GeezerVison

Summary

Free the re-entrant native output buffer before returning nil when crypt_ra fails.

Reproduction

crypt_ra allocates its output buffer before validating the bcrypt setting. When hashing fails, bc_crypt currently returns before releasing args.data. A 50,000-call native failure model raises baseline maximum RSS to about 30.3 MB; the corrected branch remains around 26.7 MB under the same command.

Verification

• Native failure model completes 50,000 rejected calls with stable ownership.
• The complete suite passes 39 examples on Ruby 4.0.6 after rebuilding the extension.
• A cumulative 3.1.22 consumer also passes the suite and format-validation model.

Limits

RSS is a process-level supporting measurement, not a precise allocator trace. JRuby, Linux, Windows, and sanitizer builds were not run locally. The changed path is MRI-only and free(NULL) remains safe if allocation itself failed.

Compatibility

Successful hashing is unchanged. This only releases memory already owned by the failed native call.