diff '--color=auto' -Naur a/configure.ac b/configure.ac
--- a/configure.ac	2025-09-23 14:14:32.000000000 +0000
+++ b/configure.ac	2025-10-25 03:25:35.878356536 +0000
@@ -17,7 +17,7 @@
 dnl ----------------------------------------------------------------------------
 
 AC_PREREQ([2.68])
-AC_INIT([PHP],[8.4.13],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
+AC_INIT([PHP],[8.4.14],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER
diff '--color=auto' -Naur a/configure.ac.orig b/configure.ac.orig
--- a/configure.ac.orig	1970-01-01 00:00:00.000000000 +0000
+++ b/configure.ac.orig	2025-09-23 14:14:32.000000000 +0000
@@ -0,0 +1,1836 @@
+dnl Process this file with autoconf to produce a configure script.
+
+dnl Include external macro definitions before the AC_INIT to also remove
+dnl comments starting with # and empty newlines from the included files.
+dnl ----------------------------------------------------------------------------
+m4_include([build/ax_check_compile_flag.m4])
+m4_include([build/ax_func_which_gethostbyname_r.m4])
+m4_include([build/ax_gcc_func_attribute.m4])
+m4_include([build/libtool.m4])
+m4_include([build/php_cxx_compile_stdcxx.m4])
+m4_include([build/php.m4])
+m4_include([build/pkg.m4])
+m4_include([TSRM/threads.m4])
+m4_include([Zend/Zend.m4])
+
+dnl Basic autoconf initialization, generation of config.nice.
+dnl ----------------------------------------------------------------------------
+
+AC_PREREQ([2.68])
+AC_INIT([PHP],[8.4.13],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
+AC_CONFIG_SRCDIR([main/php_version.h])
+AC_CONFIG_AUX_DIR([build])
+AC_PRESERVE_HELP_ORDER
+
+PHP_CONFIG_NICE([config.nice])
+
+PHP_CANONICAL_HOST_TARGET
+
+AC_CONFIG_HEADERS([main/php_config.h])
+
+AH_TOP([
+#ifndef PHP_CONFIG_H
+#define PHP_CONFIG_H
+
+#if defined(__GNUC__) && __GNUC__ >= 4
+# define ZEND_API __attribute__ ((visibility("default")))
+# define ZEND_DLEXPORT __attribute__ ((visibility("default")))
+#else
+# define ZEND_API
+# define ZEND_DLEXPORT
+#endif
+
+#define ZEND_DLIMPORT
+])
+AH_BOTTOM([
+#include <stdlib.h>
+
+#ifdef HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
+#ifdef HAVE_SYS_SELECT_H
+#include <sys/select.h>
+#endif
+
+#include <string.h>
+
+#endif /* PHP_CONFIG_H */
+])
+
+ac_IFS=$IFS; IFS="."
+set $(echo AC_PACKAGE_VERSION | "${SED}" 's/\([[0-9\.]]*\)\(.*\)/\1\.\2/')
+IFS=$ac_IFS
+PHP_MAJOR_VERSION=[$]1
+PHP_MINOR_VERSION=[$]2
+PHP_RELEASE_VERSION=[$]3
+dnl Allow overriding PHP_EXTRA_VERSION through the homonymous env var
+AC_ARG_VAR([PHP_EXTRA_VERSION],
+  [Extra PHP version label suffix, e.g. '-dev', 'rc1', '-acme'])dnl
+AS_VAR_IF([PHP_EXTRA_VERSION],, [PHP_EXTRA_VERSION=[$]4])
+PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
+PHP_VERSION_ID=$(expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION)
+
+dnl Allow version values to be used in Makefile.
+PHP_SUBST([PHP_MAJOR_VERSION])
+PHP_SUBST([PHP_MINOR_VERSION])
+PHP_SUBST([PHP_RELEASE_VERSION])
+PHP_SUBST([PHP_EXTRA_VERSION])
+
+dnl Setting up the PHP version based on the information above.
+dnl ----------------------------------------------------------------------------
+
+echo "/* automatically generated by configure */" > php_version.h.new
+echo "/* edit configure.ac to change version number */" >> php_version.h.new
+echo "#define PHP_MAJOR_VERSION $PHP_MAJOR_VERSION" >> php_version.h.new
+echo "#define PHP_MINOR_VERSION $PHP_MINOR_VERSION" >> php_version.h.new
+echo "#define PHP_RELEASE_VERSION $PHP_RELEASE_VERSION" >> php_version.h.new
+echo "#define PHP_EXTRA_VERSION \"$PHP_EXTRA_VERSION\"" >> php_version.h.new
+echo "#define PHP_VERSION \"$PHP_VERSION\"" >> php_version.h.new
+echo "#define PHP_VERSION_ID $PHP_VERSION_ID" >> php_version.h.new
+cmp php_version.h.new $srcdir/main/php_version.h >/dev/null 2>&1
+if test $? -ne 0 ; then
+  rm -f $srcdir/main/php_version.h && mv php_version.h.new $srcdir/main/php_version.h && \
+  echo 'Updated main/php_version.h'
+else
+  rm -f php_version.h.new
+fi
+
+dnl Settings we want to make before the checks.
+dnl ----------------------------------------------------------------------------
+
+PHP_INIT_BUILD_SYSTEM
+
+dnl Because 'make install' is often performed by the superuser, we create the
+dnl libs subdirectory as the user who configures PHP. Otherwise, the current
+dnl user will not be able to delete libs or the contents of libs.
+
+$php_shtool mkdir -p libs
+rm -f libs/*
+
+dnl Checks for programs.
+dnl ----------------------------------------------------------------------------
+
+PKG_PROG_PKG_CONFIG
+AC_PROG_CC([cc gcc])
+PHP_DETECT_ICC
+PHP_DETECT_SUNCC
+
+dnl AC_PROG_CC_C99 is obsolete with autoconf >= 2.70 yet necessary for <= 2.69.
+m4_version_prereq([2.70],,[AC_PROG_CC_C99])
+AC_PROG_CPP
+AC_USE_SYSTEM_EXTENSIONS
+AC_PROG_LN_S
+
+AS_VAR_IF([cross_compiling], [yes],
+  [AC_CHECK_PROGS([BUILD_CC], [gcc clang c99 c89 cc cl], [none])
+    AC_MSG_CHECKING([for native build C compiler])
+    AC_MSG_RESULT([$BUILD_CC])],
+  [BUILD_CC=$CC])
+
+dnl Support systems with system libraries in e.g. /usr/lib64.
+PHP_ARG_WITH([libdir],
+  [for system library directory],
+  [AS_HELP_STRING([--with-libdir=NAME],
+    [Look for libraries in .../NAME rather than .../lib])],
+  [lib],
+  [no])
+
+PHP_ARG_ENABLE([rpath],
+  [whether to enable runpaths],
+  [AS_HELP_STRING([--disable-rpath],
+    [Disable passing additional runtime library search paths])],
+  [yes],
+  [no])
+
+dnl Check for -R, etc. switch.
+PHP_RUNPATH_SWITCH
+
+dnl Checks for some support/generator progs.
+PHP_PROG_BISON([3.0.0])
+PHP_PROG_RE2C([1.0.3], [--no-generation-date])
+dnl Find installed PHP. Minimum supported version for gen_stub.php is PHP 7.4.
+PHP_PROG_PHP([7.4])
+
+PHP_ARG_ENABLE([re2c-cgoto],
+  [whether to enable computed goto extension with re2c],
+  [AS_HELP_STRING([--enable-re2c-cgoto],
+    [Enable re2c -g flag to optimize conditional jumps using computed goto
+    extension, if supported by the compiler])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_RE2C_CGOTO], [no],,
+[AC_CACHE_CHECK([whether re2c -g works], [php_cv_have_re2c_cgoto],
+  [AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+int main(void)
+{
+label1:
+  ;
+label2:
+  ;
+  static void *adr[] = { &&label1, &&label2 };
+  goto *adr[0];
+  return 0;
+}]])],
+  [php_cv_have_re2c_cgoto=yes],
+  [php_cv_have_re2c_cgoto=no])])
+AS_VAR_IF([php_cv_have_re2c_cgoto], [yes],
+  [AS_VAR_APPEND([RE2C_FLAGS], [" -g"])])
+])
+
+dnl Platform-specific compile settings.
+dnl ----------------------------------------------------------------------------
+
+dnl See bug #28605
+case $host_cpu in
+  alpha*)
+    if test "$GCC" = "yes"; then
+      CFLAGS="$CFLAGS -mieee"
+    else
+      CFLAGS="$CFLAGS -ieee"
+    fi
+    ;;
+  sparc*)
+    if test "$SUNCC" = "yes"; then
+      CFLAGS="$CFLAGS -xmemalign=8s"
+    fi
+    ;;
+esac
+
+dnl See https://github.com/php/php-src/issues/14140
+AX_CHECK_COMPILE_FLAG([-ffp-contract=off], [CFLAGS="$CFLAGS -ffp-contract=off"])
+
+dnl Mark symbols hidden by default if the compiler (for example, gcc >= 4)
+dnl supports it. This can help reduce the binary size and startup time.
+AX_CHECK_COMPILE_FLAG([-fvisibility=hidden],
+                       [CFLAGS="$CFLAGS -fvisibility=hidden"])
+
+case $host_alias in
+  *solaris*)
+    CPPFLAGS="$CPPFLAGS -D_POSIX_PTHREAD_SEMANTICS"
+    ;;
+  *hpux*)
+    if test "$GCC" = "yes"; then
+      CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE_EXTENDED"
+    fi
+    ;;
+esac
+
+dnl Disable PIC mode by default where it is known to be safe to do so, to avoid
+dnl the performance hit from the lost register.
+AC_MSG_CHECKING([whether to force non-PIC code in shared modules])
+case $host_alias in
+  i?86-*-linux*|i?86-*-freebsd*)
+    if test "${with_pic+set}" != "set" || test "$with_pic" = "no"; then
+      with_pic=no
+      AC_MSG_RESULT([yes])
+    else
+      AC_MSG_RESULT([no])
+    fi
+    ;;
+  *)
+    AC_MSG_RESULT([no])
+    ;;
+esac
+
+dnl Detect musl libc
+AC_MSG_CHECKING([whether we are using musl libc])
+if command -v ldd >/dev/null && ldd --version 2>&1 | grep ^musl >/dev/null 2>&1
+then
+  AC_MSG_RESULT([yes])
+  AC_DEFINE([__MUSL__], [1], [Define to 1 when using musl libc.])
+else
+  AC_MSG_RESULT([no])
+fi
+
+dnl Add _GNU_SOURCE compile definition because the php_config.h with definitions
+dnl by AC_USE_SYSTEM_EXTENSIONS might be included after the system headers which
+dnl require extensions to C and POSIX.
+AS_VAR_APPEND([CPPFLAGS], [" -D_GNU_SOURCE"])
+
+PTHREADS_CHECK
+PHP_HELP_SEPARATOR([SAPI modules:])
+PHP_SHLIB_SUFFIX_NAMES
+PHP_BUILD_PROGRAM
+PHP_SAPI=none
+
+dnl SAPI configuration.
+dnl ----------------------------------------------------------------------------
+
+dnl Paths to the targets are relative to the build directory.
+SAPI_LIBNAME=libphp
+SAPI_LIBNAME_SHARED=$SAPI_LIBNAME.[]$SHLIB_DL_SUFFIX_NAME
+SAPI_LIBNAME_STATIC=$SAPI_LIBNAME.a
+SAPI_SHARED=libs/$SAPI_LIBNAME_SHARED
+SAPI_STATIC=libs/$SAPI_LIBNAME_STATIC
+SAPI_LIBTOOL=libphp.la
+
+PHP_CONFIGURE_PART([Configuring SAPI modules])
+
+esyscmd(./build/config-stubs sapi)
+
+dnl Show which main SAPI was selected.
+AC_MSG_CHECKING([for chosen SAPI module])
+AC_MSG_RESULT([$PHP_SAPI])
+
+dnl Show which binaries were selected.
+AC_MSG_CHECKING([for executable SAPI binaries])
+AS_VAR_IF([PHP_BINARIES],,
+  [AC_MSG_RESULT([none])],
+  [AC_MSG_RESULT([$PHP_BINARIES])])
+
+dnl Exit early.
+AS_VAR_IF([PHP_INSTALLED_SAPIS],, [AC_MSG_ERROR([Nothing to build.])])
+
+dnl Add POSIX threads compilation and linker flags when thread safety is enabled
+dnl with either the '--enable-zts' configure option or automatically enabled by
+dnl PHP SAPIs. For example, Apache SAPI.
+AS_VAR_IF([enable_zts], [yes], [
+  if test -n "$ac_cv_pthreads_lib"; then
+    LIBS="$LIBS -l$ac_cv_pthreads_lib"
+  fi
+  if test -n "$ac_cv_pthreads_cflags"; then
+    CFLAGS="$CFLAGS $ac_cv_pthreads_cflags"
+  fi
+
+  PTHREADS_FLAGS
+])
+
+dnl Starting system checks.
+dnl ----------------------------------------------------------------------------
+
+PHP_CONFIGURE_PART([Running system checks])
+
+dnl Find sendmail binary.
+PHP_PROG_SENDMAIL
+
+dnl Check whether the system uses EBCDIC (not ASCII) as its native codeset.
+PHP_EBCDIC
+
+dnl Check whether the system byte ordering is bigendian.
+PHP_C_BIGENDIAN
+
+dnl Check whether writing to stdout works.
+PHP_TEST_WRITE_STDOUT
+
+dnl Check for /usr/pkg/{lib,include} which is where NetBSD puts binary and
+dnl source packages. This should be harmless on other OSs.
+if test -d /usr/pkg/include && test -d /usr/pkg/lib; then
+   CPPFLAGS="$CPPFLAGS -I/usr/pkg/include"
+   LDFLAGS="$LDFLAGS -L/usr/pkg/lib"
+fi
+test -d /usr/ucblib && PHP_ADD_LIBPATH([/usr/ucblib])
+
+dnl First, library checks.
+dnl ----------------------------------------------------------------------------
+
+AC_SEARCH_LIBS([socket], [socket network])
+
+AC_CHECK_FUNCS([socketpair],,
+  [AC_SEARCH_LIBS([socketpair], [socket network],
+    [AC_DEFINE([HAVE_SOCKETPAIR], [1])])])
+
+AC_SEARCH_LIBS([gethostbyaddr], [nsl network])
+
+AC_SEARCH_LIBS([dlopen], [dl],
+  [AC_DEFINE([HAVE_LIBDL], [1],
+    [Define to 1 if you have the 'dl' library (-ldl).])])
+
+AC_SEARCH_LIBS([sin], [m])
+
+case $host_alias in
+  riscv64*)
+    PHP_CHECK_FUNC(__atomic_exchange_1, atomic)
+    ;;
+esac
+
+dnl Solaris/Illumos for process mapping.
+AC_SEARCH_LIBS([Pgrab], [proc])
+
+dnl Haiku does not have network api in libc.
+AC_SEARCH_LIBS([setsockopt], [network])
+
+dnl Check for openpty. It may require linking against libutil or libbsd.
+AC_CHECK_FUNCS([openpty],,
+  [AC_SEARCH_LIBS([openpty], [util bsd], [AC_DEFINE([HAVE_OPENPTY], [1])])])
+
+dnl Then headers.
+dnl ----------------------------------------------------------------------------
+
+dnl QNX requires unix.h to allow functions in libunix to work properly.
+AC_CHECK_HEADERS(m4_normalize([
+  dirent.h
+  sys/param.h
+  sys/types.h
+  sys/time.h
+  netinet/in.h
+  alloca.h
+  arpa/inet.h
+  arpa/nameser.h
+  dns.h
+  fcntl.h
+  grp.h
+  ieeefp.h
+  langinfo.h
+  linux/sock_diag.h
+  poll.h
+  pty.h
+  pwd.h
+  resolv.h
+  strings.h
+  syslog.h
+  sysexits.h
+  sys/ioctl.h
+  sys/file.h
+  sys/mman.h
+  sys/mount.h
+  sys/poll.h
+  sys/resource.h
+  sys/select.h
+  sys/socket.h
+  sys/stat.h
+  sys/statfs.h
+  sys/statvfs.h
+  sys/vfs.h
+  sys/sysexits.h
+  sys/uio.h
+  sys/wait.h
+  sys/loadavg.h
+  unistd.h
+  unix.h
+  utime.h
+  sys/utsname.h
+  sys/ipc.h
+  dlfcn.h
+  tmmintrin.h
+  nmmintrin.h
+  wmmintrin.h
+  immintrin.h
+]),,, [dnl
+#ifdef HAVE_SYS_PARAM_H
+#include <sys/param.h>
+#endif
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_TIME_H
+#include <sys/time.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#ifdef HAVE_ARPA_NAMESER_H
+#include <arpa/nameser.h>
+#endif
+])
+
+PHP_FOPENCOOKIE
+PHP_BROKEN_GETCWD
+AS_VAR_IF([GCC], [yes], [PHP_BROKEN_GCC_STRLEN_OPT])
+
+dnl Detect the headers required to use makedev, major, and minor.
+dnl Autoconf <= 2.69 didn't check glibc 2.25 deprecated macros in sys/types.h.
+m4_version_prereq([2.70],,[ac_cv_header_sys_types_h_makedev=no])
+AC_HEADER_MAJOR
+
+dnl Checks for typedefs, structures, and compiler characteristics.
+dnl ----------------------------------------------------------------------------
+
+AC_STRUCT_TIMEZONE
+
+PHP_MISSING_TIME_R_DECL
+
+AC_CHECK_TYPES([struct flock],,,[#include <fcntl.h>])
+AC_CHECK_TYPES([socklen_t], [], [], [
+  #ifdef HAVE_SYS_TYPES_H
+  # include <sys/types.h>
+  #endif
+  #ifdef HAVE_SYS_SOCKET_H
+  # include <sys/socket.h>
+  #endif
+])
+
+dnl These are defined elsewhere than stdio.h.
+PHP_CHECK_SIZEOF([intmax_t], [0])
+PHP_CHECK_SIZEOF([ssize_t], [8])
+PHP_CHECK_SIZEOF([ptrdiff_t], [8])
+
+dnl Check stdint types (must be after header check).
+PHP_CHECK_STDINT_TYPES
+
+dnl Check GNU C builtins.
+PHP_CHECK_BUILTIN([__builtin_clz])
+PHP_CHECK_BUILTIN([__builtin_clzl])
