install(security-scanner): gate post-start() deref on Ok to avoid over-deref

src/install/PackageManager/security_scanner.rs

@@ -1390,10 +1390,14 @@ impl<'a> SecurityScanSubprocess<'a> {
         // SAFETY: `writer_local` holds a live ref; `start()` mutates the writer
         // in place (raw intrusive object — no Rust aliasing across the RefPtr).
         let start_result = unsafe { (*writer_ptr).start() };
-        // SAFETY: `writer_local` keeps `*writer_ptr` live; we own the `start()` ref.
-        unsafe { RefCount::<StaticPipeWriter>::deref(writer_ptr) };
-        // SAFETY: `writer_local` keeps `*writer_ptr` live.
-        unsafe { (*writer_ptr).started = false };
+        // `start()` is refcount-neutral on `Err` (it releases its own +1 and
+        // leaves `started == false`); only the `Ok` path leaves a +1 to drop.
+        if start_result.is_ok() {
+            // SAFETY: `writer_local` keeps `*writer_ptr` live; we own the `start()` ref.
+            unsafe { RefCount::<StaticPipeWriter>::deref(writer_ptr) };
+            // SAFETY: `writer_local` keeps `*writer_ptr` live.
+            unsafe { (*writer_ptr).started = false };
+        }
         match start_result {
             Err(e) => {
                 writer_local.deref();

src/runtime/socket/SSLConfig.rs

@@ -60,13 +60,13 @@ impl From<JsError> for ReadFromBlobError {
 // so `free_sensitive` would not pair with `Box`-owned memory.
 // ──────────────────────────────────────────────────────────────────────────
 
-/// `ZBox` is global-allocator memory; re-allocate via `dupe_z` so `mi_free` can free it.
+/// `ZBox` is global-allocator memory; re-allocate via `dupe_z` so `free_sensitive` can free it.
 #[inline]
 fn zbox_into_raw(z: &bun_core::ZBox) -> *const c_char {
     bun_core::dupe_z(z.as_bytes())
 }
 
-/// `dupeZ` a byte slice into a fresh mimalloc allocation.
+/// `dupeZ` a byte slice into a fresh default-allocator allocation.
 #[inline]
 fn dupe_z(bytes: &[u8]) -> *const c_char {
     bun_core::dupe_z(bytes)