Reading the code, it appears that _mongoc_cyrus_set_mechanism constructs a string of supported auth mechanisms and then calls:

bson_string_free (str, 0);

That's passing 0 as the "free_segment" argument, so the character buffer is not freed.