diff --git a/CHANGES b/CHANGES
index 88baf7f42..62a7f8fc5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -130,6 +130,8 @@ CHANGES FROM 3.7c TO 3.8
 
 * Add capture-pane -I to include the time each line entered history.
 
+* Various memory leak fixes from Heon Jeong.
+
 * Add a default C-b T binding to change the current pane title.
 
 * Menus now belong to the window, so appear on all clients.
diff --git a/cmd-split-window.c b/cmd-split-window.c
index 3ddc33c22..641792e2c 100644
--- a/cmd-split-window.c
+++ b/cmd-split-window.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd-split-window.c,v 1.150 2026/08/20 09:19:24 nicm Exp $ */
+/* $OpenBSD: cmd-split-window.c,v 1.151 2026/09/10 11:02:18 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Nicholas Marriott <nicholas.marriott@gmail.com>
diff --git a/layout-custom.c b/layout-custom.c
index 7f6da285c..48b12a967 100644
--- a/layout-custom.c
+++ b/layout-custom.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: layout-custom.c,v 1.40 2026/09/09 07:03:39 nicm Exp $ */
+/* $OpenBSD: layout-custom.c,v 1.41 2026/09/09 09:01:19 nicm Exp $ */
 
 /*
  * Copyright (c) 2010 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -28,8 +28,8 @@
 #include "tmux.h"
 
 /*
- * Layouts can be represented as strings in a JSON format (v2). The legacy
- * format (v1) will be removed in the future and should no longer be used.
+ * Layouts can be represented as strings in a JSON format (v2). The version 1
+ * format will be removed in the future and should no longer be used.
  *
  * The current (v2) format is JSON. The top level has two keys:
  *    "V": version number, currently 2
@@ -57,6 +57,9 @@
  *    "z": z-index, if a floating pane
  */
 
+/* Maximum nesting depth for version 1 layouts. */
+#define LAYOUT_V1_MAX_DEPTH 1000
+
 /* Layout string. */
 struct layout_string {
 	char	*dat;
@@ -362,7 +365,7 @@ layout_append_v2(struct layout_cell *lc, struct layout_string *ls)
 	return (0);
 }
 
-/* Append information for a single cell in the legacy (v1) format. */
+/* Append information for a single cell in the version 1 format. */
 static int
 layout_append_v1(struct layout_cell *lc, struct layout_string *ls)
 {
@@ -778,7 +781,7 @@ layout_assign(struct window *w, struct layout_parse_ctx *pctx)
 		layout_assign_fallback(w, w->layout_root);
 }
 
-/* Construct a cell from the legacy (v1) format. */
+/* Construct a cell from the version 1 format. */
 static struct layout_cell *
 layout_construct_cell(struct layout_cell *lcparent, const char **layout)
 {
@@ -827,12 +830,15 @@ layout_construct_cell(struct layout_cell *lcparent, const char **layout)
 	return (lc);
 }
 
-/* Construct a layout from the legacy (v1) format. */
+/* Construct a layout from the version 1 format. */
 static struct layout_cell *
-layout_construct_v1(struct layout_cell *lcparent, const char **layout)
+layout_construct_v1(struct layout_cell *lcparent, const char **layout, u_int depth)
 {
 	struct layout_cell	*lc, *lcchild;
 
+	if (depth > LAYOUT_V1_MAX_DEPTH)
+		return (NULL);
+
 	lc = layout_construct_cell(lcparent, layout);
 	if (lc == NULL)
 		return (NULL);
@@ -855,7 +861,7 @@ layout_construct_v1(struct layout_cell *lcparent, const char **layout)
 
