The OS always recovers all of the memory from a process that has terminated (barring horrible kernel bugs), and it doesn't need to look through the process imag

The OS always recovers all of the memory from a process that has terminated (barring horrible kernel bugs), and it doesn't need to look through the process image for pointers that need to be freed. When a process allocates memory, the kernel doesn't give it a physical memory address. It gives it a virtual address, which, when accessed, will be mapped to some physical address. The kernel has to keep track of which virtual addresses map to which physical addresses for each process, and it stores these mappings in a data structure called a "page table". At all times, the kernel knows what memory segments are in use by a given process. So, when a process exits, the kernel can just look at its page table to see what memory had been allocated to it. Provided that no other processes shared the same memory, it can free it.