BUG: typecode reference leak in array_setstate on 4 error paths (methods.c) #31678

Bug Description

In numpy/_core/src/multiarray/methods.c, after Py_INCREF(typecode) at line 2100, four early return NULL paths skip the matching Py_DECREF(typecode), leaking the reference.

Location

numpy/_core/src/multiarray/methods.c:2100-2131

Code

Py_INCREF(typecode);        // line 2100: refcount incremented

if (nd < 0) {
    return NULL;            // line 2103: typecode LEAKED
}
// ...
if (dimensions[i] < 0) {
    return NULL;            // line 2118: typecode LEAKED
}
// ...
if (overflow) {
    PyErr_NoMemory();
    return NULL;            // line 2123: typecode LEAKED
}
// ...
if (!PyList_Check(rawdata)) {
    return NULL;            // line 2131: typecode LEAKED
}

Impact

Every failed ndarray unpickling operation leaks the typecode reference. This affects pickle.loads() / numpy.loads() on corrupted or malformed ndarray pickle data.

Suggested Fix

Replace all early return NULL with goto fail where fail does Py_DECREF(typecode):

fail:
    Py_DECREF(typecode);
    return NULL;

Environment

• NumPy version: current main
• Affected: ndarray.__setstate__() (unpickling)