 	do {
 		(*layout)++;
-		lcchild = layout_construct_v1(lc, layout);
+		lcchild = layout_construct_v1(lc, layout, depth + 1);
 		if (lcchild == NULL)
 			goto fail;
 		TAILQ_INSERT_TAIL(&lc->cells, lcchild, entry);
@@ -1068,7 +1074,8 @@ layout_construct(const char *input, struct layout_parse_ctx *pctx)
 			*pctx->cause = xstrdup("invalid layout checksum");
 			return (-1);
 		}
-		if ((pctx->root = layout_construct_v1(NULL, &input)) == NULL) {
+		pctx->root = layout_construct_v1(NULL, &input, 0);
+		if (pctx->root == NULL) {
 			*pctx->cause = xstrdup("invalid layout");
 			return (-1);
 		}
diff --git a/options-table.c b/options-table.c
index 7a2575b02..4951c6325 100644
--- a/options-table.c
+++ b/options-table.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: options-table.c,v 1.244 2026/09/01 12:49:49 nicm Exp $ */
+/* $OpenBSD: options-table.c,v 1.245 2026/09/10 11:02:18 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
diff --git a/regress/control-client-sanity.sh b/regress/control-client-sanity.sh
index 32695e7c0..b85589de6 100644
--- a/regress/control-client-sanity.sh
+++ b/regress/control-client-sanity.sh
@@ -30,8 +30,11 @@ killw
 EOF
 sleep 1
 $TMUX has || exit 1
-$TMUX lsp -aF '#{pane_id} #{window_layout}' >$TMP || exit 1
-cat <<EOF|cmp -s $TMP - || exit 1
+# Use a control client to request legacy layouts, keeping only pane lines
+# from the control protocol output.
+$TMUX -C lsp -aF '#{pane_id} #{window_layout}' |
+	grep '^%[0-9]' >$TMP || exit 1
+cat <<EOF|cmp $TMP - || exit 1
 %0 f5ab,200x200,0,0[200x50,0,0,0,200x149,0,51,3]
 %3 f5ab,200x200,0,0[200x50,0,0,0,200x149,0,51,3]
 %2 dcbd,200x200,0,0[200x100,0,0,2,200x99,0,101,4]
diff --git a/regress/modal-pane.sh b/regress/modal-pane.sh
index a09eef327..d83ca6be4 100644
--- a/regress/modal-pane.sh
+++ b/regress/modal-pane.sh
@@ -381,6 +381,25 @@ must_equal "$(fmt modal:0 '#{window_modal_pane}')" "$modal"
 check_ok kill-pane -t "$modal"
 sleep 1
 
+# failed-key closes successful panes and retains failed panes until a key.
+modal=$($TMUX new-pane -OPF '#{pane_id}' -t "$p0" \
+    -x 20 -y 5 -X 20 -Y 10 'sleep 1') ||
+	fail "new-pane -O failed"
+check_ok set-option -p -t "$modal" remain-on-exit failed-key
+sleep 2
+must_equal "$(fmt modal:0 '#{window_modal_pane}')" ''
+
+modal=$($TMUX new-pane -OPF '#{pane_id}' -t "$p0" \
+    -x 20 -y 5 -X 20 -Y 10 'sleep 1; exit 1') ||
+	fail "new-pane -O failed"
+check_ok set-option -p -t "$modal" remain-on-exit failed-key
+sleep 2
+must_equal "$(fmt "$modal" '#{pane_dead}:#{pane_modal_flag}')" 1:1
+must_equal "$($TMUX show-options -pv -t "$modal" remain-on-exit)" failed-key
+$TMUX2 send-keys -t "$OUTER" a
+sleep 1
+must_equal "$(fmt modal:0 '#{window_modal_pane}')" ''
+
 $TMUX bind P display-popup -E -t "$p0" -w 20 -h 5 'cat'
 $TMUX2 send-keys -t "$OUTER" C-b P
 sleep 1
diff --git a/regress/pane-ops.sh b/regress/pane-ops.sh
index c69362cee..25795c026 100644
--- a/regress/pane-ops.sh
+++ b/regress/pane-ops.sh
@@ -104,6 +104,25 @@ assert_alive()
 	fi
 }
 
+# Compare layout geometry and pane ordering, ignoring the active pane and
+# last-pane history in the JSON layout. Selection is checked separately.
+pane_layout()
+{
+	$TMUX display-message -p -t "$1" '#{window_layout}' |
+		sed 's/,"a":true//g; s/,"l":[0-9][0-9]*//g'
+}
+
+check_layout()
+{
+	out=$(pane_layout "$1")
+	if [ "$out" != "$2" ]; then
+		echo "Layout for '$1' wrong."
+		echo "Expected: '$2'"
+		echo "But got:  '$out'"
+		exit 1
+	fi
+}
+
 # ---------------------------------------------------------------------------
 # split-window geometry.
 