+PHP_CHECK_BUILTIN([__builtin_clzll])
+PHP_CHECK_BUILTIN([__builtin_cpu_init])
+PHP_CHECK_BUILTIN([__builtin_cpu_supports])
+PHP_CHECK_BUILTIN([__builtin_ctzl])
+PHP_CHECK_BUILTIN([__builtin_ctzll])
+PHP_CHECK_BUILTIN([__builtin_expect])
+PHP_CHECK_BUILTIN([__builtin_frame_address])
+PHP_CHECK_BUILTIN([__builtin_saddl_overflow])
+PHP_CHECK_BUILTIN([__builtin_saddll_overflow])
+PHP_CHECK_BUILTIN([__builtin_smull_overflow])
+PHP_CHECK_BUILTIN([__builtin_smulll_overflow])
+PHP_CHECK_BUILTIN([__builtin_ssubl_overflow])
+PHP_CHECK_BUILTIN([__builtin_ssubll_overflow])
+PHP_CHECK_BUILTIN([__builtin_unreachable])
+PHP_CHECK_BUILTIN([__builtin_usub_overflow])
+
+dnl Check AVX512
+PHP_CHECK_AVX512_SUPPORTS
+dnl Check AVX512 VBMI
+PHP_CHECK_AVX512_VBMI_SUPPORTS
+
+dnl Check for __alignof__ support in the compiler
+AC_CACHE_CHECK([whether the compiler supports __alignof__],
+[php_cv_have_alignof],
+[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [
+  int align = __alignof__(int);
+  (void)align;
+])],
+[php_cv_have_alignof=yes],
+[php_cv_have_alignof=no])])
+AS_VAR_IF([php_cv_have_alignof], [yes],
+  [AC_DEFINE([HAVE_ALIGNOF], [1],
+    [Define to 1 if the compiler supports '__alignof__'.])])
+
+dnl Check for structure members.
+AC_CHECK_MEMBERS([struct tm.tm_gmtoff],,,[#include <time.h>])
+AC_CHECK_MEMBERS([struct stat.st_blksize, struct stat.st_rdev])
+dnl AC_STRUCT_ST_BLOCKS will screw QNX because fileblocks.o does not exist.
+if test "$(uname -s 2>/dev/null)" != "QNX"; then
+  AC_STRUCT_ST_BLOCKS
+fi
+
+dnl Checks for types.
+AC_TYPE_UID_T
+
+dnl Checks for sockaddr_storage and sockaddr.sa_len.
+AC_CHECK_TYPES([struct sockaddr_storage],,,[#include <sys/socket.h>])
+AC_CHECK_MEMBERS([struct sockaddr.sa_len],,,[#include <sys/socket.h>])
+
+dnl Checks for GCC function attributes on all systems except ones without glibc
+dnl Fix for these systems is already included in GCC 7, but not on GCC 6.
+dnl
+dnl At least some versions of FreeBSD seem to have buggy ifunc support, see
+dnl bug #77284. Conservatively don't use ifuncs on FreeBSD prior to version 12.
+AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*|*openbsd*], [true], [
+  if test "$(uname -s 2>/dev/null)" != "FreeBSD" || test "$(uname -U 2>/dev/null)" -ge 1200000; then
+    AX_GCC_FUNC_ATTRIBUTE([ifunc])
+    AX_GCC_FUNC_ATTRIBUTE([target])
+  fi
+])
+
+dnl Check for __attribute__ ((__aligned__)) support in the compiler.
+PHP_CHECK_VARIABLE_ATTRIBUTE([aligned])
+
+dnl Checks for library functions.
+dnl ----------------------------------------------------------------------------
+
+AC_CHECK_FUNCS(m4_normalize([
+  alphasort
+  asctime_r
+  asprintf
+  chroot
+  ctime_r
+  explicit_memset
+  fdatasync
+  flock
+  ftok
+  funopen
+  gai_strerror
+  getcwd
+  getgrnam_r
+  gethostname
+  getloadavg
+  getlogin
+  getprotobyname
+  getprotobynumber
+  getpwnam_r
+  getpwuid_r
+  getrusage
+  getservbyname
+  getservbyport
+  gettimeofday
+  getwd
+  glob
+  gmtime_r
+  lchown
+  localtime_r
+  memcntl
+  memfd_create
+  memmem
+  mempcpy
+  memrchr
+  mkstemp
+  mmap
+  nice
+  nl_langinfo
+  poll
+  pthread_jit_write_protect_np
+  putenv
+  scandir
+  setenv
+  setitimer
+  shutdown
+  sigprocmask
+  statfs
+  statvfs
+  std_syslog
+  strcasecmp
+  strnlen
+  strptime
+  strtok_r
+  symlink
+  tzset
+  unsetenv
+  usleep
+  utime
+  vasprintf
+]))
+
+AC_CHECK_FUNC([inet_ntop],, [AC_MSG_FAILURE([Required inet_ntop not found.])])
+AC_CHECK_FUNC([inet_pton],, [AC_MSG_FAILURE([Required inet_pton not found.])])
+
+dnl Check for strerror_r, and if its a POSIX-compatible or a GNU specific version.
+AC_FUNC_STRERROR_R
+
+dnl Check for functions inside their belonging headers.
+AC_CHECK_HEADER([sys/prctl.h], [AC_CHECK_FUNCS([prctl])])
+AC_CHECK_HEADER([sys/procctl.h], [AC_CHECK_FUNCS([procctl])])
+
+AX_FUNC_WHICH_GETHOSTBYNAME_R
+
+dnl Some systems (Solaris 10) do not have nanosleep in libc.
+AC_CHECK_FUNCS([nanosleep],,
+  [AC_SEARCH_LIBS([nanosleep], [rt], [AC_DEFINE([HAVE_NANOSLEEP], [1])])])
+
+dnl Check for getaddrinfo, should be a better way, but... Also check for working
+dnl getaddrinfo.
+AC_CACHE_CHECK([for getaddrinfo], [php_cv_func_getaddrinfo],
+[AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <netdb.h>],
+  [struct addrinfo *g,h;g=&h;getaddrinfo("","",g,&g);])],
+  [AC_RUN_IFELSE([AC_LANG_SOURCE([
+#include <netdb.h>
+#include <sys/types.h>
+#include <string.h>
+#include <stdlib.h>
+#ifndef AF_INET
+# include <sys/socket.h>
+#endif
+int main(void) {
+  struct addrinfo *ai, *pai, hints;
+
+  memset(&hints, 0, sizeof(hints));
+  hints.ai_flags = AI_NUMERICHOST;
+
+  if (getaddrinfo("127.0.0.1", 0, &hints, &ai) < 0) {
+    return 1;
+  }
+
+  if (ai == 0) {
+    return 1;
+  }
+
+  pai = ai;
+
+  while (pai) {
+    if (pai->ai_family != AF_INET) {
+      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
+      return 1;
+    }
+    if (pai->ai_addr->sa_family != AF_INET) {
+      /* 127.0.0.1/NUMERICHOST should only resolve ONE way */
+      return 1;
+    }
+    pai = pai->ai_next;
+  }
+  freeaddrinfo(ai);
+  return 0;
+}
+  ])],
+  [php_cv_func_getaddrinfo=yes],
+  [php_cv_func_getaddrinfo=no],
+  [AS_CASE([$host_alias],
+    [*linux*|*midipix], [php_cv_func_getaddrinfo=yes],
+    [php_cv_func_getaddrinfo=no])])],
+[php_cv_func_getaddrinfo=no])])
+AS_VAR_IF([php_cv_func_getaddrinfo], [yes],
+  [AC_DEFINE([HAVE_GETADDRINFO], [1],
+    [Define to 1 if you have the 'getaddrinfo' function.])])
+
+dnl on FreeBSD, copy_file_range() works only with the undocumented flag 0x01000000;
+dnl until the problem is fixed properly, copy_file_range() is used only on Linux
+AC_CACHE_CHECK([for copy_file_range], [php_cv_func_copy_file_range],
+[AC_COMPILE_IFELSE([AC_LANG_SOURCE([
+#ifndef __linux__
+# error "unsupported platform"
+#endif
+#ifndef _GNU_SOURCE
+# define _GNU_SOURCE
+#endif
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5,3,0)
+# error "kernel too old"
+#endif
+#include <unistd.h>
+int main(void)
+{
+  (void)copy_file_range(-1, 0, -1, 0, 0, 0);
+  return 0;
+}
+])],
+[php_cv_func_copy_file_range=yes],
+[php_cv_func_copy_file_range=no])
+])
+AS_VAR_IF([php_cv_func_copy_file_range], [yes],
+  [AC_DEFINE([HAVE_COPY_FILE_RANGE], [1],
+    [Define to 1 if you have the 'copy_file_range' function.])])
+
+AC_REPLACE_FUNCS([strlcat strlcpy explicit_bzero getopt])
+AC_FUNC_ALLOCA
+PHP_TIME_R_TYPE
+
+AC_CACHE_CHECK([for aarch64 CRC32 API], [php_cv_func___crc32d],
+[AC_LINK_IFELSE([AC_LANG_PROGRAM([
+#include <arm_acle.h>
+# if defined(__GNUC__)
+#  if!defined(__clang__)
+#   pragma GCC push_options
+#   pragma GCC target ("+nothing+crc")
+#  elif defined(__APPLE__)
+#   pragma clang attribute push(__attribute__((target("crc"))), apply_to=function)
+#  else
+#   pragma clang attribute push(__attribute__((target("+nothing+crc"))), apply_to=function)
+#  endif
+# endif
+], [__crc32d(0, 0);])],
+[php_cv_func___crc32d=yes],
+[php_cv_func___crc32d=no])])
+AS_VAR_IF([php_cv_func___crc32d], [yes],
+  [AC_DEFINE([HAVE_AARCH64_CRC32], [1],
+    [Define to 1 when aarch64 CRC32 API is available.])])
+
+dnl Check for asm goto support.
+AC_CACHE_CHECK([for asm goto], [php_cv_have__asm_goto],
+[AC_LINK_IFELSE([AC_LANG_PROGRAM([], [
+#if defined(__x86_64__) || defined(__i386__)
+  __asm__ goto("jmp %l0\n" :::: end);
+#elif defined(__aarch64__)
+  __asm__ goto("b %l0\n" :::: end);
+#endif
+end:
+  return 0;
+])],
+[php_cv_have__asm_goto=yes],
+[php_cv_have__asm_goto=no])])
+AS_VAR_IF([php_cv_have__asm_goto], [yes],
+  [AC_DEFINE([HAVE_ASM_GOTO], [1],
+    [Define to 1 if asm goto support is available.])])
+
+dnl Check Valgrind support.
+PHP_ARG_WITH([valgrind],
+  [whether to enable Valgrind support],
+  [AS_HELP_STRING([--with-valgrind],
+    [Enable Valgrind support])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_VALGRIND], [no],, [
+  PKG_CHECK_MODULES([VALGRIND], [valgrind],
+     [PHP_EVAL_INCLINE([$VALGRIND_CFLAGS])
+       AC_DEFINE([HAVE_VALGRIND], [1],
+        [Define to 1 if Valgrind is enabled and supported.])])
+  save_CFLAGS=$CFLAGS
+  CFLAGS="$CFLAGS $VALGRIND_CFLAGS"
+  AC_CHECK_HEADERS([valgrind/cachegrind.h])
+  CFLAGS=$save_CFLAGS
+])
+
+dnl General settings.
+dnl ----------------------------------------------------------------------------
+PHP_CONFIGURE_PART([General settings])
+
+PHP_HELP_SEPARATOR([General settings:])
+
+PHP_ARG_ENABLE([gcov],
+  [whether to include gcov symbols],
+  [AS_HELP_STRING([--enable-gcov],
+    [Enable GCOV code coverage - FOR DEVELOPERS ONLY!!])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_GCOV], [yes], [
+  AS_VAR_IF([GCC], [yes],,
+    [AC_MSG_ERROR([GNU C compatible compiler is required for --enable-gcov])])
+
+  dnl Check if ccache is being used.
+  AS_CASE([$($php_shtool path $CC)],
+    [*ccache*], [gcc_ccache=yes],
+    [gcc_ccache=no])
+
+  if test "$gcc_ccache" = "yes" && (test -z "$CCACHE_DISABLE" || test "$CCACHE_DISABLE" != "1"); then
+    AC_MSG_ERROR(m4_text_wrap([
+      ccache must be disabled when --enable-gcov option is used. You can disable
+      ccache by setting environment variable CCACHE_DISABLE=1.
+    ]))
+  fi
+
+  AC_DEFINE([HAVE_GCOV], [1], [Define to 1 if GCOV code coverage is enabled.])
+  PHP_ADD_MAKEFILE_FRAGMENT([$abs_srcdir/build/Makefile.gcov], [$abs_srcdir])
+
+  dnl Remove all optimization flags from CFLAGS.
+  PHP_REMOVE_OPTIMIZATION_FLAGS
+
+  dnl Add the special gcc flags.
+  CFLAGS="$CFLAGS -O0 -fprofile-arcs -ftest-coverage"
+  CXXFLAGS="$CXXFLAGS -O0 -fprofile-arcs -ftest-coverage"
+])
+
+PHP_ARG_ENABLE([debug],
+  [whether to include debugging symbols],
+  [AS_HELP_STRING([--enable-debug],
+    [Compile with debugging symbols])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_DEBUG], [yes], [
+  PHP_DEBUG=1
+  ZEND_DEBUG=yes
+  PHP_REMOVE_OPTIMIZATION_FLAGS
+  dnl Add -O0 only if GCC or ICC is used.
+  if test "$GCC" = "yes" || test "$ICC" = "yes"; then
+    CFLAGS="$CFLAGS -O0"
+    CXXFLAGS="$CXXFLAGS -g -O0"
+  fi
+  if test "$SUNCC" = "yes"; then
+    if test -n "$auto_cflags"; then
+      CFLAGS="-g"
+      CXXFLAGS="-g"
+    else
+      CFLAGS="$CFLAGS -g"
+      CXXFLAGS="$CFLAGS -g"
+    fi
+  fi
+], [
+  PHP_DEBUG=0
+  ZEND_DEBUG=no
+])
+
+PHP_ARG_ENABLE([debug-assertions],
+  [whether to enable debug assertions in release mode],
+  [AS_HELP_STRING([--enable-debug-assertions],
+    [Compile with debug assertions even in release mode])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_DEBUG_ASSERTIONS], [yes], [
+  PHP_DEBUG=1
+  ZEND_DEBUG=yes
+])
+
+AC_ARG_ENABLE([zts],
+  [AS_HELP_STRING([--enable-zts],
+    [Enable thread safety])],
+  [ZEND_ZTS=$enableval],
+  [ZEND_ZTS=no])
+
+AS_VAR_IF([ZEND_ZTS], [yes], [PHP_THREAD_SAFETY=yes], [PHP_THREAD_SAFETY=no])
+
+AS_VAR_IF([PHP_THREAD_SAFETY], [yes], [
+  AS_VAR_IF([pthreads_working], [yes], [],
+    [AC_MSG_FAILURE(m4_text_wrap([
+      Unable to verify system support for POSIX Threads, which are required for
+      PHP thread safety (ZTS) build.
+    ]))])
+
+  AC_MSG_CHECKING([for POSIX threads])
+  AC_MSG_RESULT([yes])
+])
+
+PHP_ARG_ENABLE([rtld-now],
+  [whether to dlopen extensions with RTLD_NOW instead of RTLD_LAZY],
+  [AS_HELP_STRING([--enable-rtld-now],
+    [Use dlopen with RTLD_NOW instead of RTLD_LAZY])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_RTLD_NOW], [yes],
+  [AC_DEFINE([PHP_USE_RTLD_NOW], [1],
+    [Define to 1 if 'dlopen()' uses the 'RTLD_NOW' mode flag instead of
+    'RTLD_LAZY'.])])
+
+PHP_ARG_WITH([layout],
+  [layout of installed files],
+  [AS_HELP_STRING([--with-layout=TYPE],
+    [Set how installed files will be laid out. Type can be either PHP or GNU [PHP]])],
+  [PHP],
+  [no])
+
+AS_CASE([$PHP_LAYOUT], [GNU], [oldstyleextdir=no], [oldstyleextdir=yes])
+
+PHP_ARG_WITH([config-file-path],
+  [path to configuration file],
+  [AS_HELP_STRING([--with-config-file-path=PATH],
+    [Set the path in which to look for php.ini [PREFIX/lib]])],
+  [DEFAULT],
+  [no])
+
+AS_VAR_IF([PHP_CONFIG_FILE_PATH], [DEFAULT],
+  [AS_CASE([$PHP_LAYOUT],
+    [GNU], [PHP_CONFIG_FILE_PATH=$sysconfdir],
+    [PHP_CONFIG_FILE_PATH=$libdir])])
+
+AC_MSG_CHECKING([where to scan for configuration files])
+PHP_ARG_WITH([config-file-scan-dir],,
+  [AS_HELP_STRING([--with-config-file-scan-dir=PATH],
+    [Set the path where to scan for configuration files])],
+  [DEFAULT],
+  [no])
+
+AS_VAR_IF([PHP_CONFIG_FILE_SCAN_DIR], [DEFAULT], [PHP_CONFIG_FILE_SCAN_DIR=])
+AC_MSG_RESULT([$PHP_CONFIG_FILE_SCAN_DIR])
+
+PHP_ARG_ENABLE([sigchild],
+  [whether to enable PHP's own SIGCHLD handler],
+  [AS_HELP_STRING([--enable-sigchild],
+    [Enable PHP's own SIGCHLD handler])],
+  [no],
+  [no])
+
+AH_TEMPLATE([PHP_SIGCHILD],
+  [Define to 1 if PHP uses its own SIGCHLD handler, and to 0 if not.])
+AS_VAR_IF([PHP_SIGCHILD], [yes],
+  [AC_DEFINE([PHP_SIGCHILD], [1])],
+  [AC_DEFINE([PHP_SIGCHILD], [0])])
+
+PHP_ARG_ENABLE([libgcc],
+  [whether to explicitly link against libgcc],
+  [AS_HELP_STRING([--enable-libgcc],
+    [Enable explicitly linking against libgcc])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_LIBGCC], [yes], [
+  PHP_LIBGCC_LIBPATH([gcc])
+  AS_VAR_IF([libgcc_libpath],,
+    [AC_MSG_ERROR([Cannot locate libgcc. Make sure that gcc is in your path])])
+  PHP_ADD_LIBPATH([$libgcc_libpath])
+  PHP_ADD_LIBRARY([gcc], [yes])
+])
+
+PHP_ARG_ENABLE([short-tags],
+  [whether to enable short tags by default],
+  [AS_HELP_STRING([--disable-short-tags],
+    [Disable the short-form <? start tag by default])],
+  [yes],
+  [no])
+
+AH_TEMPLATE([DEFAULT_SHORT_OPEN_TAG],
+  [Define to string "1" if PHP short open tags '<?' are enabled by default, and
+  to string "0" if they are not.])
+AS_VAR_IF([PHP_SHORT_TAGS], [yes],
+  [AC_DEFINE([DEFAULT_SHORT_OPEN_TAG], ["1"])],
+  [AC_DEFINE([DEFAULT_SHORT_OPEN_TAG], ["0"])])
+
+PHP_ARG_ENABLE([dmalloc],
+  [whether to enable dmalloc],
+  [AS_HELP_STRING([--enable-dmalloc],
