Two analogous bugs:
hamt_node_bitmap_assoc(line 704): Recursivehamt_node_assocreturns new sub_node, thenhamt_node_bitmap_clonefails → sub_node leaked. Line 755 correctly DECREFs.hamt_node_bitmap_without(line 997): Same pattern. Line 968 correctly DECREFs.
Add Py_DECREF(sub_node) before return NULL/return W_ERROR at lines 705 and 997.