AIKIDO-2026-963257

TL;DR

MessagePack::Buffer transfers rmem page ownership incorrectly when carving a new chunk from the unused tail of a page, so a later chunk can keep pointing into memory that has already been returned to the shared pool and handed to another buffer. Reads then return another buffer's bytes and writes corrupt them, which in a per-request packer can leak or mix serialized data across requests. Separately, unpacking deeply nested recursive extensions ignores a failed unpacker stack push and keeps recursing until the Ruby VM crashes with SIGSEGV instead of raising MessagePack::StackError. The fix correctly transfers rmem ownership so released pages are not reused while still referenced, and raises StackError when the recursive-extension stack push fails.