+    [Enable dmalloc])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_DMALLOC], [yes],
+  [AC_CHECK_LIB([dmalloc], [dmalloc_error],
+    [PHP_ADD_LIBRARY([dmalloc])
+      AC_DEFINE([HAVE_DMALLOC], [1], [Define to 1 if you have dmalloc.])
+      AS_VAR_APPEND([CPPFLAGS], [" -DDMALLOC_FUNC_CHECK"])],
+    [AC_MSG_FAILURE([The dmalloc check failed. Cannot enable dmalloc.])])])
+
+PHP_ARG_ENABLE([ipv6],
+  [whether to enable IPv6 support],
+  [AS_HELP_STRING([--disable-ipv6],
+    [Disable IPv6 support])],
+  [yes],
+  [no])
+
+AS_VAR_IF([PHP_IPV6], [yes],
+  [AC_CACHE_CHECK([for IPv6 support], [php_cv_have_ipv6],
+    [AC_LINK_IFELSE([AC_LANG_PROGRAM([
+      #include <sys/types.h>
+      #include <sys/socket.h>
+      #include <netinet/in.h>
+    ], [[
+      struct sockaddr_in6 s;
+      struct in6_addr t = in6addr_any;
+      int i = AF_INET6;
+      (void)s;
+      t.s6_addr[0] = 0;
+      (void)i;
+    ]])],
+    [php_cv_have_ipv6=yes],
+    [php_cv_have_ipv6=no])])
+])
+AS_VAR_IF([php_cv_have_ipv6], [yes],
+  [AC_DEFINE([HAVE_IPV6], [1],
+    [Define to 1 if IPv6 is enabled and supported.])])
+
+dnl DTRACE checks. Note: this has to be done after SAPI configuration.
+PHP_ARG_ENABLE([dtrace],
+  [whether to enable DTrace support],
+  [AS_HELP_STRING([--enable-dtrace],
+    [Enable DTrace support])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_DTRACE], [yes], [
+  PHP_INIT_DTRACE([Zend/zend_dtrace.d], [Zend/zend_dtrace_gen.h], [
+    main/main.c
+    Zend/zend_API.c
+    Zend/zend_dtrace.c
+    Zend/zend_exceptions.c
+    Zend/zend_execute.c
+    Zend/zend.c
+  ])
+  AC_DEFINE([HAVE_DTRACE], [1], [Define to 1 if DTrace support is enabled.])
+])
+
+AC_MSG_CHECKING([how big to make fd sets])
+PHP_ARG_ENABLE([fd-setsize],,
+  [AS_HELP_STRING([--enable-fd-setsize],
+    [Set size of descriptor sets])],
+  [no],
+  [no])
+
+AS_VAR_IF([PHP_FD_SETSIZE], [no], [AC_MSG_RESULT([using system default])], [
+  if test "0$PHP_FD_SETSIZE" -gt 0 2>/dev/null; then
+    CPPFLAGS="$CPPFLAGS -DFD_SETSIZE=$PHP_FD_SETSIZE"
+    AC_MSG_RESULT([using $PHP_FD_SETSIZE])
+  else
+    AC_MSG_ERROR([Invalid value passed to --enable-fd-setsize!])
+  fi
+])
+
+PHP_ARG_ENABLE([werror],,
+  [AS_HELP_STRING([--enable-werror],
+    [Enable -Werror])],
+  [no],
+  [no])
+PHP_ARG_ENABLE([memory-sanitizer],,
+  [AS_HELP_STRING([--enable-memory-sanitizer],
+    [Enable memory sanitizer (clang only)])],
+  [no],
+  [no])
+PHP_ARG_ENABLE([address-sanitizer],,
+  [AS_HELP_STRING([--enable-address-sanitizer],
+    [Enable address sanitizer])],
+  [no],
+  [no])
+PHP_ARG_ENABLE([undefined-sanitizer],,
+  [AS_HELP_STRING([--enable-undefined-sanitizer],
+    [Enable undefined sanitizer])],
+  [no],
+  [no])
+
+dnl Extension configuration.
+dnl ----------------------------------------------------------------------------
+
+PHP_HELP_SEPARATOR([[Extensions:
+  --with-EXTENSION=[shared[,PATH]]
+
+    NOTE: Not all extensions can be built as 'shared'.
+
+    Example: --with-foobar=shared,/usr/local/foobar/
+
+      o Builds the foobar extension as shared extension.
+      o foobar package install prefix is /usr/local/foobar/
+]])
+
+PHP_CONFIGURE_PART([Configuring extensions])
+
+dnl Check if all enabled by default extensions should be disabled.
+AC_ARG_ENABLE([all],
+  [AS_HELP_STRING([--disable-all],
+    [Disable all extensions which are enabled by default])],
+  [PHP_ENABLE_ALL=$enableval])
+
+dnl Reading config stubs.
+esyscmd(./build/config-stubs ext)
+
+dnl Extensions post-config.
+dnl ----------------------------------------------------------------------------
+
+dnl Align segments on huge page boundary
+AS_CASE([$host_alias], [[i[3456]86-*-linux-* | x86_64-*-linux-*]],
+  [AC_CACHE_CHECK([linker support for -zcommon-page-size=2097152],
+    [php_cv_have_common_page_size], [
+    save_LDFLAGS=$LDFLAGS
+    LDFLAGS="$LDFLAGS -Wl,-zcommon-page-size=2097152 -Wl,-zmax-page-size=2097152"
+    AC_RUN_IFELSE([AC_LANG_PROGRAM()],
+      [php_cv_have_common_page_size=yes],
+      [php_cv_have_common_page_size=no],
+      [php_cv_have_common_page_size=no])
+    LDFLAGS=$save_LDFLAGS])
+  AS_VAR_IF([php_cv_have_common_page_size], [yes],
+    [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM -Wl,-zcommon-page-size=2097152 -Wl,-zmax-page-size=2097152"],
+    [AC_CACHE_CHECK([linker support for -zmax-page-size=2097152],
+      [php_cv_have_max_page_size], [
+      save_LDFLAGS=$LDFLAGS
+      LDFLAGS="$LDFLAGS -Wl,-zmax-page-size=2097152"
+      AC_RUN_IFELSE([AC_LANG_PROGRAM()],
+        [php_cv_have_max_page_size=yes],
+        [php_cv_have_max_page_size=no],
+        [php_cv_have_max_page_size=no])
+      LDFLAGS=$save_LDFLAGS])
+    AS_VAR_IF([php_cv_have_max_page_size], [yes],
+      [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM -Wl,-zmax-page-size=2097152"])
+  ])
+])
+
+enable_shared=yes
+enable_static=yes
+
+case $php_sapi_module in
+  shared[)]
+    if test "$PHP_CGI" = "no" && test "$PHP_CLI" = "no" && test "$PHP_FPM" = "no" && test "$PHP_LITESPEED" = "no" && test "$PHP_PHPDBG" = "no"; then
+      enable_static=no
+    fi
+    case $with_pic in
+      yes)
+        standard_libtool_flag='-prefer-pic'
+        ;;
+      no)
+        standard_libtool_flag='-prefer-non-pic'
+        ;;
+    esac
+    EXTRA_LDFLAGS="$EXTRA_LDFLAGS -avoid-version -module"
+    ;;
+  *[)]
+    standard_libtool_flag='-prefer-non-pic -static'
+    if test -z "$PHP_MODULES" && test -z "$PHP_ZEND_EX"; then
+      enable_shared=no
+    fi
+    ;;
+esac
+
+EXTRA_LIBS="$EXTRA_LIBS $DLIBS $LIBS"
+unset LIBS
+
+dnl PEAR
+dnl ----------------------------------------------------------------------------
+
+PHP_HELP_SEPARATOR([PEAR:])
+PHP_CONFIGURE_PART([Configuring PEAR])
+
+dnl If CLI is disabled disable PEAR.
+AS_VAR_IF([PHP_CLI], [no], [with_pear=no])
+
+PHP_ARG_WITH([pear],
+  [whether to install PEAR],
+  [AS_HELP_STRING([[--with-pear[=DIR]]],
+    [Install PEAR in DIR [PREFIX/lib/php]])],
+  [no],
+  [yes])
+
+AS_VAR_IF([PHP_PEAR], [no],, [
+  AC_MSG_WARN([The --with-pear option is deprecated])
+
+  dnl PEAR dependencies.
+  AS_VAR_IF([PHP_XML], [no], [AC_MSG_ERROR(m4_text_wrap([
+    PEAR requires XML to be enabled. Add '--enable-xml' to the configure line,
+    or disable PEAR (--without-pear).
+  ]))])
+
+  install_pear=install-pear
+
+  AS_VAR_IF([PHP_PEAR], [yes],
+    [AS_CASE([$PHP_LAYOUT],
+      [GNU], [PEAR_INSTALLDIR=$datadir/pear],
+      [PEAR_INSTALLDIR=$libdir/php])],
+    [PEAR_INSTALLDIR=$PHP_PEAR])
+
+  PHP_SUBST([PEAR_INSTALLDIR])
+  PHP_ADD_BUILD_DIR([pear])
+  PHP_ADD_MAKEFILE_FRAGMENT([$abs_srcdir/pear/Makefile.frag],
+    [$abs_srcdir/pear],
+    [pear])
+])
+
+dnl Configuring Zend and TSRM.
+dnl ----------------------------------------------------------------------------
+
+PHP_HELP_SEPARATOR([Zend:])
+PHP_CONFIGURE_PART([Configuring Zend])
+
+AC_ARG_ENABLE([fiber-asm],
+  [AS_HELP_STRING([--disable-fiber-asm],
+    [Disable the use of boost fiber assembly files])],
+  [fiber_asm=$enableval], [fiber_asm='yes'])
+
+AS_CASE([$host_cpu],
+  [x86_64*|amd64*], [fiber_cpu="x86_64"],
+  [x86*|amd*|i?86*|pentium], [fiber_cpu="i386"],
+  [aarch64*|arm64*], [fiber_cpu="arm64"],
+  [arm*], [fiber_cpu="arm32"],
+  [ppc64*|powerpc64*], [fiber_cpu="ppc64"],
+  [ppc*|powerpc*], [fiber_cpu="ppc32"],
+  [riscv64*], [fiber_cpu="riscv64"],
+  [sparc64], [fiber_cpu="sparc64"],
+  [s390x*], [fiber_cpu="s390x"],
+  [loongarch64*], [fiber_cpu="loongarch64"],
+  [mips64*], [fiber_cpu="mips64"],
+  [mips*], [fiber_cpu="mips32"],
+  [fiber_cpu="unknown"]
+)
+
+AS_CASE([$host_os],
+  [darwin*], [fiber_os="mac"],
+  [aix*|os400*], [fiber_os="aix"],
+  [freebsd*], [fiber_os="freebsd"],
+  [midipix], [fiber_os="midipix"],
+  [fiber_os="other"]
+)
+
+AS_CASE([$fiber_cpu],
+  [x86_64], [fiber_asm_file_prefix="x86_64_sysv"],
+  [i386], [fiber_asm_file_prefix="i386_sysv"],
+  [arm64], [fiber_asm_file_prefix="arm64_aapcs"],
+  [arm32], [fiber_asm_file_prefix="arm_aapcs"],
+  [ppc64], [fiber_asm_file_prefix="ppc64_sysv"],
+  [ppc32], [fiber_asm_file_prefix="ppc32_sysv"],
+  [riscv64], [fiber_asm_file_prefix="riscv64_sysv"],
+  [sparc64], [fiber_asm_file_prefix="sparc64_sysv"],
+  [s390x], [fiber_asm_file_prefix="s390x_sysv"],
+  [loongarch64], [fiber_asm_file_prefix="loongarch64_sysv"],
+  [mips64], [fiber_asm_file_prefix="mips64_n64"],
+  [mips32], [fiber_asm_file_prefix="mips32_o32"],
+  [fiber_asm_file_prefix="unknown"]
+)
+
+if test "$fiber_os" = 'mac'; then
+  fiber_asm_file="combined_sysv_macho_gas"
+elif test "$fiber_os" = 'aix'; then
+  # AIX uses a different calling convention (shared with non-_CALL_ELF Linux).
+  # The AIX assembler isn't GNU, but the file is compatible.
+  fiber_asm_file="${fiber_asm_file_prefix}_xcoff_gas"
+elif test "$fiber_os" = 'freebsd'; then
+  case $fiber_cpu in
+    i386*)
+      fiber_asm="no"
+      ;;
+    *)
+      fiber_asm_file="${fiber_asm_file_prefix}_elf_gas"
+      ;;
+  esac
+elif test "$fiber_os" = 'midipix'; then
+  case $fiber_cpu in
+    i386*)
+      fiber_asm="no"
+      ;;
+    x86_64)
+      fiber_asm_file="x86_64_ms_pe_gas"
+      ;;
+  esac
+elif test "$fiber_asm_file_prefix" != 'unknown'; then
+  fiber_asm_file="${fiber_asm_file_prefix}_elf_gas"
+else
+  fiber_asm="no"
+fi
+
+AC_CACHE_CHECK([whether syscall to create shadow stack exists],
+[php_cv_have_shadow_stack_syscall],
+[AC_RUN_IFELSE([AC_LANG_SOURCE([
+#include <unistd.h>
+#include <sys/mman.h>
+int main(void) {
+  /* test if syscall 451, i.e., map_shadow_stack is available */
+  void* base = (void *)syscall(451, 0, 0x20000, 0x1);
+  if (base != (void*)-1) {
+    munmap(base, 0x20000);
+    return 0;
+  }
+  return 1;
+}
+])],
+  [php_cv_have_shadow_stack_syscall=yes],
+  [php_cv_have_shadow_stack_syscall=no],
+  [php_cv_have_shadow_stack_syscall=no])
+])
+dnl The asm files can't see macro from AC_DEFINE, workaround this via cflag. If
+dnl the syscall doesn't exist, we may block the final ELF from __PROPERTY_SHSTK
+dnl via redefine macro as "-D__CET__=1".
+AS_VAR_IF([php_cv_have_shadow_stack_syscall], [yes],
+  [fiber_asm_cflag="-DSHADOW_STACK_SYSCALL=1"],
+  [fiber_asm_cflag="-DSHADOW_STACK_SYSCALL=0"])
+
+if test "$fiber_asm" = 'yes'; then
+  AC_MSG_CHECKING([for fiber switching context])
+  PHP_ADD_SOURCES([Zend/asm],
+    [make_${fiber_asm_file}.S jump_${fiber_asm_file}.S],
+    [$fiber_asm_cflag])
+  AC_MSG_RESULT([$fiber_asm_file])
+else
+  AS_VAR_IF([fiber_os], [mac], [AC_DEFINE([_XOPEN_SOURCE], [1], [ ])])
+  AC_CHECK_HEADER([ucontext.h],
+    [AC_DEFINE([ZEND_FIBER_UCONTEXT], [1],
+      [Define to 1 if Zend fiber uses ucontext instead of boost context.])],
+    [AC_MSG_FAILURE([fibers not available on this platform])])
+fi
+
+ZEND_INIT
+
+ZEND_EXTRA_LIBS=$LIBS
+unset LIBS
+
+PHP_ADD_INCLUDE([$abs_srcdir], [1])
+PHP_ADD_INCLUDE([$abs_srcdir/main], [1])
+PHP_ADD_INCLUDE([$abs_builddir], [1])
+PHP_ADD_INCLUDE([$abs_builddir/main], [1])
+PHP_ADD_INCLUDE([$abs_builddir/TSRM])
+PHP_ADD_INCLUDE([$abs_builddir/Zend])
+PHP_ADD_INCLUDE([$abs_srcdir/Zend])
+PHP_ADD_INCLUDE([$abs_srcdir/TSRM])
+
+EXTRA_LDFLAGS="$EXTRA_LDFLAGS $LDFLAGS"
+EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $LDFLAGS"
+unset LDFLAGS
+
+AC_ARG_PROGRAM
+
+AS_VAR_IF([prefix], [NONE], [prefix=/usr/local])
+AS_VAR_IF([exec_prefix], [NONE], [exec_prefix='${prefix}'])
+AS_VAR_IF([program_prefix], [NONE], [program_prefix=])
+AS_VAR_IF([program_suffix], [NONE], [program_suffix=])
+
+orig_libdir=$libdir
+AS_CASE([$libdir],
+  ['${exec_prefix}/lib'], [libdir=$libdir/php])
+
+AS_CASE([$(eval echo $datadir)],
+  ['${prefix}/share'], [datadir=$datadir/php])
+
+phptempdir=$(pwd)/libs
+
+old_exec_prefix=$exec_prefix
+old_libdir=$libdir
+old_datadir=$datadir
+exec_prefix=$(eval echo $exec_prefix)
+libdir=$(eval echo $libdir)
+datadir=$(eval eval echo $datadir)
+
+dnl Build extension directory path.
+ZEND_MODULE_API_NO=$($EGREP '#define ZEND_MODULE_API_NO ' $srcdir/Zend/zend_modules.h|"${SED}" 's/#define ZEND_MODULE_API_NO //')
+
+AC_ARG_VAR([EXTENSION_DIR],
+  [Default directory for dynamically loadable PHP extensions. If left empty, it
+  is determined automatically. Can be overridden using the PHP 'extension_dir'
+  INI directive.])
+AS_VAR_IF([EXTENSION_DIR],, [
+  extbasedir=$ZEND_MODULE_API_NO
+  AS_VAR_IF([oldstyleextdir], [yes], [
+    AS_VAR_IF([PHP_DEBUG], [1], [part1=debug], [part1=no-debug])
+    AS_VAR_IF([PHP_THREAD_SAFETY], [yes], [part2=zts], [part2=non-zts])
+    extbasedir=$part1-$part2-$extbasedir
+    EXTENSION_DIR=$libdir/extensions/$extbasedir
+  ], [
+    AS_VAR_IF([PHP_THREAD_SAFETY], [yes], [extbasedir=$extbasedir-zts])
+    AS_VAR_IF([PHP_DEBUG], [1], [extbasedir=$extbasedir-debug])
+    EXTENSION_DIR=$libdir/$extbasedir
+  ])
+])
+
+AS_CASE([$PHP_LAYOUT],
+  [GNU], [datarootdir=$prefix/share],
+  [datarootdir=$prefix/php])
+
+dnl Expand all directory names for use in macros/constants.
+EXPANDED_PEAR_INSTALLDIR=$(eval echo $PEAR_INSTALLDIR)
+EXPANDED_EXTENSION_DIR=$(eval echo $EXTENSION_DIR)
+EXPANDED_LOCALSTATEDIR=$(eval echo $localstatedir)
+EXPANDED_BINDIR=$(eval echo $bindir)
+EXPANDED_SBINDIR=$(eval echo $sbindir)
+EXPANDED_MANDIR=$(eval echo $mandir)
+EXPANDED_LIBDIR=$libdir
+EXPANDED_SYSCONFDIR=$(eval echo $sysconfdir)
+EXPANDED_DATADIR=$datadir
+EXPANDED_PHP_CONFIG_FILE_PATH=$(eval echo "$PHP_CONFIG_FILE_PATH")
+EXPANDED_PHP_CONFIG_FILE_SCAN_DIR=$(eval echo "$PHP_CONFIG_FILE_SCAN_DIR")
+INCLUDE_PATH=.:$EXPANDED_PEAR_INSTALLDIR
+
+exec_prefix=$old_exec_prefix
+libdir=$old_libdir
+datadir=$old_datadir
+
+AC_SUBST([INCLUDE_PATH])
+AC_SUBST([EXPANDED_PEAR_INSTALLDIR])
+AC_SUBST([EXPANDED_EXTENSION_DIR])
+AC_SUBST([EXPANDED_BINDIR])
+AC_SUBST([EXPANDED_SBINDIR])
+AC_SUBST([EXPANDED_MANDIR])
+AC_SUBST([EXPANDED_LIBDIR])
+AC_SUBST([EXPANDED_DATADIR])
+AC_SUBST([EXPANDED_SYSCONFDIR])
+AC_SUBST([EXPANDED_LOCALSTATEDIR])
+AC_SUBST([EXPANDED_PHP_CONFIG_FILE_PATH])
