At qtdemux.c 

static void
qtdemux_tag_add_blob (GNode * node, GstQTDemux * demux)

line 8680

//-------------------------------
  sample = gst_sample_new (buf, NULL, NULL, s);
  gst_buffer_unref (buf);
  g_free (media_type);

  GST_DEBUG_OBJECT (demux, "adding private tag; size %d, info %" GST_PTR_FORMAT,
      len, s);

  gst_tag_list_add (demux->tag_list, GST_TAG_MERGE_APPEND,
      GST_QT_DEMUX_PRIVATE_TAG, sample, NULL);

//------------------------------------------

I think the sample should be unref after added to the tag list.