PT-2026-66639

Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmem last, rmem end, rmem owner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...