+AC_SUBST([EXPANDED_PHP_CONFIG_FILE_SCAN_DIR])
+AC_SUBST([PHP_INSTALLED_SAPIS])
+AC_SUBST([SAPI_LIBNAME_SHARED])
+AC_SUBST([SAPI_LIBNAME_STATIC])
+AC_SUBST([PHP_VERSION])
+AC_SUBST([PHP_VERSION_ID])
+AC_SUBST([PHP_LDFLAGS])
+
+PHP_UTILIZE_RPATHS
+
+PHP_REMOVE_USR_LIB([PHP_LDFLAGS])
+PHP_REMOVE_USR_LIB([LDFLAGS])
+
+EXTRA_LDFLAGS="$EXTRA_LDFLAGS $PHP_LDFLAGS"
+EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $PHP_LDFLAGS"
+
+AC_ARG_VAR([PHP_UNAME],
+  [System information (defaults to the 'uname -a' output)])
+AS_VAR_IF([PHP_UNAME],, [PHP_UNAME=$(uname -a | xargs)])
+AC_DEFINE_UNQUOTED([PHP_UNAME], ["$PHP_UNAME"], [The 'uname -a' output.])
+
+PHP_OS=$(uname | xargs)
+AC_DEFINE_UNQUOTED([PHP_OS], ["$PHP_OS"], [The 'uname' output.])
+
+AC_ARG_VAR([PHP_BUILD_SYSTEM],
+  [The system that PHP was built on (defaults to the 'uname -a' output)])
+AS_VAR_IF([PHP_BUILD_SYSTEM],, [PHP_BUILD_SYSTEM=$PHP_UNAME])
+AC_DEFINE_UNQUOTED([PHP_BUILD_SYSTEM], ["$PHP_BUILD_SYSTEM"],
+  [The system that PHP was built on.])
+
+AC_ARG_VAR([PHP_BUILD_PROVIDER], [The PHP build provider information])
+AS_VAR_IF([PHP_BUILD_PROVIDER],,,
+  [AC_DEFINE_UNQUOTED([PHP_BUILD_PROVIDER], ["$PHP_BUILD_PROVIDER"],
+    [The PHP build provider information.])])
+
+AC_ARG_VAR([PHP_BUILD_COMPILER],
+  [Information about the compiler used for the PHP build])
+AS_VAR_IF([PHP_BUILD_COMPILER],,,
+  [AC_DEFINE_UNQUOTED([PHP_BUILD_COMPILER], ["$PHP_BUILD_COMPILER"],
+    [The compiler used for the PHP build.])])
+
+AC_ARG_VAR([PHP_BUILD_ARCH], [The build architecture])
+AS_VAR_IF([PHP_BUILD_ARCH],,,
+  [AC_DEFINE_UNQUOTED([PHP_BUILD_ARCH], ["$PHP_BUILD_ARCH"],
+    [The build architecture.])])
+
+PHP_SUBST([PHP_FASTCGI_OBJS])
+PHP_SUBST([PHP_SAPI_OBJS])
+PHP_SUBST([PHP_BINARY_OBJS])
+PHP_SUBST([PHP_GLOBAL_OBJS])
+PHP_SUBST([PHP_BINARIES])
+PHP_SUBST([PHP_MODULES])
+PHP_SUBST([PHP_ZEND_EX])
+PHP_SUBST([bindir])
+PHP_SUBST([sbindir])
+PHP_SUBST([exec_prefix])
+PHP_SUBST_OLD([program_prefix])
+PHP_SUBST_OLD([program_suffix])
+PHP_SUBST([includedir])
+PHP_SUBST_OLD([orig_libdir])
+PHP_SUBST([libdir])
+PHP_SUBST([mandir])
+PHP_SUBST([phptempdir])
+PHP_SUBST([prefix])
+PHP_SUBST([localstatedir])
+PHP_SUBST([datadir])
+PHP_SUBST([datarootdir])
+PHP_SUBST([sysconfdir])
+PHP_SUBST([EXEEXT])
+PHP_SUBST([CC])
+PHP_SUBST([BUILD_CC])
+PHP_SUBST([CFLAGS])
+PHP_SUBST([CFLAGS_CLEAN])
+PHP_SUBST([CPP])
+PHP_SUBST([CPPFLAGS])
+PHP_SUBST([CXX])
+PHP_SUBST([CXXFLAGS])
+PHP_SUBST([CXXFLAGS_CLEAN])
+PHP_SUBST_OLD([EXTENSION_DIR])
+PHP_SUBST([EXTRA_LDFLAGS])
+PHP_SUBST([EXTRA_LDFLAGS_PROGRAM])
+PHP_SUBST_OLD([EXTRA_LIBS])
+PHP_SUBST([ZEND_EXTRA_LIBS])
+PHP_SUBST([INCLUDES])
+PHP_SUBST([EXTRA_INCLUDES])
+PHP_SUBST([INSTALL_IT])
+PHP_SUBST([LIBTOOL])
+PHP_SUBST([LN_S])
+PHP_SUBST([NATIVE_RPATHS])
+PHP_SUBST([OVERALL_TARGET])
+PHP_SUBST([PHP_RPATHS])
+PHP_SUBST([PHP_SAPI])
+PHP_SUBST([SHELL])
+PHP_SUBST([PHP_FRAMEWORKS])
+PHP_SUBST([PHP_FRAMEWORKPATH])
+PHP_SUBST([INSTALL_HEADERS])
+
+if test "$PHP_THREAD_SAFETY" = "yes" && test -n "$ac_cv_pthreads_cflags"; then
+  CXXFLAGS="$CXXFLAGS $ac_cv_pthreads_cflags"
+  CPPFLAGS="$CPPFLAGS $ac_cv_pthreads_cflags"
+fi
+
+dnl Enable -Werror late, because it may break configure checks throwing warnings.
+AS_VAR_IF([PHP_WERROR], [yes], [
+  CFLAGS="$CFLAGS -Werror"
+  CXXFLAGS="$CXXFLAGS -Werror"
+])
+
+if test "$PHP_MEMORY_SANITIZER" = "yes" &&
+   test "$PHP_ADDRESS_SANITIZER" = "yes"; then
+   AC_MSG_ERROR([MemorySanitizer and AddressSanitizer are mutually exclusive])
+fi
+
+dnl Enable -fsanitize=memory late, because interceptors may break linking detection.
+AS_VAR_IF([PHP_MEMORY_SANITIZER], [yes],
+  [AX_CHECK_COMPILE_FLAG([-fsanitize=memory -fsanitize-memory-track-origins], [
+    CFLAGS="$CFLAGS -fsanitize=memory -fsanitize-memory-track-origins"
+    CXXFLAGS="$CXXFLAGS -fsanitize=memory -fsanitize-memory-track-origins"
+  ], [AC_MSG_ERROR([MemorySanitizer is not available])])
+])
+
+AS_VAR_IF([PHP_ADDRESS_SANITIZER], [yes],
+  [AS_VAR_IF([PHP_VALGRIND], [no],, [AC_MSG_ERROR(m4_text_wrap([
+    Valgrind and address sanitizer are not compatible. Either disable Valgrind
+    (remove --with-valgrind) or disable address sanitizer (remove
+    --enable-address-sanitizer).
+  ]))])
+
+  AX_CHECK_COMPILE_FLAG([-fsanitize=address], [
+    CFLAGS="$CFLAGS -fsanitize=address -DZEND_TRACK_ARENA_ALLOC"
+    CXXFLAGS="$CXXFLAGS -fsanitize=address -DZEND_TRACK_ARENA_ALLOC"
+  ], [AC_MSG_ERROR([AddressSanitizer is not available])])
+])
+
+AS_VAR_IF([PHP_UNDEFINED_SANITIZER], [yes],
+  [AX_CHECK_COMPILE_FLAG([-fsanitize=undefined], [
+    CFLAGS="$CFLAGS -fsanitize=undefined -fno-sanitize-recover=undefined"
+    CXXFLAGS="$CXXFLAGS -fsanitize=undefined -fno-sanitize-recover=undefined"
+    AX_CHECK_COMPILE_FLAG([-fno-sanitize=object-size], [
+      dnl Disable object-size sanitizer, because it is incompatible with our zend_function
+      dnl union, and this can't be easily fixed.
+      CFLAGS="$CFLAGS -fno-sanitize=object-size"
+      CXXFLAGS="$CFLAGS -fno-sanitize=object-size"
+    ])
+
+    dnl Clang 17 adds stricter function pointer compatibility checks where pointer args cannot be
+    dnl cast to void*. In that case, set -fno-sanitize=function.
+    OLD_CFLAGS=$CFLAGS
+    CFLAGS="$CFLAGS -fno-sanitize-recover=undefined"
+    AC_CACHE_CHECK([whether to add -fno-sanitize=function],
+    [php_cv_ubsan_no_function],
+    [AC_RUN_IFELSE([AC_LANG_SOURCE([
+      void foo(char *string) { (void)string; }
+      int main(void) {
+        void (*f)(void *) = (void (*)(void *))foo;
+        f("foo");
+        return 0;
+      }
+    ])],
+    [php_cv_ubsan_no_function=no],
+    [php_cv_ubsan_no_function=yes],
+    [php_cv_ubsan_no_function=no])])
+    CFLAGS=$OLD_CFLAGS
+    AS_VAR_IF([php_cv_ubsan_no_function], [yes], [
+      CFLAGS="$CFLAGS -fno-sanitize=function"
+      CXXFLAGS="$CFLAGS -fno-sanitize=function"
+    ])
+  ], [AC_MSG_ERROR([UndefinedBehaviorSanitizer is not available])])
+])
+
+if test "$PHP_MEMORY_SANITIZER" = "yes" ||
+   test "$PHP_ADDRESS_SANITIZER" = "yes" ||
+   test "$PHP_UNDEFINED_SANITIZER" = "yes"; then
+    CFLAGS="$CFLAGS -fno-omit-frame-pointer"
+    CXXFLAGS="$CXXFLAGS -fno-omit-frame-pointer"
+fi
+
+dnl
+dnl Libtool creation.
+dnl
+
+PHP_HELP_SEPARATOR([Libtool:])
+PHP_CONFIGURE_PART([Configuring libtool])
+
+dnl Silence warning: "ar: 'u' modifier ignored since 'D' is the default".
+dnl See https://github.com/php/php-src/pull/3017
+AC_SUBST([AR_FLAGS], [cr])
+
+dnl Only allow AC_PROG_CXX and AC_PROG_CXXCPP if they are explicitly called (by
+dnl PHP_REQUIRE_CXX). Otherwise AC_PROG_LIBTOOL fails if there is no working C++
+dnl compiler.
+AC_PROVIDE_IFELSE([PHP_REQUIRE_CXX], [], [
+  undefine([AC_PROG_CXX])
+  AC_DEFUN([AC_PROG_CXX], [])
+  undefine([AC_PROG_CXXCPP])
+  AC_DEFUN([AC_PROG_CXXCPP], [php_prog_cxxcpp=disabled])
+])
+AC_PROG_LIBTOOL
+
+PHP_SET_LIBTOOL_VARIABLE([--silent])
+
+dnl libtool 1.4.3 needs this.
+PHP_SET_LIBTOOL_VARIABLE([--preserve-dup-deps])
+
+PHP_CONFIGURE_PART([Generating files])
+
+CXXFLAGS_CLEAN=$CXXFLAGS
+CFLAGS_CLEAN="$CFLAGS \$(PROF_FLAGS)"
+CFLAGS="\$(CFLAGS_CLEAN) $standard_libtool_flag"
+CXXFLAGS="$CXXFLAGS $standard_libtool_flag \$(PROF_FLAGS)"
+
+if test "$PHP_PHAR" != "no" && test "$PHP_CLI" != "no"; then
+  pharcmd=pharcmd
+  pharcmd_install=install-pharcmd
+else
+  pharcmd=
+  pharcmd_install=
+fi;
+
+all_targets="\$(OVERALL_TARGET) \$(PHP_MODULES) \$(PHP_ZEND_EX) \$(PHP_BINARIES) $pharcmd"
+install_targets="$install_sapi $install_modules $install_binaries install-build install-headers install-programs $install_pear $pharcmd_install"
+
+PHP_SUBST([all_targets])
+PHP_SUBST([install_targets])
+PHP_SUBST([install_binary_targets])
+
+PHP_INSTALL_HEADERS([Zend/ TSRM/ main/ main/streams/])
+PHP_INSTALL_HEADERS([Zend/Optimizer], m4_normalize([
+  zend_call_graph.h
+  zend_cfg.h
+  zend_dfg.h
+  zend_dump.h
+  zend_func_info.h
+  zend_inference.h
+  zend_optimizer.h
+  zend_ssa.h
+  zend_worklist.h
+]))
+
+PHP_ADD_SOURCES([TSRM], [TSRM.c], [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1])
+
+PHP_ADD_SOURCES([main], m4_normalize([
+    explicit_bzero.c
+    fopen_wrappers.c
+    getopt.c
+    main.c
+    network.c
+    output.c
+    php_content_types.c
+    php_ini_builder.c
+    php_ini.c
+    php_odbc_utils.c
+    php_open_temporary_file.c
+    php_scandir.c
+    php_syslog.c
+    php_ticks.c
+    php_variables.c
+    reentrancy.c
+    rfc1867.c
+    safe_bcmp.c
+    SAPI.c
+    snprintf.c
+    spprintf.c
+    strlcat.c
+    strlcpy.c
+  ]),
+  [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1])
+
+if printf "#if __ELF__\nelf\n#endif\n" | $CC -E - | grep elf > /dev/null; then
+  PHP_ADD_SOURCES([main], [debug_gdb_scripts.c])
+
+  cat >> Makefile.objects <<EOF
+$abs_srcdir/main/debug_gdb_scripts.c: $abs_srcdir/scripts/gdb/debug_gdb_scripts_gen.php $abs_srcdir/scripts/gdb/php_gdb.py $abs_srcdir/.gdbinit
+	@if test ! -z "\$(PHP)"; then \\
+		\$(PHP) $abs_srcdir/scripts/gdb/debug_gdb_scripts_gen.php; \\
+	fi;
+EOF
+fi
+
+PHP_ADD_SOURCES_X([main],
+  [fastcgi.c],
+  [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1],
+  [PHP_FASTCGI_OBJS],
+  [no])
+
+PHP_ADD_SOURCES([main/streams], m4_normalize([
+    cast.c
+    filter.c
+    glob_wrapper.c
+    memory.c
+    mmap.c
+    plain_wrapper.c
+    streams.c
+    transports.c
+    userspace.c
+    xp_socket.c
+  ]),
+  [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1])
+
+PHP_ADD_SOURCES([/main],
+  [internal_functions.c],
+  [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1],
+  [sapi])
+PHP_ADD_SOURCES_X([/main],
+  [internal_functions_cli.c],
+  [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1],
+  [PHP_BINARY_OBJS])
+
+PHP_ADD_SOURCES([Zend], m4_normalize([
+    Optimizer/block_pass.c
+    Optimizer/compact_literals.c
+    Optimizer/compact_vars.c
+    Optimizer/dce.c
+    Optimizer/dfa_pass.c
+    Optimizer/escape_analysis.c
+    Optimizer/nop_removal.c
+    Optimizer/optimize_func_calls.c
+    Optimizer/optimize_temp_vars_5.c
+    Optimizer/pass1.c
+    Optimizer/pass3.c
+    Optimizer/sccp.c
+    Optimizer/scdf.c
+    Optimizer/zend_call_graph.c
+    Optimizer/zend_cfg.c
+    Optimizer/zend_dfg.c
+    Optimizer/zend_dump.c
+    Optimizer/zend_func_info.c
+    Optimizer/zend_inference.c
+    Optimizer/zend_optimizer.c
+    Optimizer/zend_ssa.c
+    zend_alloc.c
+    zend_API.c
+    zend_ast.c
+    zend_atomic.c
+    zend_attributes.c
+    zend_builtin_functions.c
+    zend_call_stack.c
+    zend_closures.c
+    zend_compile.c
+    zend_constants.c
+    zend_cpuinfo.c
+    zend_default_classes.c
+    zend_dtrace.c
+    zend_enum.c
+    zend_exceptions.c
+    zend_execute_API.c
+    zend_execute.c
+    zend_extensions.c
+    zend_fibers.c
+    zend_float.c
+    zend_frameless_function.c
+    zend_gc.c
+    zend_gdb.c
+    zend_generators.c
+    zend_hash.c
+    zend_highlight.c
+    zend_hrtime.c
+    zend_inheritance.c
+    zend_ini_parser.c
+    zend_ini_scanner.c
+    zend_ini.c
+    zend_interfaces.c
+    zend_iterators.c
+    zend_language_parser.c
+    zend_language_scanner.c
+    zend_lazy_objects.c
+    zend_list.c
+    zend_llist.c
+    zend_max_execution_timer.c
+    zend_multibyte.c
+    zend_object_handlers.c
+    zend_objects_API.c
+    zend_objects.c
+    zend_observer.c
+    zend_opcode.c
+    zend_operators.c
+    zend_property_hooks.c
+    zend_ptr_stack.c
+    zend_signal.c
+    zend_smart_str.c
+    zend_sort.c
+    zend_stack.c
+    zend_stream.c
+    zend_string.c
+    zend_strtod.c
+    zend_system_id.c
+    zend_variables.c
+    zend_virtual_cwd.c
+    zend_vm_opcodes.c
+    zend_weakrefs.c
+    zend.c
+  ]),
+  [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 $fiber_asm_cflag])
+
+PHP_ADD_MAKEFILE_FRAGMENT([$abs_srcdir/scripts/Makefile.frag],
+  [$abs_srcdir/scripts],
+  [scripts])
+PHP_ADD_MAKEFILE_FRAGMENT([$abs_srcdir/Zend/Makefile.frag],
+  [$abs_srcdir/Zend],
+  [Zend])
+
+AC_DEFINE([HAVE_BUILD_DEFS_H], [1],
+  [Define to 1 if PHP has the <main/build-defs.h> header file.])
+
+PHP_ADD_BUILD_DIR([
+  main
+  main/streams
+  scripts
+  scripts/man1
+  TSRM
+  Zend
+  Zend/asm
+  Zend/Optimizer
+])
+
+AC_CONFIG_FILES([
+  main/build-defs.h
+  scripts/man1/php-config.1
+  scripts/man1/phpize.1
+  scripts/php-config
+  scripts/phpize
+])
+
+AC_CONFIG_COMMANDS_PRE([PHP_PATCH_CONFIG_HEADERS([main/php_config.h.in])])
+
+AC_CONFIG_COMMANDS([Zend/zend_config.h], [
+cat >Zend/zend_config.h <<FEO
+#include <../main/php_config.h>
+FEO
+])
+
+AC_CONFIG_COMMANDS([main/internal_functions.c], [], [
+  AWK="$AWK" $SHELL $srcdir/build/genif.sh \
+    $srcdir/main/internal_functions.c.in \
+    "$EXT_STATIC" > main/internal_functions.c
+])
+
+AC_CONFIG_COMMANDS([main/internal_functions_cli.c], [], [
+  AWK="$AWK" $SHELL $srcdir/build/genif.sh \
+    $srcdir/main/internal_functions.c.in \
+    "$EXT_CLI_STATIC" > main/internal_functions_cli.c
+])
+
+AC_CONFIG_COMMANDS([default], [
+cat <<X
+
++--------------------------------------------------------------------+
+| License:                                                           |
+| This software is subject to the PHP License, available in this     |
+| distribution in the file LICENSE. By continuing this installation  |
+| process, you are bound by the terms of this license agreement.     |
+| If you do not agree with the terms of this license, you must abort |
+| the installation process at this point.                            |
++--------------------------------------------------------------------+
+
+Thank you for using PHP.
+
+X
+])
+AC_OUTPUT
diff '--color=auto' -Naur a/ext/curl/interface.c b/ext/curl/interface.c
--- a/ext/curl/interface.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/curl/interface.c	2025-10-25 03:24:13.151647843 +0000
@@ -453,7 +453,7 @@
 	clone_ch->cp = cp;
 	_php_setup_easy_copy_handlers(clone_ch, ch);
 
