incorrect list handling in copy_small_ranges

In `src/malloc-graph.c`, the `copy_small_ranges` function is defined as:
```c
static bool copy_small_ranges(SmallRange **copy, SmallRange *range) {
for (; range; range = range->next) {
*copy = malloc(sizeof(**copy));
if (!*copy) {
return false;
}
**copy = *range;
copy = &(*copy)->next;
}
return true;
}
```
If `malloc` fails during any iteration other than the first:
* `**copy = *range` copy-assigns the entire struct, which includes copying the original list's `range->next` pointer.
* `copy = &(*copy)->next` shifts the assignment target to the `next` pointer of the newly allocated range.
* When the subsequent `malloc` fails, the loop exits with `false` without setting `*copy` (the `next` pointer of the prior allocated node) to `NULL`.
* The partially copied list remains linked to the original live list starting from `range->next`.

This behavior leads to double-free corruption.

Start in src/malloc-graph.c at copy_small_ranges and trace the allocation-failure path after a partially copied list has been built. Verify the failure path cannot retain a link into the original live list, and use the project’s existing test or allocation-failure checks if available to confirm that cleanup does not double-free.

Written by the indexing model from the issue text.