In src/java.security.jgss/share/native/libj2gss/NativeUtil.c:

   723 jbytes = (*env)->NewByteArray(env, cLen+2);
   724 if (jbytes == NULL) {
   725 return NULL;
   726 }
   727 (*env)->SetByteArrayRegion(env, jbytes, 0, 2, (jbyte *) oidHdr);
   728 if ((*env)->ExceptionCheck(env)) {
   729 return NULL;
   730 }
   731 (*env)->SetByteArrayRegion(env, jbytes, 2, cLen, (jbyte *) cOid->elements);
   732 if ((*env)->ExceptionCheck(env)) {
   733 return NULL;
   734 }
   735 result = (*env)->NewObject(env, CLS_Oid, MID_Oid_ctor1, jbytes);
   736 if ((*env)->ExceptionCheck(env)) {
   737 return NULL;
   738 }
   739 (*env)->DeleteLocalRef(env, jbytes);
   740 return result;

Here when "return NULL" is called jbytes is not released.