-	postfields = &clone_ch->postfields;
+	postfields = &ch->postfields;
 	if (Z_TYPE_P(postfields) != IS_UNDEF) {
 		if (build_mime_structure_from_hash(clone_ch, postfields) == FAILURE) {
 			zend_throw_exception(NULL, "Failed to clone CurlHandle", 0);
@@ -643,10 +643,10 @@
 /* }}} */
 
 /* {{{ curl_progress */
-static size_t curl_progress(void *clientp, double dltotal, double dlnow, double ultotal, double ulnow)
+static int curl_progress(void *clientp, double dltotal, double dlnow, double ultotal, double ulnow)
 {
 	php_curl *ch = (php_curl *)clientp;
-	size_t	rval = 0;
+	int rval = 0;
 
 #if PHP_CURL_DEBUG
 	fprintf(stderr, "curl_progress() called\n");
@@ -681,10 +681,10 @@
 /* }}} */
 
 /* {{{ curl_xferinfo */
-static size_t curl_xferinfo(void *clientp, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow)
+static int curl_xferinfo(void *clientp, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow)
 {
 	php_curl *ch = (php_curl *)clientp;
-	size_t rval = 0;
+	int rval = 0;
 
 #if PHP_CURL_DEBUG
 	fprintf(stderr, "curl_xferinfo() called\n");
@@ -1190,8 +1190,8 @@
 {
 	char *cainfo;
 
-	curl_easy_setopt(ch->cp, CURLOPT_NOPROGRESS,        1);
-	curl_easy_setopt(ch->cp, CURLOPT_VERBOSE,           0);
+	curl_easy_setopt(ch->cp, CURLOPT_NOPROGRESS,        1L);
+	curl_easy_setopt(ch->cp, CURLOPT_VERBOSE,           0L);
 	curl_easy_setopt(ch->cp, CURLOPT_ERRORBUFFER,       ch->err.str);
 	curl_easy_setopt(ch->cp, CURLOPT_WRITEFUNCTION,     curl_write);
 	curl_easy_setopt(ch->cp, CURLOPT_FILE,              (void *) ch);
@@ -1199,8 +1199,8 @@
 	curl_easy_setopt(ch->cp, CURLOPT_INFILE,            (void *) ch);
 	curl_easy_setopt(ch->cp, CURLOPT_HEADERFUNCTION,    curl_write_header);
 	curl_easy_setopt(ch->cp, CURLOPT_WRITEHEADER,       (void *) ch);
-	curl_easy_setopt(ch->cp, CURLOPT_DNS_CACHE_TIMEOUT, 120);
-	curl_easy_setopt(ch->cp, CURLOPT_MAXREDIRS, 20); /* prevent infinite redirects */
+	curl_easy_setopt(ch->cp, CURLOPT_DNS_CACHE_TIMEOUT, 120L);
+	curl_easy_setopt(ch->cp, CURLOPT_MAXREDIRS, 20L); /* prevent infinite redirects */
 
 	cainfo = INI_STR("openssl.cafile");
 	if (!(cainfo && cainfo[0] != '\0')) {
@@ -1211,7 +1211,7 @@
 	}
 
 #ifdef ZTS
-	curl_easy_setopt(ch->cp, CURLOPT_NOSIGNAL, 1);
+	curl_easy_setopt(ch->cp, CURLOPT_NOSIGNAL, 1L);
 #endif
 }
 /* }}} */
@@ -1701,7 +1701,7 @@
 			lval = zval_get_long(zvalue);
 			if (lval == 1) {
 				php_error_docref(NULL, E_NOTICE, "CURLOPT_SSL_VERIFYHOST no longer accepts the value 1, value 2 will be used instead");
-				error = curl_easy_setopt(ch->cp, option, 2);
+				error = curl_easy_setopt(ch->cp, option, 2L);
 				break;
 			}
 			ZEND_FALLTHROUGH;
@@ -2207,7 +2207,7 @@
 
 		case CURLOPT_FOLLOWLOCATION:
 			lval = zend_is_true(zvalue);
-			error = curl_easy_setopt(ch->cp, option, lval);
+			error = curl_easy_setopt(ch->cp, option, (long) lval);
 			break;
 
 		case CURLOPT_POSTFIELDS:
@@ -2216,7 +2216,7 @@
 					/* no need to build the mime structure for empty hashtables;
 					   also works around https://github.com/curl/curl/issues/6455 */
 					curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDS, "");
-					error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, 0);
+					error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, 0L);
 				} else {
 					return build_mime_structure_from_hash(ch, zvalue);
 				}
@@ -2249,7 +2249,7 @@
 
 		case CURLOPT_POSTREDIR:
 			lval = zval_get_long(zvalue);
-			error = curl_easy_setopt(ch->cp, CURLOPT_POSTREDIR, lval & CURL_REDIR_POST_ALL);
+			error = curl_easy_setopt(ch->cp, CURLOPT_POSTREDIR, (long) (lval & CURL_REDIR_POST_ALL));
 			break;
 
 		/* the following options deal with files, therefore the open_basedir check
@@ -2289,11 +2289,11 @@
 			if (zend_is_true(zvalue)) {
 				curl_easy_setopt(ch->cp, CURLOPT_DEBUGFUNCTION, curl_debug);
 				curl_easy_setopt(ch->cp, CURLOPT_DEBUGDATA, (void *)ch);
-				curl_easy_setopt(ch->cp, CURLOPT_VERBOSE, 1);
+				curl_easy_setopt(ch->cp, CURLOPT_VERBOSE, 1L);
 			} else {
 				curl_easy_setopt(ch->cp, CURLOPT_DEBUGFUNCTION, NULL);
 				curl_easy_setopt(ch->cp, CURLOPT_DEBUGDATA, NULL);
-				curl_easy_setopt(ch->cp, CURLOPT_VERBOSE, 0);
+				curl_easy_setopt(ch->cp, CURLOPT_VERBOSE, 0L);
 			}
 			break;
 
diff '--color=auto' -Naur a/ext/curl/tests/curl_copy_handle_variation3_clone.phpt b/ext/curl/tests/curl_copy_handle_variation3_clone.phpt
--- a/ext/curl/tests/curl_copy_handle_variation3_clone.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/curl/tests/curl_copy_handle_variation3_clone.phpt	2025-10-25 03:24:13.152227880 +0000
@@ -0,0 +1,34 @@
+--TEST--
+clone() allows to post CURLFile multiple times
+--EXTENSIONS--
+curl
+--FILE--
+<?php
+include 'server.inc';
+$host = curl_cli_server_start();
+
+$ch1 = curl_init();
+curl_setopt($ch1, CURLOPT_SAFE_UPLOAD, 1);
+curl_setopt($ch1, CURLOPT_URL, "{$host}/get.php?test=file");
+curl_setopt($ch1, CURLOPT_RETURNTRANSFER, 1);
+
+$filename = __DIR__ . '/curl_copy_handle_variation3_clone.txt';
+file_put_contents($filename, "Test.");
+$file = curl_file_create($filename);
+$params = array('file' => $file);
+var_dump(curl_setopt($ch1, CURLOPT_POSTFIELDS, $params));
+
+$ch2 = clone($ch1);
+
+var_dump(curl_exec($ch1));
+
+var_dump(curl_exec($ch2));
+?>
+--EXPECTF--
+bool(true)
+string(%d) "curl_copy_handle_variation3_clone.txt|application/octet-stream|5"
+string(%d) "curl_copy_handle_variation3_clone.txt|application/octet-stream|5"
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/curl_copy_handle_variation3_clone.txt');
+?>
diff '--color=auto' -Naur a/ext/curl/tests/curl_setopt_ssl.phpt b/ext/curl/tests/curl_setopt_ssl.phpt
--- a/ext/curl/tests/curl_setopt_ssl.phpt	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/curl/tests/curl_setopt_ssl.phpt	2025-10-25 03:24:13.152338151 +0000
@@ -18,9 +18,13 @@
 --FILE--
 <?php
 
-function check_error(CurlHandle $ch) {
+function check_error(CurlHandle $ch, $expected = null) {
     if (curl_errno($ch) !== 0) {
-        echo "CURL ERROR: " . curl_errno($ch) . "\n";
+        $errno = curl_errno($ch);
+        if (!is_null($expected)) {
+            $errno = $errno == $expected ? 'EXPECTED' : "UNEXPECTED(A:$errno,E:$expected)";
+        }
+        echo "CURL ERROR: " . $errno . "\n";
     }
 }
 
@@ -109,7 +113,7 @@
 
     $response = curl_exec($ch);
     check_response($response, $clientCertSubject);
-    check_error($ch);
+    check_error($ch, curl_version()['version_number'] < 0x081000 ? 58 : 43);
     curl_close($ch);
 
     echo "\n";
@@ -203,7 +207,7 @@
 bool(true)
 bool(true)
 client cert subject not in response
-CURL ERROR: 58
+CURL ERROR: EXPECTED
 
 case 4: client cert and key from file
 bool(true)
diff '--color=auto' -Naur a/ext/date/lib/parse_date.c b/ext/date/lib/parse_date.c
--- a/ext/date/lib/parse_date.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/date/lib/parse_date.c	2025-10-25 03:24:13.155178498 +0000
@@ -1,4 +1,4 @@
-/* Generated by re2c 1.0.3 on Wed Sep 11 17:29:29 2024 */
+/* Generated by re2c 1.0.3 on Mon Sep 15 10:38:03 2025 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
  * The MIT License (MIT)
@@ -941,10 +941,12 @@
 {
 	timelib_tzinfo *res;
 	timelib_long            retval = 0;
+	size_t paren_count = 0;
 
 	*tz_not_found = 0;
 
 	while (**ptr == ' ' || **ptr == '\t' || **ptr == '(') {
+		paren_count += **ptr == '(';
 		++*ptr;
 	}
 	if ((*ptr)[0] == 'G' && (*ptr)[1] == 'M' && (*ptr)[2] == 'T' && ((*ptr)[3] == '+' || (*ptr)[3] == '-')) {
@@ -993,8 +995,9 @@
 		*tz_not_found = (found == 0);
 		retval = offset;
 	}
-	while (**ptr == ')') {
+	while (paren_count > 0 && **ptr == ')') {
 		++*ptr;
+		paren_count--;
 	}
 	return retval;
 }
@@ -1018,11 +1021,11 @@
 std:
 	s->tok = cursor;
 	s->len = 0;
-#line 1151 "ext/date/lib/parse_date.re"
+#line 1154 "ext/date/lib/parse_date.re"
 
 
 
