CVE-2026-8925: SASL double-free

Hi all,

We found a double-free in the GSASL authentication path — Curl_auth_gsasl_is_supported() frees gsasl->ctx on a failed gsasl_client_start() but never nulls the pointer, and then Curl_auth_gsasl_cleanup() frees it again unconditionally at connection teardown.

The bug lives in two spots. lib/vauth/gsasl.c:47-50:

res = gsasl_client_start(gsasl->ctx, mech, &gsasl->client);
if(res != GSASL_OK) {
  gsasl_done(gsasl->ctx);   /* frees gsasl->ctx ... */