3c7938163c
bux_sb_build returned sb->buf and then bux_sb_free freed it, causing dangling pointers in all callers of StringBuilder_Build followed by StringBuilder_Free (e.g. JsonParser_ParseString, Fmt). Fix: bux_sb_build now detaches the buffer (sets sb->buf = NULL) before returning it, so bux_sb_free only frees the sb struct. This transfers buffer ownership to the caller.