tl;dr: there isn't currently a way to annotate g_memory_input_stream_new_from_data() correctly. The bindings need to know that the destroy parameter refers to the data parameter, but the (destroy) annotation is currently only valid in combination with callbacks.
I propose a (destroy-pointer PARAM) annotation, used like so:
/**
* g_memory_input_stream_new_from_data:
* @data: (array length=len) (element-type guint8) (transfer full): input data
* @len: length of the data, may be -1 if @data is a nul-terminated string
* @destroy: (destroy-pointer data) (nullable): function that is called to free @data, or %NULL
...
The value of PARAM is the name of another function parameter. PARAM is required (unlike with the existing (destroy) annotation where it can be guessed.) This translates into a destroy-pointer="POS" annotation in the GIR.