quic: free popped incoming channel on early exit in accept_connection

If we pop a channel but fail to extract or adopt its SSL pointer,
we return without releasing the channel. Add a small cleanup at
the function epilogue to free new_ch when conn_ssl is NULL.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 12 18:54:05 2026
(Merged from https://github.com/openssl/openssl/pull/28920)

(cherry picked from commit d62febf758)

ssl/quic/quic_impl.c

@@ -4711,6 +4711,11 @@ SSL *ossl_quic_accept_connection(SSL *ssl, uint64_t flags)
     }
 
 out:
+    if (conn_ssl == NULL && new_ch != NULL) {
+        ossl_quic_channel_free(new_ch);
+        new_ch = NULL;
+    }
+
     qctx_unlock(&ctx);
     return conn_ssl;
 }