Don't know about Ubuntu, but program exit codes should be 8-bit (0-255).
I cannot check that at the moment, but I think your explanation is spot-on.

If you echo $space then it works OK, because $space can hold any value. But $? can, by definition, only be between 0 and 255, so it would explain your observations.

Given that filing a bug report is next-to-useless and Nokia will anyway not fix this, I would suggest you contact the CSSU people and report the bug (an easy solution would be to remove the dfree() function and just "inline" it where it's needed, which is at most 2 or 3 places).

Well done!