AIKIDO-2026-421995

TL;DR

MessagePack::Unpacker's read_raw_body_begin pushes a stack barrier before calling a registered extension type's proc, then pops that barrier unconditionally after the proc returns. When the proc drives the same unpacker itself, for example by calling read or skip or by rescuing a read error, it leaves stack.depth at 0 before the unconditional pop runs, underflowing depth to SIZE_MAX and causing out-of-bounds access into the unpacker's internal stack array on the next unpack call. This crashes the Ruby VM with a segmentation fault and can leave Factory extension-type state corrupted. The fix restores depth to the barrier value directly instead of blindly decrementing it.