So what you're saying here is that the child (proc 2) saves an address to a variable in it's own DATA-segment at some location in the parent's (proc 1) memory?
Yes.
So the problem is that the pointer in proc 1 now points to free memory. If it's Mfree'd then it belongs to the OS now. Of course it's illegal to access this memory now. If LDG does this, it must be considered a bug.
But again, we're freeing BP _only_ and BP contains some pointers to some parts of memory (text, data, bss etc) -- so it would make sense if I call Mfree (bp->p_data_segment ); but calling Mfree (bp) only? There must be something more.