owns the surface and should call [cairo.device.Device.destroy] when done with it.
This function always returns a valid pointer, but it will return a pointer to a "nil" device if an error such as out of memory occurs. You can use [cairo.device.Device.status] to check for this.