AIKIDO-2026-11117

TL;DR

The MessagePack::Buffer#clear method returns chunk memory pages to a shared pool without resetting the buffer's rmem cursor pointers. Reusing the cleared buffer for writing then hands back a slice of an already-freed page, and a later buffer allocating from the same pool can alias the same physical memory. This lets one buffer read or corrupt another buffer's data within the same process, but only when application code uses the MessagePack::Buffer API directly with a clear-and-reuse pattern. The fix resets the rmem pointers when the buffer is fully emptied so freed pages are no longer referenced.