AIKIDO-2026-806256

TL;DR

The schunk_from_cframe() and ndarray_from_cframe() helpers in core.py build objects whose data points directly into the caller's in-memory cframe bytes buffer when copy=False (the default), without keeping that buffer alive. A temporary cframe (for example ndarray_from_cframe(response.content)) can therefore be reclaimed while the returned object is still in use, so later reads dereference freed memory and return corrupted data. The related vlmeta read paths (__getitem__/__len__/__iter__) also dereference the raw C schunk pointer without the dead-owner check the write paths already had, segfaulting on an orphaned owner. The fix pins the source buffer on the returned object and makes vlmeta reads raise ReferenceError instead of crashing.