-#line 1026 "<stdout>"
+#line 1029 "ext/date/lib/parse_date.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -1203,23 +1206,23 @@
 	YYDEBUG(2, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(3, *YYCURSOR);
-#line 1984 "ext/date/lib/parse_date.re"
+#line 1987 "ext/date/lib/parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 1212 "<stdout>"
+#line 1215 "ext/date/lib/parse_date.c"
 yy4:
 	YYDEBUG(4, *YYCURSOR);
 	++YYCURSOR;
 yy5:
 	YYDEBUG(5, *YYCURSOR);
-#line 1990 "ext/date/lib/parse_date.re"
+#line 1993 "ext/date/lib/parse_date.re"
 	{
 		add_error(s, TIMELIB_ERR_UNEXPECTED_CHARACTER, "Unexpected character");
 		goto std;
 	}
-#line 1223 "<stdout>"
+#line 1226 "ext/date/lib/parse_date.c"
 yy6:
 	YYDEBUG(6, *YYCURSOR);
 	yyaccept = 0;
@@ -1234,11 +1237,11 @@
 	if (yych <= '9') goto yy58;
 yy8:
 	YYDEBUG(8, *YYCURSOR);
-#line 1979 "ext/date/lib/parse_date.re"
+#line 1982 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
-#line 1242 "<stdout>"
+#line 1245 "ext/date/lib/parse_date.c"
 yy9:
 	YYDEBUG(9, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -1272,11 +1275,11 @@
 	YYDEBUG(11, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(12, *YYCURSOR);
-#line 1974 "ext/date/lib/parse_date.re"
+#line 1977 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
-#line 1280 "<stdout>"
+#line 1283 "ext/date/lib/parse_date.c"
 yy13:
 	YYDEBUG(13, *YYCURSOR);
 	yyaccept = 1;
@@ -1777,7 +1780,7 @@
 	}
 yy20:
 	YYDEBUG(20, *YYCURSOR);
-#line 1889 "ext/date/lib/parse_date.re"
+#line 1892 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -1791,7 +1794,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
-#line 1795 "<stdout>"
+#line 1798 "ext/date/lib/parse_date.c"
 yy21:
 	YYDEBUG(21, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -3596,7 +3599,7 @@
 	}
 yy81:
 	YYDEBUG(81, *YYCURSOR);
-#line 1636 "ext/date/lib/parse_date.re"
+#line 1639 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenoyearrev");
 		TIMELIB_INIT;
@@ -3607,7 +3610,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3611 "<stdout>"
+#line 3614 "ext/date/lib/parse_date.c"
 yy82:
 	YYDEBUG(82, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -4122,7 +4125,7 @@
 	}
 	if (yych == '.') goto yy289;
 	YYDEBUG(114, *YYCURSOR);
-#line 1211 "ext/date/lib/parse_date.re"
+#line 1214 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 
@@ -4147,7 +4150,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 4151 "<stdout>"
+#line 4154 "ext/date/lib/parse_date.c"
 yy115:
 	YYDEBUG(115, *YYCURSOR);
 	++YYCURSOR;
@@ -5873,7 +5876,7 @@
 	}
 yy177:
 	YYDEBUG(177, *YYCURSOR);
-#line 1377 "ext/date/lib/parse_date.re"
+#line 1380 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("timetiny24 | timeshort24 | timelong24 | iso8601long");
@@ -5900,7 +5903,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 5904 "<stdout>"
+#line 5907 "ext/date/lib/parse_date.c"
 yy178:
 	YYDEBUG(178, *YYCURSOR);
 	yyaccept = 4;
@@ -6929,7 +6932,7 @@
 	}
 yy224:
 	YYDEBUG(224, *YYCURSOR);
-#line 1471 "ext/date/lib/parse_date.re"
+#line 1474 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("americanshort | american");
@@ -6944,7 +6947,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
-#line 6948 "<stdout>"
+#line 6951 "ext/date/lib/parse_date.c"
 yy225:
 	YYDEBUG(225, *YYCURSOR);
 	yyaccept = 5;
@@ -7187,7 +7190,7 @@
 	if (yych <= '9') goto yy431;
 yy251:
 	YYDEBUG(251, *YYCURSOR);
-#line 1553 "ext/date/lib/parse_date.re"
+#line 1556 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datefull");
@@ -7201,7 +7204,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
-#line 7205 "<stdout>"
+#line 7208 "ext/date/lib/parse_date.c"
 yy252:
 	YYDEBUG(252, *YYCURSOR);
 	yyaccept = 3;
@@ -7315,7 +7318,7 @@
 	if (yych == 'e') goto yy440;
 yy260:
 	YYDEBUG(260, *YYCURSOR);
-#line 1958 "ext/date/lib/parse_date.re"
+#line 1961 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -7330,7 +7333,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 7334 "<stdout>"
+#line 7337 "ext/date/lib/parse_date.c"
 yy261:
 	YYDEBUG(261, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7776,7 +7779,7 @@
 	if (yych <= '9') goto yy471;
 yy290:
 	YYDEBUG(290, *YYCURSOR);
-#line 1237 "ext/date/lib/parse_date.re"
+#line 1240 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		timelib_ull us;
@@ -7815,7 +7818,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 7819 "<stdout>"
+#line 7822 "ext/date/lib/parse_date.c"
 yy291:
 	YYDEBUG(291, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7840,7 +7843,7 @@
 	}
 yy293:
 	YYDEBUG(293, *YYCURSOR);
-#line 1799 "ext/date/lib/parse_date.re"
+#line 1802 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("ago");
 		TIMELIB_INIT;
@@ -7860,7 +7863,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
-#line 7864 "<stdout>"
+#line 7867 "ext/date/lib/parse_date.c"
 yy294:
 	YYDEBUG(294, *YYCURSOR);
 	yyaccept = 7;
@@ -7899,7 +7902,7 @@
 	}
 yy295:
 	YYDEBUG(295, *YYCURSOR);
-#line 1879 "ext/date/lib/parse_date.re"
+#line 1882 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -7908,7 +7911,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 7912 "<stdout>"
+#line 7915 "ext/date/lib/parse_date.c"
 yy296:
 	YYDEBUG(296, *YYCURSOR);
 	yyaccept = 7;
@@ -8483,7 +8486,7 @@
 	}
 yy315:
 	YYDEBUG(315, *YYCURSOR);
-#line 1820 "ext/date/lib/parse_date.re"
+#line 1823 "ext/date/lib/parse_date.re"
 	{
 		const timelib_relunit* relunit;
 		DEBUG_OUTPUT("daytext");
@@ -8500,7 +8503,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
-#line 8504 "<stdout>"
+#line 8507 "ext/date/lib/parse_date.c"
 yy316:
 	YYDEBUG(316, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -8768,7 +8771,7 @@
 	}
 yy325:
 	YYDEBUG(325, *YYCURSOR);
-#line 1622 "ext/date/lib/parse_date.re"
+#line 1625 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datetextual | datenoyear");
@@ -8781,7 +8784,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 8785 "<stdout>"
+#line 8788 "ext/date/lib/parse_date.c"
 yy326:
 	YYDEBUG(326, *YYCURSOR);
 	yyaccept = 10;
@@ -9475,7 +9478,7 @@
 	}
 yy351:
 	YYDEBUG(351, *YYCURSOR);
-#line 1168 "ext/date/lib/parse_date.re"
+#line 1171 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("now");
 		TIMELIB_INIT;
@@ -9483,7 +9486,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 9487 "<stdout>"
+#line 9490 "ext/date/lib/parse_date.c"
 yy352:
 	YYDEBUG(352, *YYCURSOR);
 	yyaccept = 2;
@@ -10986,7 +10989,7 @@
 	}
 yy420:
 	YYDEBUG(420, *YYCURSOR);
-#line 1405 "ext/date/lib/parse_date.re"
+#line 1408 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("gnunocolon");
 		TIMELIB_INIT;
@@ -11008,7 +11011,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_GNU_NOCOLON;
 	}
-#line 11012 "<stdout>"
+#line 11015 "ext/date/lib/parse_date.c"
 yy421:
 	YYDEBUG(421, *YYCURSOR);
 	yyaccept = 13;
@@ -11089,7 +11092,7 @@
 	}
 yy422:
 	YYDEBUG(422, *YYCURSOR);
-#line 1790 "ext/date/lib/parse_date.re"
+#line 1793 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("year4");
 		TIMELIB_INIT;
@@ -11097,7 +11100,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 11101 "<stdout>"
+#line 11104 "ext/date/lib/parse_date.c"
 yy423:
 	YYDEBUG(423, *YYCURSOR);
 	yyaccept = 3;
@@ -11704,7 +11707,7 @@
 	YYDEBUG(456, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(457, *YYCURSOR);
-#line 1339 "ext/date/lib/parse_date.re"
+#line 1342 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("timetiny12 | timeshort12 | timelong12");
 		TIMELIB_INIT;
@@ -11721,7 +11724,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME12;
 	}
-#line 11725 "<stdout>"
+#line 11728 "ext/date/lib/parse_date.c"
 yy458:
 	YYDEBUG(458, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13048,7 +13051,7 @@
 	}
 yy526:
 	YYDEBUG(526, *YYCURSOR);
-#line 1177 "ext/date/lib/parse_date.re"
+#line 1180 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("noon");
 		TIMELIB_INIT;
@@ -13059,7 +13062,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 13063 "<stdout>"
+#line 13066 "ext/date/lib/parse_date.c"
 yy527:
 	YYDEBUG(527, *YYCURSOR);
 	yyaccept = 2;
@@ -14105,7 +14108,7 @@
 	}
 yy567:
 	YYDEBUG(567, *YYCURSOR);
-#line 1539 "ext/date/lib/parse_date.re"
+#line 1542 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshort");
@@ -14118,7 +14121,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 14122 "<stdout>"
+#line 14125 "ext/date/lib/parse_date.c"
 yy568:
 	YYDEBUG(568, *YYCURSOR);
 	yyaccept = 15;
@@ -14569,7 +14572,7 @@
 	}
 yy600:
 	YYDEBUG(600, *YYCURSOR);
-#line 1608 "ext/date/lib/parse_date.re"
+#line 1611 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenodayrev");
@@ -14582,7 +14585,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 14586 "<stdout>"
+#line 14589 "ext/date/lib/parse_date.c"
 yy601:
 	YYDEBUG(601, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -15957,7 +15960,7 @@
 	YYDEBUG(696, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(697, *YYCURSOR);
-#line 1594 "ext/date/lib/parse_date.re"
+#line 1597 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenoday");
@@ -15970,7 +15973,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 15974 "<stdout>"
+#line 15977 "ext/date/lib/parse_date.c"
 yy698:
 	YYDEBUG(698, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -16531,7 +16534,7 @@
 	}
 yy722:
 	YYDEBUG(722, *YYCURSOR);
-#line 1189 "ext/date/lib/parse_date.re"
+#line 1192 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("midnight | today");
 		TIMELIB_INIT;
@@ -16540,7 +16543,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 16544 "<stdout>"
+#line 16547 "ext/date/lib/parse_date.c"
 yy723:
 	YYDEBUG(723, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -16850,7 +16853,7 @@
 	if (yych <= '9') goto yy897;
 yy739:
 	YYDEBUG(739, *YYCURSOR);
-#line 1580 "ext/date/lib/parse_date.re"
+#line 1583 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pointed date YY");
@@ -16863,7 +16866,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 16867 "<stdout>"
+#line 16870 "ext/date/lib/parse_date.c"
 yy740:
 	YYDEBUG(740, *YYCURSOR);
 	yyaccept = 15;
@@ -16975,7 +16978,7 @@
 	}
 yy752:
 	YYDEBUG(752, *YYCURSOR);
-#line 1525 "ext/date/lib/parse_date.re"
+#line 1528 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshorter");
@@ -16988,7 +16991,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 16992 "<stdout>"
+#line 16995 "ext/date/lib/parse_date.c"
 yy753:
 	YYDEBUG(753, *YYCURSOR);
 	yyaccept = 18;
@@ -17237,7 +17240,7 @@
 	}
 yy777:
 	YYDEBUG(777, *YYCURSOR);
-#line 1451 "ext/date/lib/parse_date.re"
+#line 1454 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("iso8601nocolon");
@@ -17256,7 +17259,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_NOCOLON;
 	}
-#line 17260 "<stdout>"
+#line 17263 "ext/date/lib/parse_date.c"
 yy778:
 	YYDEBUG(778, *YYCURSOR);
 	yyaccept = 19;
@@ -18484,7 +18487,7 @@
 	}
 yy849:
 	YYDEBUG(849, *YYCURSOR);
-#line 1928 "ext/date/lib/parse_date.re"
+#line 1931 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("dateshortwithtimeshort | dateshortwithtimelong | dateshortwithtimelongtz");
@@ -18513,7 +18516,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 18517 "<stdout>"
+#line 18520 "ext/date/lib/parse_date.c"
 yy850:
 	YYDEBUG(850, *YYCURSOR);
 	yyaccept = 20;
@@ -19557,7 +19560,7 @@
 	}
 yy926:
 	YYDEBUG(926, *YYCURSOR);
-#line 1686 "ext/date/lib/parse_date.re"
+#line 1689 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgydotd");
@@ -19570,7 +19573,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_YEARDAY;
 	}
-#line 19574 "<stdout>"
+#line 19577 "ext/date/lib/parse_date.c"
 yy927:
 	YYDEBUG(927, *YYCURSOR);
 	yyaccept = 21;
@@ -19824,7 +19827,7 @@
 	if (yych <= '7') goto yy1059;
 yy942:
 	YYDEBUG(942, *YYCURSOR);
-#line 1719 "ext/date/lib/parse_date.re"
+#line 1722 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweek");
@@ -19842,7 +19845,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 19846 "<stdout>"
+#line 19849 "ext/date/lib/parse_date.c"
 yy943:
 	YYDEBUG(943, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -20318,7 +20321,7 @@
 	if (yych == 'e') goto yy1094;
 yy982:
 	YYDEBUG(982, *YYCURSOR);
-#line 1862 "ext/date/lib/parse_date.re"
+#line 1865 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -20334,7 +20337,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20338 "<stdout>"
+#line 20341 "ext/date/lib/parse_date.c"
 yy983:
 	YYDEBUG(983, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -20681,7 +20684,7 @@
 	YYDEBUG(1020, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1021, *YYCURSOR);
-#line 1568 "ext/date/lib/parse_date.re"
+#line 1571 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("pointed date YYYY");
 		TIMELIB_INIT;
@@ -20692,7 +20695,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 20696 "<stdout>"
+#line 20699 "ext/date/lib/parse_date.c"
 yy1022:
 	YYDEBUG(1022, *YYCURSOR);
 	++YYCURSOR;
@@ -20721,7 +20724,7 @@
 	}
 yy1025:
 	YYDEBUG(1025, *YYCURSOR);
-#line 1499 "ext/date/lib/parse_date.re"
+#line 1502 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("iso8601date2");
@@ -20734,7 +20737,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 20738 "<stdout>"
+#line 20741 "ext/date/lib/parse_date.c"
 yy1026:
 	YYDEBUG(1026, *YYCURSOR);
 	yyaccept = 15;
@@ -20954,7 +20957,7 @@
 	}
 yy1043:
 	YYDEBUG(1043, *YYCURSOR);
-#line 1487 "ext/date/lib/parse_date.re"
+#line 1490 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("iso8601date4 | iso8601date2 | iso8601dateslash | dateslash");
 		TIMELIB_INIT;
@@ -20965,7 +20968,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 20969 "<stdout>"
+#line 20972 "ext/date/lib/parse_date.c"
 yy1044:
 	YYDEBUG(1044, *YYCURSOR);
 	yyaccept = 26;
@@ -21080,7 +21083,7 @@
 	}
 yy1048:
 	YYDEBUG(1048, *YYCURSOR);
-#line 1648 "ext/date/lib/parse_date.re"
+#line 1651 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenocolon");
 		TIMELIB_INIT;
@@ -21091,7 +21094,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NOCOLON;
 	}
-#line 21095 "<stdout>"
+#line 21098 "ext/date/lib/parse_date.c"
 yy1049:
 	YYDEBUG(1049, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21161,7 +21164,7 @@
 	YYDEBUG(1059, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1060, *YYCURSOR);
-#line 1700 "ext/date/lib/parse_date.re"
+#line 1703 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweekday");
@@ -21179,7 +21182,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 21183 "<stdout>"
+#line 21186 "ext/date/lib/parse_date.c"
 yy1061:
 	YYDEBUG(1061, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21242,7 +21245,7 @@
 	if (yych <= '9') goto yy1143;
 yy1070:
 	YYDEBUG(1070, *YYCURSOR);
-#line 1738 "ext/date/lib/parse_date.re"
+#line 1741 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextshort");
@@ -21255,7 +21258,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 21259 "<stdout>"
+#line 21262 "ext/date/lib/parse_date.c"
 yy1071:
 	YYDEBUG(1071, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21728,7 +21731,7 @@
 	++YYCURSOR;
 yy1107:
 	YYDEBUG(1107, *YYCURSOR);
-#line 1199 "ext/date/lib/parse_date.re"
+#line 1202 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("tomorrow");
 		TIMELIB_INIT;
@@ -21739,7 +21742,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21743 "<stdout>"
+#line 21746 "ext/date/lib/parse_date.c"
 yy1108:
 	YYDEBUG(1108, *YYCURSOR);
 	yyaccept = 28;
@@ -22076,7 +22079,7 @@
 	YYDEBUG(1140, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1141, *YYCURSOR);
-#line 1752 "ext/date/lib/parse_date.re"
+#line 1755 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextreverse");
@@ -22089,7 +22092,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 22093 "<stdout>"
+#line 22096 "ext/date/lib/parse_date.c"
 yy1142:
 	YYDEBUG(1142, *YYCURSOR);
 	++YYCURSOR;
@@ -22133,7 +22136,7 @@
 	}
 yy1145:
 	YYDEBUG(1145, *YYCURSOR);
-#line 1294 "ext/date/lib/parse_date.re"
+#line 1297 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("backof | frontof");
 		TIMELIB_INIT;
@@ -22155,7 +22158,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 22159 "<stdout>"
+#line 22162 "ext/date/lib/parse_date.c"
 yy1146:
 	YYDEBUG(1146, *YYCURSOR);
 	yyaccept = 29;
@@ -22479,7 +22482,7 @@
 	}
 yy1172:
 	YYDEBUG(1172, *YYCURSOR);
-#line 1838 "ext/date/lib/parse_date.re"
+#line 1841 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -22502,7 +22505,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22506 "<stdout>"
+#line 22509 "ext/date/lib/parse_date.c"
 yy1173:
 	YYDEBUG(1173, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -22514,7 +22517,7 @@
 	++YYCURSOR;
 yy1175:
 	YYDEBUG(1175, *YYCURSOR);
-#line 1156 "ext/date/lib/parse_date.re"
+#line 1159 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("yesterday");
 		TIMELIB_INIT;
@@ -22525,7 +22528,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22529 "<stdout>"
+#line 22532 "ext/date/lib/parse_date.c"
 yy1176:
 	YYDEBUG(1176, *YYCURSOR);
 	yyaccept = 31;
@@ -23018,7 +23021,7 @@
 	YYDEBUG(1222, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1223, *YYCURSOR);
-#line 1904 "ext/date/lib/parse_date.re"
+#line 1907 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("dateshortwithtimeshort12 | dateshortwithtimelong12");
 		TIMELIB_INIT;
@@ -23041,7 +23044,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 23045 "<stdout>"
+#line 23048 "ext/date/lib/parse_date.c"
 yy1224:
 	YYDEBUG(1224, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -23543,7 +23546,7 @@
 	YYDEBUG(1268, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1269, *YYCURSOR);
-#line 1317 "ext/date/lib/parse_date.re"
+#line 1320 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -23564,7 +23567,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEK_DAY_OF_MONTH;
 	}
-#line 23568 "<stdout>"
+#line 23571 "ext/date/lib/parse_date.c"
 yy1270:
 	YYDEBUG(1270, *YYCURSOR);
 	yyaccept = 24;
@@ -23611,7 +23614,7 @@
 	YYDEBUG(1273, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1274, *YYCURSOR);
-#line 1277 "ext/date/lib/parse_date.re"
+#line 1280 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("firstdayof | lastdayof");
 		TIMELIB_INIT;
@@ -23627,12 +23630,12 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 23631 "<stdout>"
+#line 23634 "ext/date/lib/parse_date.c"
 yy1275:
 	YYDEBUG(1275, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1276, *YYCURSOR);
-#line 1513 "ext/date/lib/parse_date.re"
+#line 1516 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("iso8601datex");
 		TIMELIB_INIT;
@@ -23643,7 +23646,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 23647 "<stdout>"
+#line 23650 "ext/date/lib/parse_date.c"
 yy1277:
 	YYDEBUG(1277, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -23746,7 +23749,7 @@
 	YYDEBUG(1290, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1291, *YYCURSOR);
-#line 1357 "ext/date/lib/parse_date.re"
+#line 1360 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("mssqltime");
 		TIMELIB_INIT;
@@ -23765,7 +23768,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 23769 "<stdout>"
+#line 23772 "ext/date/lib/parse_date.c"
 yy1292:
 	YYDEBUG(1292, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -24189,7 +24192,7 @@
 	if (yych <= '9') goto yy1331;
 yy1329:
 	YYDEBUG(1329, *YYCURSOR);
-#line 1660 "ext/date/lib/parse_date.re"
+#line 1663 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("xmlrpc | xmlrpcnocolon | soap | wddx | exif");
@@ -24214,7 +24217,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_XMLRPC_SOAP;
 	}
-#line 24218 "<stdout>"
+#line 24221 "ext/date/lib/parse_date.c"
 yy1330:
 	YYDEBUG(1330, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -24584,7 +24587,7 @@
 	if (yych <= ':') goto yy1383;
 yy1375:
 	YYDEBUG(1375, *YYCURSOR);
-#line 1766 "ext/date/lib/parse_date.re"
+#line 1769 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("clf");
@@ -24607,7 +24610,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 24611 "<stdout>"
+#line 24614 "ext/date/lib/parse_date.c"
 yy1376:
 	YYDEBUG(1376, *YYCURSOR);
 	yyaccept = 33;
@@ -24839,7 +24842,7 @@
 	if (yych == ':') goto yy1286;
 	goto yy1329;
 }
-#line 1994 "ext/date/lib/parse_date.re"
+#line 1997 "ext/date/lib/parse_date.re"
 
