In Reg2Py() in winreg.c, in the REG_MULTI_SZ case, there's the following:

                wchar_t **str = (wchar_t **)malloc(sizeof(wchar_t *)*s);
                if (str == NULL)
                    return PyErr_NoMemory();

However, not all of the return paths after that point call free(str).

The leaking paths are pretty unusual, so I'm setting the priority to low.  The leaking paths occur when PyList_New returns NULL or if the registry entry contains more than INT_MAX characters.

Two other things I noticed and I'm not sure about:

Is INT_MAX really the maximum number of characters for a Python unicode string?

Should this be using PyMem functions instead of malloc/free?