LGTM.

The get_cfunc_from_callable() fix is surprising: PyCFunction_Check() is always true and so nobody noticed the reference leak before? Is it possible to trigger the leak with a reproducer?

I cannot create a reproducer from the Python side. The check Py_TYPE(callable) == &PyMethodDescr_Type ensures callable->tp_descr_get is always method_get from descrobject.c which (currently) returns a PyCFunction_Type instance or NULL.

A C-extension could override the tp_descr_get field (override as in setting a new tp_descr_get, not subclassing PyMethodDescr_Type) and return a non-PyCFunction_Type object, but under the consenting adult principle I do not think we have to guard for that.

I can leave this part as is, change the PyCFunction_Check into an assert or revert to the current main version.

Pinging @gaogaotiantian as the one who introduced the code in #103534

Merged. Thanks for the fix.