 }
 
diff '--color=auto' -Naur a/ext/date/lib/parse_date.re b/ext/date/lib/parse_date.re
--- a/ext/date/lib/parse_date.re	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/date/lib/parse_date.re	2025-10-25 03:24:13.156800552 +0000
@@ -939,10 +939,12 @@
 {
 	timelib_tzinfo *res;
 	timelib_long            retval = 0;
+	size_t paren_count = 0;
 
 	*tz_not_found = 0;
 
 	while (**ptr == ' ' || **ptr == '\t' || **ptr == '(') {
+		paren_count += **ptr == '(';
 		++*ptr;
 	}
 	if ((*ptr)[0] == 'G' && (*ptr)[1] == 'M' && (*ptr)[2] == 'T' && ((*ptr)[3] == '+' || (*ptr)[3] == '-')) {
@@ -991,8 +993,9 @@
 		*tz_not_found = (found == 0);
 		retval = offset;
 	}
-	while (**ptr == ')') {
+	while (paren_count > 0 && **ptr == ')') {
 		++*ptr;
+		paren_count--;
 	}
 	return retval;
 }
diff '--color=auto' -Naur a/ext/date/lib/parse_iso_intervals.c b/ext/date/lib/parse_iso_intervals.c
--- a/ext/date/lib/parse_iso_intervals.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/date/lib/parse_iso_intervals.c	2025-10-25 03:24:13.157068790 +0000
@@ -1,4 +1,4 @@
-/* Generated by re2c 1.0.3 on Wed Sep 11 17:29:40 2024 */
+/* Generated by re2c 1.0.3 on Mon Sep 15 10:38:16 2025 */
 #line 1 "ext/date/lib/parse_iso_intervals.re"
 /*
  * The MIT License (MIT)
@@ -180,7 +180,7 @@
 
 
 
-#line 184 "<stdout>"
+#line 184 "ext/date/lib/parse_iso_intervals.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -252,7 +252,7 @@
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 256 "<stdout>"
+#line 256 "ext/date/lib/parse_iso_intervals.c"
 yy4:
 	YYDEBUG(4, *YYCURSOR);
 	++YYCURSOR;
@@ -263,7 +263,7 @@
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 267 "<stdout>"
+#line 267 "ext/date/lib/parse_iso_intervals.c"
 yy6:
 	YYDEBUG(6, *YYCURSOR);
 	++YYCURSOR;
@@ -272,7 +272,7 @@
 	{
 		goto std;
 	}
-#line 276 "<stdout>"
+#line 276 "ext/date/lib/parse_iso_intervals.c"
 yy8:
 	YYDEBUG(8, *YYCURSOR);
 	yyaccept = 0;
@@ -330,7 +330,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;
 	}
-#line 334 "<stdout>"
+#line 334 "ext/date/lib/parse_iso_intervals.c"
 yy11:
 	YYDEBUG(11, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -399,7 +399,7 @@
 		s->have_recurrences = 1;
 		return TIMELIB_PERIOD;
 	}
-#line 403 "<stdout>"
+#line 403 "ext/date/lib/parse_iso_intervals.c"
 yy19:
 	YYDEBUG(19, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -917,7 +917,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 921 "<stdout>"
+#line 921 "ext/date/lib/parse_iso_intervals.c"
 yy91:
 	YYDEBUG(91, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -956,7 +956,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;
 	}
-#line 960 "<stdout>"
+#line 960 "ext/date/lib/parse_iso_intervals.c"
 }
 #line 321 "ext/date/lib/parse_iso_intervals.re"
 
diff '--color=auto' -Naur a/ext/date/lib/timelib.h b/ext/date/lib/timelib.h
--- a/ext/date/lib/timelib.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/date/lib/timelib.h	2025-10-25 03:24:13.157263812 +0000
@@ -1,7 +1,7 @@
 /*
  * The MIT License (MIT)
  *
- * Copyright (c) 2015-2024 Derick Rethans
+ * Copyright (c) 2015-2025 Derick Rethans
  * Copyright (c) 2018,2021 MongoDB, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -30,9 +30,9 @@
 # include "timelib_config.h"
 #endif
 
-#define TIMELIB_VERSION 202212
-#define TIMELIB_EXTENDED_VERSION 20221201
-#define TIMELIB_ASCII_VERSION "2022.12"
+#define TIMELIB_VERSION 202214
+#define TIMELIB_EXTENDED_VERSION 20221401
+#define TIMELIB_ASCII_VERSION "2022.14"
 
 #include <stdlib.h>
 #include <stdbool.h>
diff '--color=auto' -Naur a/ext/dba/dba.c b/ext/dba/dba.c
--- a/ext/dba/dba.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/dba/dba.c	2025-10-25 03:24:13.157442806 +0000
@@ -1070,6 +1070,11 @@
 		ZEND_PARSE_PARAMETERS_END();
 	}
 
+	if (ZEND_LONG_EXCEEDS_INT(skip)) {
+		zend_argument_value_error(3, "must be between %d and %d", INT_MIN, INT_MAX);
+		RETURN_THROWS();
+	}
+
 	info = Z_DBA_INFO_P(id);
 	CHECK_DBA_CONNECTION(info);
 
diff '--color=auto' -Naur a/ext/dba/tests/gh19885.phpt b/ext/dba/tests/gh19885.phpt
--- a/ext/dba/tests/gh19885.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/dba/tests/gh19885.phpt	2025-10-25 03:24:13.157568578 +0000
@@ -0,0 +1,35 @@
+--TEST--
+GH-19885 (dba_fetch() segfault on large skip values)
+--EXTENSIONS--
+dba
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only");
+$handler = 'cdb';
+require_once(__DIR__ .'/skipif.inc');
+?>
+--FILE--
+<?php
+$handler = 'cdb';
+$db_file = __DIR__.'/test.cdb';
+$db =dba_open($db_file, "r", $handler);
+try {
+	dba_fetch("1", $db, PHP_INT_MIN);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+
+try {
+	dba_fetch("1", $db, PHP_INT_MAX);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+// negative skip needs to remain acceptable albeit corrected down the line
+var_dump(dba_fetch("1", $db, -1000000));
+?>
+--EXPECTF--
+dba_fetch(): Argument #3 ($skip) must be between -%d and %d
+dba_fetch(): Argument #3 ($skip) must be between -%d and %d
+
+Notice: dba_fetch(): Handler cdb accepts only skip values greater than or equal to zero, using skip=0 in %s on line %d
+string(1) "1"
diff '--color=auto' -Naur a/ext/dom/attr.c b/ext/dom/attr.c
--- a/ext/dom/attr.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/dom/attr.c	2025-10-25 03:24:13.157643397 +0000
@@ -201,10 +201,10 @@
 
 bool dom_compare_value(const xmlAttr *attr, const xmlChar *value)
 {
-	bool free;
-	xmlChar *attr_value = php_libxml_attr_value(attr, &free);
+	bool should_free;
+	xmlChar *attr_value = php_libxml_attr_value(attr, &should_free);
 	bool result = xmlStrEqual(attr_value, value);
-	if (free) {
+	if (should_free) {
 		xmlFree(attr_value);
 	}
 	return result;
diff '--color=auto' -Naur a/ext/dom/lexbor/lexbor/selectors-adapted/selectors.c b/ext/dom/lexbor/lexbor/selectors-adapted/selectors.c
--- a/ext/dom/lexbor/lexbor/selectors-adapted/selectors.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/dom/lexbor/lexbor/selectors-adapted/selectors.c	2025-10-25 03:24:13.157781744 +0000
@@ -13,7 +13,7 @@
 #include <Zend/zend_API.h>
 #include <php.h>
 
-#include "ext/dom/lexbor/lexbor/selectors-adapted/selectors.h"
+#include "lexbor/selectors-adapted/selectors.h"
 #include "../../../namespace_compat.h"
 #include "../../../domexception.h"
 #include "../../../php_dom.h"
diff '--color=auto' -Naur a/ext/dom/php_dom.c b/ext/dom/php_dom.c
--- a/ext/dom/php_dom.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/dom/php_dom.c	2025-10-25 03:24:13.158042007 +0000
@@ -2396,10 +2396,10 @@
 		}
 
 		case XML_ATTRIBUTE_NODE: {
-			bool free;
-			xmlChar *value = php_libxml_attr_value((const xmlAttr *) nodep, &free);
+			bool should_free;
+			xmlChar *value = php_libxml_attr_value((const xmlAttr *) nodep, &should_free);
 			RETVAL_STRING_FAST((const char *) value);
-			if (free) {
+			if (should_free) {
 				xmlFree(value);
 			}
 			return;
diff '--color=auto' -Naur a/ext/gd/libgd/gdkanji.c b/ext/gd/libgd/gdkanji.c
--- a/ext/gd/libgd/gdkanji.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/gd/libgd/gdkanji.c	2025-10-25 03:24:13.158289777 +0000
@@ -368,6 +368,8 @@
       else
 	error ("something happen");
       strcpy ((char *) to, (const char *) from);
+      if (iconv_close (cd) != 0)
+      	error ("iconv_close() error");
       return;
     }
 
diff '--color=auto' -Naur a/ext/gd/tests/gh19955.phpt b/ext/gd/tests/gh19955.phpt
--- a/ext/gd/tests/gh19955.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/gd/tests/gh19955.phpt	2025-10-25 03:24:13.158374784 +0000
@@ -0,0 +1,15 @@
+--TEST--
+GH-19955: (imagefttext() memory leak)
+--EXTENSIONS--
+gd
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+ini_set('error_reporting', E_ALL&~E_WARNING);
+$im = imagecreate(64, 32);
+imagefttext(imagecreate(8, 8), 0, 0, 0, 0, 255, __DIR__ . "/Tuffy.ttf", 'Ж');
+echo "OK"
+?>
+--EXPECT--
+OK
diff '--color=auto' -Naur a/ext/mysqli/tests/bug67563.phpt b/ext/mysqli/tests/bug67563.phpt
--- a/ext/mysqli/tests/bug67563.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/mysqli/tests/bug67563.phpt	2025-10-25 03:24:13.158465740 +0000
@@ -0,0 +1,40 @@
+--TEST--
+Fix bug #67563 (mysqli compiled with mysqlnd does not take ipv6 adress as parameter)
+--EXTENSIONS--
+mysqli
+--SKIPIF--
+<?php
+require_once 'connect.inc';
+
+if ($host !== '127.0.0.1')
+    die('skip local test');
+
+if (@stream_socket_client('udp://[::1]:8888') === false)
+    die('skip no IPv6 support 2');
+
+if (!$link = @my_mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
+    die(sprintf("SKIP Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+        $host, $user, $db, $port, $socket));
+}
+?>
+--INI--
+max_execution_time=240
+--FILE--
+<?php
+require_once 'connect.inc';
+
+$hosts = ['::1', "[::1]:$port"];
+
+foreach ($hosts as $host) {
+    if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
+        printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=%s dbname=%s, port=%s, socket=%s\n",
+            $host, $user, $passwd, $db, $port, $socket);
+    } else {
+        $link->close();
+    }
+}
+
+print "done!";
+?>
+--EXPECT--
+done!
diff '--color=auto' -Naur a/ext/mysqli/tests/fetch/mysqli_fetch_all_data_types_variation.phpt b/ext/mysqli/tests/fetch/mysqli_fetch_all_data_types_variation.phpt
--- a/ext/mysqli/tests/fetch/mysqli_fetch_all_data_types_variation.phpt	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/mysqli/tests/fetch/mysqli_fetch_all_data_types_variation.phpt	2025-10-25 03:24:13.158547280 +0000
@@ -4,6 +4,9 @@
 mysqli
 --SKIPIF--
 <?php
+if (getenv('GITHUB_ACTIONS') && str_starts_with(php_uname('m'), 'ppc')) {
+    die('skip Flaky on GitHub Actions PPC runner');
+}
 require_once dirname(__DIR__) . "/test_setup/test_helpers.inc";
 mysqli_check_skip_test();
 ?>
diff '--color=auto' -Naur a/ext/mysqlnd/mysqlnd_connection.c b/ext/mysqlnd/mysqlnd_connection.c
--- a/ext/mysqlnd/mysqlnd_connection.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/mysqlnd/mysqlnd_connection.c	2025-10-25 03:24:13.158699556 +0000
@@ -513,6 +513,16 @@
 }
 /* }}} */
 
+/* ipv6 addresses have at least two colons, which is how we can differentiate between domain names and addresses */
+static bool mysqlnd_fast_is_ipv6_address(const char *s)
+{
+	const char *first_colon = strchr(s, ':');
+	if (!first_colon) {
+		return false;
+	}
+	return strchr(first_colon + 1, ':') != NULL;
+}
+
 /* {{{ mysqlnd_conn_data::get_scheme */
 static MYSQLND_STRING
 MYSQLND_METHOD(mysqlnd_conn_data, get_scheme)(MYSQLND_CONN_DATA * conn, MYSQLND_CSTRING hostname, MYSQLND_CSTRING *socket_or_pipe, unsigned int port, bool * unix_socket, bool * named_pipe)
@@ -542,7 +552,13 @@
 		if (!port) {
 			port = 3306;
 		}
-		transport.l = mnd_sprintf(&transport.s, 0, "tcp://%s:%u", hostname.s, port);
+
+		/* ipv6 addresses are in the format [address]:port */
+		if (hostname.s[0] != '[' && mysqlnd_fast_is_ipv6_address(hostname.s)) {
+			transport.l = mnd_sprintf(&transport.s, 0, "tcp://[%s]:%u", hostname.s, port);
+		} else {
+			transport.l = mnd_sprintf(&transport.s, 0, "tcp://%s:%u", hostname.s, port);
+		}
 	}
 	DBG_INF_FMT("transport=%s", transport.s? transport.s:"OOM");
 	DBG_RETURN(transport);
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_aarch64.dasc b/ext/opcache/jit/ir/ir_aarch64.dasc
--- a/ext/opcache/jit/ir/ir_aarch64.dasc	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_aarch64.dasc	2025-10-25 03:24:13.159810441 +0000
@@ -397,6 +397,15 @@
 				n++;
 			}
 			break;
+		case IR_INT2FP:
+		case IR_FP2INT:
+			insn = &ctx->ir_base[ref];
+			n = 0;
+			if (IR_IS_CONST_REF(insn->op1)) {
+				constraints->tmp_regs[n] = IR_TMP_REG(1, ctx->ir_base[insn->op1].type, IR_LOAD_SUB_REF, IR_DEF_SUB_REF);
+				n++;
+			}
+			break;
 		case IR_MUL_PWR2:
 		case IR_DIV_PWR2:
 		case IR_MOD_PWR2:
@@ -404,8 +413,6 @@
 		case IR_SHIFT_CONST:
 		case IR_OP_INT:
 		case IR_OP_FP:
-		case IR_INT2FP:
-		case IR_FP2INT:
 		case IR_FP2FP:
 			insn = &ctx->ir_base[ref];
 			n = 0;
@@ -567,6 +574,10 @@
 			constraints->tmp_regs[n] = IR_TMP_REG(3, IR_ADDR, IR_LOAD_SUB_REF, IR_DEF_SUB_REF);
 			n++;
 			break;
+		case IR_ARGVAL:
+			constraints->tmp_regs[0] = IR_SCRATCH_REG(IR_REG_SCRATCH, IR_DEF_SUB_REF - IR_SUB_REFS_COUNT, IR_USE_SUB_REF);
+			n = 1;
+			break;
 		case IR_CALL:
 			insn = &ctx->ir_base[ref];
 			constraints->def_reg = (IR_IS_TYPE_INT(insn->type)) ? IR_REG_INT_RET1 : IR_REG_FP_RET1;
@@ -1096,6 +1107,8 @@
 				}
 			}
 			return IR_SKIPPED | IR_NOP;
+		case IR_ARGVAL:
+			return IR_FUSED | IR_ARGVAL;
 		case IR_NOP:
 			return IR_SKIPPED | IR_NOP;
 		default:
@@ -1379,6 +1392,12 @@
 	}
 }
 