@@ -309,12 +328,12 @@ check_ok kill-pane -t "$p6"
 
 # Zoom and unzoom preserve the exact tiled layout. Selecting another pane
 # without -Z unzooms, while -Z transfers zoom to the selected pane.
-layout=$($TMUX display-message -p -t P:0 '#{window_layout}')
+layout=$(pane_layout P:0)
 check_ok select-pane -t "$p0"
 check_ok resize-pane -Z -t "$p0"
 check_ok select-pane -t "$p2"
 check_fmt "$p2" '#{window_zoomed_flag}:#{pane_active}' '0:1'
-check_fmt P:0 '#{window_layout}' "$layout"
+check_layout P:0 "$layout"
 
 check_ok select-pane -t "$p0"
 check_ok resize-pane -Z -t "$p0"
@@ -322,7 +341,7 @@ check_ok select-pane -Z -t "$p2"
 check_fmt "$p2" '#{window_zoomed_flag}:#{pane_zoomed_flag}:#{pane_active}' \
 	'1:1:1'
 check_ok resize-pane -Z -t "$p2"
-check_fmt P:0 '#{window_layout}' "$layout"
+check_layout P:0 "$layout"
 
 # Directional selection temporarily restores the full layout to find its
 # neighbour, then follows the same unzoom or -Z transfer rules.
@@ -340,7 +359,7 @@ check_ok select-pane -D -Z -t "$p0"
 check_fmt "$p2" '#{window_zoomed_flag}:#{pane_zoomed_flag}:#{pane_active}' \
 	'1:1:1'
 check_ok resize-pane -Z -t "$p2"
-check_fmt P:0 '#{window_layout}' "$layout"
+check_layout P:0 "$layout"
 
 # The last-pane path has separate zoom handling, both with and without -Z.
 check_ok select-pane -t "$p0"
@@ -357,7 +376,7 @@ check_ok select-pane -l -Z -t P:0
 check_fmt "$p0" '#{window_zoomed_flag}:#{pane_zoomed_flag}:#{pane_active}' \
 	'1:1:1'
 check_ok resize-pane -Z -t "$p0"
-check_fmt P:0 '#{window_layout}' "$layout"
+check_layout P:0 "$layout"
 
 # Killing either a hidden ordinary pane or the zoom target unzooms.
 check_ok new-window -d -t P:12 -n zoom-kill 'cat'
diff --git a/server-client.c b/server-client.c
index a1f8b3121..9618d43bc 100644
--- a/server-client.c
+++ b/server-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: server-client.c,v 1.511 2026/09/08 10:20:08 nicm Exp $ */
+/* $OpenBSD: server-client.c,v 1.512 2026/09/10 11:02:18 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Nicholas Marriott <nicholas.marriott@gmail.com>
diff --git a/server-fn.c b/server-fn.c
index 9721aa03b..585e4511b 100644
--- a/server-fn.c
+++ b/server-fn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: server-fn.c,v 1.152 2026/09/03 19:12:36 nicm Exp $ */
+/* $OpenBSD: server-fn.c,v 1.153 2026/09/10 11:02:18 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
diff --git a/tmux.1 b/tmux.1
index 526d67cb3..8a0169b69 100644
--- a/tmux.1
+++ b/tmux.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tmux.1,v 1.1168 2026/09/09 07:03:39 nicm Exp $
+.\" $OpenBSD: tmux.1,v 1.1169 2026/09/10 11:02:18 nicm Exp $
 .\"
 .\" Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
 .\"
@@ -14,7 +14,7 @@
 .\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 .\" OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: September 9 2026 $
+.Dd $Mdocdate: September 10 2026 $
 .Dt TMUX 1
 .Os
 .Sh NAME
diff --git a/tmux.h b/tmux.h
index 17cd168bc..514517898 100644
--- a/tmux.h
+++ b/tmux.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tmux.h,v 1.1438 2026/09/09 08:30:05 nicm Exp $ */
+/* $OpenBSD: tmux.h,v 1.1439 2026/09/10 11:02:18 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>