Camera: fix cleanupFailedRequests + HAL buffer manager path

Test: crash fixed
Bug: 120986771
Change-Id: I3f7031b0a2db30dfbdcf0522dec1c0d6dc9ab26b

services/camera/libcameraservice/device3/Camera3Device.cpp

@@ -5689,6 +5689,8 @@ void Camera3Device::RequestThread::cleanUpFailedRequests(bool sendRequestError)
             captureRequest->mInputStream->returnInputBuffer(captureRequest->mInputBuffer);
         }
 
+        // No output buffer can be returned when using HAL buffer manager
+        if (!mUseHalBufManager) {
             for (size_t i = 0; i < halRequest->num_output_buffers; i++) {
                 //Buffers that failed processing could still have
                 //valid acquire fence.
@@ -5702,6 +5704,7 @@ void Camera3Device::RequestThread::cleanUpFailedRequests(bool sendRequestError)
                         /*timestampIncreasing*/true, std::vector<size_t> (),
                         captureRequest->mResultExtras.frameNumber);
             }
+        }
 
         if (sendRequestError) {
             Mutex::Autolock l(mRequestLock);