The set_policy_overrides operation returns an object reference.  If a oneway 
call is made on the returned reference, a memory leak occurs.  If a normal call 
is made on the returned reference, no memory leak occurs.  This is all 
according to BoundsChecker.

The following programs will demonstrate the problem:

==== test.idl ====

module JCAFCore {

  interface Listener {

    oneway void update1way();
    void update();

  };

};

==== client_main.cpp ====

#include "testC.h"

class Client
{
  public:
    void init(CORBA::ORB_ptr orb);
    JCAFCore::Listener_ptr setPolicyOverrides(JCAFCore::Listener_ptr listener);

  private:
    CORBA::ORB_ptr theOrb;
};

void
Client::init(CORBA::ORB_ptr orb)
{
  theOrb = orb;
}

JCAFCore::Listener_ptr
Client::setPolicyOverrides(JCAFCore::Listener_ptr listener)
{
  Messaging::SyncScope listenerSyncPolicy(Messaging::SYNC_WITH_TRANSPORT);
  CORBA::PolicyList policyList( 1);
  policyList.length( 1);
  CORBA::Any syncPolicy;
  syncPolicy <<= listenerSyncPolicy;
  policyList[0] = theOrb->create_policy(
      Messaging::SYNC_SCOPE_POLICY_TYPE,
      syncPolicy);
  CORBA::Object_var obj = listener->_set_policy_overrides(
      policyList,
      CORBA::SET_OVERRIDE);
  policyList[0]->destroy();
  return JCAFCore::Listener::_narrow( obj.in());
}

int
main (int argc, char *argv[])
{
  ACE_DECLARE_NEW_CORBA_ENV;
  ACE_TRY
    {
      CORBA::ORB_var orb =
        CORBA::ORB_init (argc, argv, 0, ACE_TRY_ENV);
      ACE_TRY_CHECK;

      Client client;
      client.init(orb);

      std::ifstream file;
      file.open( "c:\\ior.txt");
      std::string iorString;
      file >> iorString;

      CORBA::Object_var obj = orb->string_to_object( iorString.c_str());

      JCAFCore::Listener_var listener = JCAFCore::Listener::_narrow(obj.in());

      // There is no leak that shows up 77 times.
      for (int i=0; i<77; i++)
        {
          JCAFCore::Listener_var ref = client.setPolicyOverrides(listener.in());
          ref->update();
        }

      // There is a memory leak on set_policy_overrides that shows up 99 times.
      for (int i=0; i<99; i++)
        {
          JCAFCore::Listener_var ref = client.setPolicyOverrides(listener.in());
          ref->update1way();
        }

      orb->destroy();

    }
  ACE_CATCHANY
    {
      ACE_PRINT_EXCEPTION (ACE_ANY_EXCEPTION,"main");
      return -1;
    }
  ACE_ENDTRY;
  ACE_CHECK_RETURN (-1);

  return 0;
}

==== server_main.cpp ====

#include "testS.h"

class ListenerImpl : public POA_JCAFCore::Listener
{
  public:
    virtual void update ()
      ACE_THROW_SPEC (( CORBA::SystemException ));
    virtual void update1way ()
      ACE_THROW_SPEC (( CORBA::SystemException ));
};


void ListenerImpl::update ( )
    ACE_THROW_SPEC (( CORBA::SystemException ))
{
  ACE_DEBUG((LM_INFO, "update called\n"));
}

void
ListenerImpl::update1way ()
    ACE_THROW_SPEC (( CORBA::SystemException ))
{
  ACE_DEBUG(( LM_INFO, "update1way called\n"));
}


int
main (int argc, char *argv[])
{
  ACE_DECLARE_NEW_CORBA_ENV;
  ACE_TRY
    {
      CORBA::ORB_var orb =
        CORBA::ORB_init (argc, argv, 0, ACE_TRY_ENV);
      ACE_TRY_CHECK;

      CORBA::Object_var obj =
          orb->resolve_initial_references ("RootPOA", ACE_TRY_ENV);
      ACE_TRY_CHECK;

      PortableServer::POA_var root_poa =
          PortableServer::POA::_narrow (obj.in (), ACE_TRY_ENV);
      ACE_TRY_CHECK;

      PortableServer::POAManager_var mgr =
          root_poa->the_POAManager (ACE_TRY_ENV);
      ACE_TRY_CHECK;

      mgr->activate (ACE_TRY_ENV);
      ACE_TRY_CHECK;

      ListenerImpl server;

      obj = server._this();

      std::ofstream file;
      file.open( "c:\\ior.txt");

      CORBA::String_var iorString = orb->object_to_string( obj);

      file << iorString;
      file.close();

      orb->run();

      orb->destroy();

    }
  ACE_CATCHANY
    {
      ACE_PRINT_EXCEPTION (ACE_ANY_EXCEPTION,"main");
      return -1;
    }
  ACE_ENDTRY;
  ACE_CHECK_RETURN (-1);

  return 0;
}