NGX_HTTP_ZERO_IN_URI:

src/http/ngx_http_core_module.c: sr->zero_in_uri = (flags & NGX_HTTP_ZERO_IN_URI) != 0;

src/http/ngx_http_request.h: /* URI with "\0" or "%00" */ unsigned zero_in_uri:1;

Obviously, IMHO.

NGX_HTTP_SUBREQUEST_IN_MEMORY:

src/http/ngx_http_core_module.c: sr->subrequest_in_memory = (flags & NGX_HTTP_SUBREQUEST_IN_MEMORY) != 0;

src/http/ngx_http_upstream.c: if (!r->subrequest_in_memory) { ngx_http_upstream_send_response(r, u); return; }

/* subrequest content in memory */

...

So, as I can understand from using-of-subrequests point of view, r->subrequest_in_memory flag tells ngx_http_upstream_module to save a pointer to the full chain of response buffers in r->upstream->out_bufs chain-link. And *not-to-free* that buffers after subrequest was finished.

Fix me, if I'm wrong.