The vulnerability stemmed from using Py_DECREF instead of Py_CLEAR in loops that create Python objects. The commit 7d512c8 shows systematic replacement of Py_DECREF with Py_CLEAR across multiple functions in platform-specific C files. These functions handle system data conversion in while/for loops, and the original Py_DECREF usage left variables non-NULL after decrementing refcounts. This created a scenario where subsequent iterations/error handling could trigger double-free conditions if object creation failed after the first iteration. The pattern is consistent across all patched functions, with high confidence from the explicit fix in the security commit.