CVE-2026-22991 libceph: make free_choose_arg_map() resilient to partial allocation