May be a bug in /libmdp/src/mdp_broker.c
s_broker_worker_msg (broker_t *self, zframe_t *sender, zmsg_t *msg)
free (command); //! this only free, but not close message, should be zframe_destroy(&command)?
by the way, for worker/client commands, why not use one byte to instead of string(four bytes).
And one time only use one zmq_msg_t may be better, which not need to malloc frequently.