What changes

Passing a plain JS object literal where a native parameter expects a pointer to a struct (e.g. CGPoint*, NSRange*):

someNativeFn({ x: 1, y: 2 }); // param is MyStruct*

previously snapshotted the literal into a malloc'd buffer that was never freed (the long-standing // TODO: How to free this? in Interop::WriteValue) — one leak per call. With this PR the buffer is owned by the FFICall driving the invocation and freed when the call completes (after ffi_call returns and the result is read).

Writes of literals into MyStruct*-typed slots of an interop.Reference are unchanged: that pointer is stored in memory that outlives any call, so those buffers deliberately remain unowned.

The lifetime contract (new, documented behavior)

⚠️ Behavior change & risk — please test in real apps before merging

This is a deliberate behavior change with a known hazard class: code that passes a literal and relies on native retaining that pointer past the call worked before only because of the leak (the buffer was accidentally immortal). Under this PR such code gets a dangling pointer at call end — a use-after-free instead of a leak. Symmetrically, an API whose contract is "callee frees the pointer" would now double-free; interop.alloc is the correct form there.

Mitigating data — a survey of NativeScript core (packages/core + test apps):

• Zero occurrences of the literal-as-struct-pointer pattern. Every struct literal in core feeds a by-value parameter (unaffected).
• The single genuine struct-pointer call in core (sockaddr → SCNetworkReachabilityCreateWithAddress, connectivity/index.ios.ts) already uses new interop.Reference(sockaddr, {...}) — a different, unaffected path.
• All other interop.Reference uses are scalar out-params (CGFloat*, BOOL*, NSError**).

So exposure is limited to third-party plugins / app code using a pattern core never uses. Still: this should soak in real apps (ideally ones heavy on CoreGraphics/CoreText/AV struct-pointer APIs) before it ships, and the release notes should state the new lifetime rule.

Implementation

• FFICall gains OwnBuffer(void*) + an owned-buffer list freed in its destructor (stack-scoped at all three drive sites: CallInitializer, CallFunctionInternal, block invoke — verified the destructor runs after the result is read).
• Interop::WriteValue takes an optional FFICall* callOwner = nullptr; only SetFFIParams passes it. All nine other call sites — including nested ref/out-param initialization and Reference.cpp slot writes — stay owner-less on purpose (audited).
• New fixture +[TNSTestNativeCallbacks recordsPointerEcho:] (returns the pointee) to allow per-iteration value assertions.

Tests

New specs in Marshalling/RecordTests.js:

• literal → struct-pointer, 1000 iterations, values asserted every iteration (guards premature free/corruption);
• wrapped struct instance → pointer param: wrapper's own buffer must survive (not call-owned);
• interop.Reference → pointer param: reference stays readable after the call;
• literal → by-value struct, 1000 iterations, pinned to the (allocation-free) by-value path.

Full suite passes. The leak itself is verified fixed out-of-band with the Instruments Leaks template — this path was the last remaining entry from the leaks run that 8080bc0 addressed.