"sureware" should not be "hwcrhk".

Also, the "to" variable used in cleanup is never non-NULL and is entirely
unused. As such, the cleanup might have been missed under genuine error
conditions and caused leaks and/or returned invalid pointers.