attrlist *)attrbuf;
-	struct attrlist_ent		*ent;
+	struct attrlist_cursor		cur = { };
+	char				*keybuf;
+	struct attrlist			*attrlist;
 	struct unicrash			*uc = NULL;
 	int				i;
 	int				error;
 
-	error = unicrash_xattr_init(&uc, ctx, bstat);
-	if (error) {
-		str_liberror(ctx, error, descr_render(dsc));
+	attrlist = calloc(XFS_XATTR_LIST_MAX, 1);
+	if (!attrlist) {
+		error = errno;
+		str_errno(ctx, descr_render(dsc));
 		return error;
 	}
 
-	memset(attrbuf, 0, XFS_XATTR_LIST_MAX);
-	memset(&cur, 0, sizeof(cur));
-	memset(keybuf, 0, XATTR_NAME_MAX + 1);
-	error = attr_list_by_handle(handle, sizeof(*handle), attrbuf,
-			XFS_XATTR_LIST_MAX, attr_ns->flags, &cur);
-	while (!error) {
+	keybuf = calloc(XATTR_NAME_MAX + 1, 1);
+	if (!keybuf) {
+		error = errno;
+		str_errno(ctx, descr_render(dsc));
+		goto out_attrlist;
+	}
+
+	error = unicrash_xattr_init(&uc, ctx, bstat);
+	if (error) {
+		str_liberror(ctx, error, descr_render(dsc));
+		goto out_keybuf;
+	}
+
+	while ((error = attr_list_by_handle(handle, sizeof(*handle), attrlist,
+				XFS_XATTR_LIST_MAX, attr_ns->flags,
+				&cur)) == 0) {
 		/* Examine the xattrs. */
 		for (i = 0; i < attrlist->al_count; i++) {
-			ent = ATTR_ENTRY(attrlist, i);
+			struct attrlist_ent	*ent = ATTR_ENTRY(attrlist, i);
+
 			snprintf(keybuf, XATTR_NAME_MAX, "%s.%s", attr_ns->name,
 					ent->a_name);
 			if (uc)
@@ -225,14 +235,12 @@
 						keybuf);
 			if (error) {
 				str_liberror(ctx, error, descr_render(dsc));
-				goto out;
+				goto out_uc;
 			}
 		}
 
 		if (!attrlist->al_more)
 			break;
-		error = attr_list_by_handle(handle, sizeof(*handle), attrbuf,
-				XFS_XATTR_LIST_MAX, attr_ns->flags, &cur);
 	}
 	if (error) {
 		if (errno == ESTALE)
@@ -241,8 +249,12 @@
 		if (errno)
 			str_errno(ctx, descr_render(dsc));
 	}
-out:
+out_uc:
 	unicrash_free(uc);
+out_keybuf:
+	free(keybuf);
+out_attrlist:
+	free(attrlist);
 	return error;
 }