Thank you for your hard work in tracking this one down!
I'll have a look and see what would be involved in using GC for the buffer.
In principle, the buffer referenced via gr->color could simply be allocated via
gr->color = new (GC::ATOMIC) char[whatever...];
But the garbage collector doesn't know anything about SPGradients (because SPObjects aren't managed by it), so the reference wouldn't get tracked.
I suspect we shall have to make SPGradient::color a refcounted object rather than a raw buffer.
That isn't necessarily exclusive with making it managed by the collector; we can use GC::Anchored. That way, references from GC-managed objects can be handled automatically, and references from "outside" can be reflected via refcounts.
As far as tracking down the other lingering reference to the color buffer, I'd definitely suggest looking at the NRArenaItem hierarchy if you haven't already.
-mental