Prevent possible double-xfree on buffer

Use FREE_NULL_BUFFER instead, otherwise we could attempt to
free_buffer a second time if we jump to the rwfail label.

bug4491