Cross-buffer data disclosure via stale buffer pointers

Use-after-free in MessagePack for Ruby before 1.8.2 allows attackers to disclose or corrupt data across buffers in one process. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into it, so a later write reuses memory another buffer can acquire. Exploitation requires direct Buffer API use with a clear-and-reuse lifecycle; plain unpack input cannot reach the flaw, and the bounded impact is same-process data disclosure or overwrite.