+static int32_t ir_local_offset(ir_ctx *ctx, ir_insn *insn)
+{
+	IR_ASSERT(insn->op == IR_VAR || insn->op == IR_ALLOCA || insn->op == IR_VADDR);
+	return IR_SPILL_POS_TO_OFFSET(insn->op3);
+}
+
 static void ir_load_local_addr(ir_ctx *ctx, ir_reg reg, ir_ref src)
 {
 	ir_backend_data *data = ctx->data;
@@ -1392,13 +1411,12 @@
 	if (var_insn->op == IR_VADDR) {
 		var_insn = &ctx->ir_base[var_insn->op1];
 	}
-	IR_ASSERT(var_insn->op == IR_VAR || var_insn->op == IR_ALLOCA);
-	offset = IR_SPILL_POS_TO_OFFSET(var_insn->op3);
+	offset = ir_local_offset(ctx, var_insn);
 	if (aarch64_may_encode_imm12(offset)) {
 		|	add Rx(reg), Rx(base), #offset
 	} else {
 		ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
-		|	add sp, sp, Rx(IR_REG_INT_TMP)
+		|	add Rx(reg), sp, Rx(IR_REG_INT_TMP)
 	}
 }
 
@@ -1587,19 +1605,31 @@
 		offset = -(ctx->stack_frame_size+16);
 		if (aarch64_may_encode_imm7_addr_offset(offset, 8)) {
 			|	stp x29, x30, [sp, #offset]!
-		} else {
+		} else if (aarch64_may_encode_imm12(ctx->stack_frame_size+16)) {
 			|	sub sp, sp, #(ctx->stack_frame_size+16)
 			|	stp x29, x30, [sp]
+		} else {
+			ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, ctx->stack_frame_size+16);
+			|	sub sp, sp, Rx(IR_REG_INT_TMP)
+			|	stp x29, x30, [sp]
 		}
 		|	mov x29, sp
 		if (ctx->call_stack_size) {
-			| sub sp, sp, #(ctx->call_stack_size)
+			if (aarch64_may_encode_imm12(ctx->call_stack_size)) {
+				|	sub sp, sp, #(ctx->call_stack_size)
+			} else {
+				ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, ctx->call_stack_size);
+				|	sub sp, sp, Rx(IR_REG_INT_TMP)
+			}
 		}
 	} else if (ctx->stack_frame_size + ctx->call_stack_size) {
 		if (ctx->fixed_stack_red_zone) {
 			IR_ASSERT(ctx->stack_frame_size + ctx->call_stack_size <= ctx->fixed_stack_red_zone);
+		} else if (aarch64_may_encode_imm12(ctx->stack_frame_size + ctx->call_stack_size)) {
+			|	sub sp, sp, #(ctx->stack_frame_size + ctx->call_stack_size)
 		} else {
-			| sub sp, sp, #(ctx->stack_frame_size + ctx->call_stack_size)
+			ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, ctx->stack_frame_size + ctx->call_stack_size);
+			|	sub sp, sp, Rx(IR_REG_INT_TMP)
 		}
 	}
 	if (ctx->used_preserved_regs) {
@@ -1623,26 +1653,41 @@
 					offset -= sizeof(void*) * 2;
 					if (aarch64_may_encode_imm7_addr_offset(offset, 8)) {
 						|	stp Rx(prev), Rx(i), [Rx(fp), #offset]
-					} else {
-						IR_ASSERT(aarch64_may_encode_addr_offset(offset, 8));
+					} else if (aarch64_may_encode_addr_offset(offset + 8, 8)) {
 						|	str Rx(prev), [Rx(fp), #offset]
 						|	str Rx(i), [Rx(fp), #(offset+8)]
+					} else {
+						ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+						|	str Rx(prev), [Rx(fp), Rx(IR_REG_INT_TMP)]
+						|	add Rx(IR_REG_INT_TMP), Rx(IR_REG_INT_TMP), #8
+						|	str Rx(i), [Rx(fp), Rx(IR_REG_INT_TMP)]
 					}
 					prev = IR_REG_NONE;
 				} else {
 					if (prev < IR_REG_FP_FIRST) {
 						offset -= sizeof(void*);
-						|	str Rx(prev), [Rx(fp), #offset]
-						offset -= sizeof(void*);
-						|	str Rd(i-IR_REG_FP_FIRST), [Rx(fp), #offset]
+						if (aarch64_may_encode_addr_offset(offset, 8)) {
+							|	str Rx(prev), [Rx(fp), #offset]
+							offset -= sizeof(void*);
+							|	str Rd(i-IR_REG_FP_FIRST), [Rx(fp), #offset]
+						} else {
+							ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+							|	str Rx(prev), [Rx(fp), Rx(IR_REG_INT_TMP)]
+							|	sub Rx(IR_REG_INT_TMP), Rx(IR_REG_INT_TMP), #8
+							|	str Rd(i-IR_REG_FP_FIRST), [Rx(fp), Rx(IR_REG_INT_TMP)]
+						}
 					} else {
 						offset -= sizeof(void*) * 2;
 						if (aarch64_may_encode_imm7_addr_offset(offset, 8)) {
 							|	stp Rd(prev-IR_REG_FP_FIRST), Rd(i-IR_REG_FP_FIRST), [Rx(fp), #offset]
-						} else {
-							IR_ASSERT(aarch64_may_encode_addr_offset(offset, 8));
+						} else if (aarch64_may_encode_addr_offset(offset + 8, 8)) {
 							|	str Rd(prev-IR_REG_FP_FIRST), [Rx(fp), #offset]
 							|	str Rd(i-IR_REG_FP_FIRST), [Rx(fp), #(offset+8)]
+						} else {
+							ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+							|	str Rd(prev-IR_REG_FP_FIRST), [Rx(fp), Rx(IR_REG_INT_TMP)]
+							|	add Rx(IR_REG_INT_TMP), Rx(IR_REG_INT_TMP), #8
+							|	str Rd(i-IR_REG_FP_FIRST), [Rx(fp), Rx(IR_REG_INT_TMP)]
 						}
 					}
 					prev = IR_REG_NONE;
@@ -1652,10 +1697,20 @@
 	    if (prev != IR_REG_NONE) {
 			if (prev < IR_REG_FP_FIRST) {
 				offset -= sizeof(void*);
-				|	str Rx(prev), [Rx(fp), #offset]
+				if (aarch64_may_encode_addr_offset(offset, 8)) {
+					|	str Rx(prev), [Rx(fp), #offset]
+				} else {
+					ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+					|	str Rx(prev), [Rx(fp), Rx(IR_REG_INT_TMP)]
+				}
 			} else {
 				offset -= sizeof(void*);
-				|	str Rd(prev-IR_REG_FP_FIRST), [Rx(fp), #offset]
+				if (aarch64_may_encode_addr_offset(offset, 8)) {
+					|	str Rd(prev-IR_REG_FP_FIRST), [Rx(fp), #offset]
+				} else {
+					ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+					|	str Rd(prev-IR_REG_FP_FIRST), [Rx(fp), Rx(IR_REG_INT_TMP)]
+				}
 			}
 		}
 	}
@@ -1685,10 +1740,14 @@
 				if (prev != IR_REG_NONE) {
 					if (aarch64_may_encode_imm7_addr_offset(offset, 8)) {
 						|	stp Rx(prev), Rx(int_reg_params[i]), [Rx(fp), #offset]
-					} else {
-						IR_ASSERT(aarch64_may_encode_addr_offset(offset, 8));
+					} else if (aarch64_may_encode_addr_offset(offset + 8, 8)) {
 						|	str Rx(prev), [Rx(fp), #offset]
 						|	str Rx(int_reg_params[i]), [Rx(fp), #(offset+8)]
+					} else {
+						ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+						|	str Rx(prev), [Rx(fp), Rx(IR_REG_INT_TMP)]
+						|	add Rx(IR_REG_INT_TMP), Rx(IR_REG_INT_TMP), #8
+						|	str Rx(int_reg_params[i]), [Rx(fp), Rx(IR_REG_INT_TMP)]
 					}
 					prev = IR_REG_NONE;
 					offset += sizeof(void*) * 2;
@@ -1697,7 +1756,12 @@
 				}
 			}
 			if (prev != IR_REG_NONE) {
-				|	str Rx(prev), [Rx(fp), #offset]
+				if (aarch64_may_encode_addr_offset(offset + 8, 8)) {
+					|	str Rx(prev), [Rx(fp), #offset]
+				} else {
+					ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, offset);
+					|	str Rx(prev), [Rx(fp), Rx(IR_REG_INT_TMP)]
+				}
 				offset += sizeof(void*);
 			}
 		}
@@ -1782,15 +1846,22 @@
 		}
 		if (aarch64_may_encode_imm7_addr_offset(ctx->stack_frame_size+16, 8)) {
 			|	ldp x29, x30, [sp], #(ctx->stack_frame_size+16)
-		} else {
+		} else if (aarch64_may_encode_imm12(ctx->stack_frame_size+16)) {
 			|	ldp x29, x30, [sp]
 			|	add sp, sp, #(ctx->stack_frame_size+16)
+		} else {
+			ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, ctx->stack_frame_size+16);
+			|	ldp x29, x30, [sp]
+			|	add sp, sp, Rx(IR_REG_INT_TMP)
 		}
 	} else if (ctx->stack_frame_size + ctx->call_stack_size) {
 		if (ctx->fixed_stack_red_zone) {
 			IR_ASSERT(ctx->stack_frame_size + ctx->call_stack_size <= ctx->fixed_stack_red_zone);
-		} else {
+		} else if (aarch64_may_encode_imm12(ctx->stack_frame_size + ctx->call_stack_size)) {
 			| add sp, sp, #(ctx->stack_frame_size + ctx->call_stack_size)
+		} else {
+			ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, ctx->stack_frame_size + ctx->call_stack_size);
+			| add sp, sp, Rx(IR_REG_INT_TMP)
 		}
 	}
 }
@@ -3798,7 +3869,7 @@
 		IR_ASSERT(!IR_IS_SYM_CONST(ctx->ir_base[addr_insn->op2].op));
 		if (ir_rule(ctx, addr_insn->op1) == IR_STATIC_ALLOCA) {
 			reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-			offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[addr_insn->op1].op3);
+			offset = ir_local_offset(ctx, &ctx->ir_base[addr_insn->op1]);
 			offset += ctx->ir_base[addr_insn->op2].val.i32;
 			return IR_MEM_BO(reg, offset);
 		} else {
@@ -3816,7 +3887,7 @@
 	} else {
 		IR_ASSERT(addr_insn->op == IR_ALLOCA || addr_insn->op == IR_VADDR);
 		reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[ref].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[ref]);
 		return IR_MEM_BO(reg, offset);
 	}
 }
@@ -4205,7 +4276,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 
 	if (ctx->flags & IR_USE_FRAME_POINTER) {
@@ -4237,7 +4308,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 
 	if (ctx->flags & IR_USE_FRAME_POINTER) {
@@ -4304,7 +4375,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op2_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		op2_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	if (op3_reg != IR_REG_NONE) {
 		if (IR_REG_SPILLED(op3_reg)) {
@@ -4315,7 +4386,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op3) == IR_STATIC_ALLOCA);
 		op3_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op3_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op3].op3);
+		op3_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op3]);
 	}
 	|	ldr Rx(tmp_reg), [Rx(op3_reg), #op3_offset]
 	|	str Rx(tmp_reg), [Rx(op2_reg), #op2_offset]
@@ -4337,7 +4408,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op2_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		op2_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	if (op3_reg != IR_REG_NONE) {
 		if (IR_REG_SPILLED(op3_reg)) {
@@ -4348,7 +4419,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op3) == IR_STATIC_ALLOCA);
 		op3_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op3_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op3].op3);
+		op3_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op3]);
 	}
 	|	ldr Rx(tmp_reg), [Rx(op3_reg), #op3_offset]
 	|	str Rx(tmp_reg), [Rx(op2_reg), #op2_offset]
@@ -4386,7 +4457,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	|	ldr Rx(tmp_reg), [Rx(op2_reg), #offset]
 	ir_emit_load_mem(ctx, type, def_reg, IR_MEM_BO(tmp_reg, 0));
@@ -4418,7 +4489,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	if (IR_IS_TYPE_INT(type)) {
 		|	ldr Rw(tmp_reg), [Rx(op2_reg), #(offset+offsetof(ir_va_list, gr_offset))]
@@ -4681,7 +4752,7 @@
 	}
 }
 
-static int32_t ir_call_used_stack(ir_ctx *ctx, ir_insn *insn)
+static int32_t ir_call_used_stack(ir_ctx *ctx, ir_insn *insn, int32_t *copy_stack_ptr)
 {
 	int j, n;
 	ir_type type;
@@ -4689,7 +4760,7 @@
 	int fp_param = 0;
 	int int_reg_params_count = IR_REG_INT_ARGS;
 	int fp_reg_params_count = IR_REG_FP_ARGS;
-	int32_t used_stack = 0;
+	int32_t used_stack = 0, copy_stack = 0;
 #ifdef __APPLE__
 	const ir_proto_t *proto = ir_call_proto(ctx, insn);
 	int last_named_input = (proto && (proto->flags & IR_VARARG_FUNC)) ? proto->params_count + 2 : insn->inputs_count;
@@ -4697,7 +4768,16 @@
 
 	n = insn->inputs_count;
 	for (j = 3; j <= n; j++) {
-		type = ctx->ir_base[ir_insn_op(insn, j)].type;
+		ir_insn *arg = &ctx->ir_base[ir_insn_op(insn, j)];
+		type = arg->type;
+		if (arg->op == IR_ARGVAL) {
+			int size = arg->op2;
+			int align = arg->op3;
+			copy_stack += size;
+			align = IR_MAX((int)sizeof(void*), align);
+			copy_stack = IR_ALIGNED_SIZE(copy_stack, align);
+			type = IR_ADDR;
+		}
 #ifdef __APPLE__
 		if (j > last_named_input) {
 			used_stack += IR_MAX(sizeof(void*), ir_type_size[type]);
@@ -4717,7 +4797,9 @@
 		}
 	}
 
-	return used_stack;
+	copy_stack = IR_ALIGNED_SIZE(copy_stack, 16);
+	*copy_stack_ptr = copy_stack;
+	return used_stack + copy_stack;
 }
 
 static int32_t ir_emit_arguments(ir_ctx *ctx, ir_ref def, ir_insn *insn, ir_reg tmp_reg)
@@ -4736,7 +4818,7 @@
 	int fp_reg_params_count = IR_REG_FP_ARGS;
 	const int8_t *int_reg_params = _ir_int_reg_params;
 	const int8_t *fp_reg_params = _ir_fp_reg_params;
-	int32_t used_stack, stack_offset = 0;
+	int32_t used_stack, copy_stack = 0, stack_offset = 0, copy_stack_offset = 0;
 	ir_copy *copies;
 	bool do_pass3 = 0;
 	/* For temporaries we may use any scratch registers except for registers used for parameters */
@@ -4755,7 +4837,7 @@
 		// TODO: support for preallocated stack
 		used_stack = 0;
 	} else {
-		used_stack = ir_call_used_stack(ctx, insn);
+		used_stack = ir_call_used_stack(ctx, insn, &copy_stack);
 		/* Stack must be 16 byte aligned */
 		used_stack = IR_ALIGNED_SIZE(used_stack, 16);
 		if (ctx->fixed_call_stack_size && used_stack <= ctx->fixed_call_stack_size) {
@@ -4778,6 +4860,48 @@
 	int last_named_input = (proto && (proto->flags & IR_VARARG_FUNC)) ? proto->params_count + 2 : insn->inputs_count;
 #endif
 
+	if (copy_stack) {
+		/* Copy struct arguments */
+		for (j = 3; j <= n; j++) {
+			arg = ir_insn_op(insn, j);
+			src_reg = ir_get_alocated_reg(ctx, def, j);
+			arg_insn = &ctx->ir_base[arg];
+			type = arg_insn->type;
+
+			if (arg_insn->op == IR_ARGVAL) {
+				/* make a stack copy */
+				void *addr = memcpy;
+				int size = arg_insn->op2;
+				int align = arg_insn->op3;
+
+				copy_stack_offset += size;
+				align = IR_MAX((int)sizeof(void*), align);
+				copy_stack_offset = IR_ALIGNED_SIZE(copy_stack_offset, align);
+				src_reg = ctx->regs[arg][1];
+
+				|	add Rx(IR_REG_INT_ARG1), sp, #(used_stack - copy_stack_offset)
+				if (src_reg != IR_REG_NONE) {
+					if (IR_REG_SPILLED(src_reg)) {
+						src_reg = IR_REG_NUM(src_reg);
+						ir_emit_load(ctx, IR_ADDR, src_reg, arg_insn->op1);
+					}
+					|	mov Rx(IR_REG_INT_ARG2), Rx(src_reg)
+				} else {
+					ir_emit_load(ctx, IR_ADDR, IR_REG_INT_ARG2, arg_insn->op1);
+				}
+				ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_ARG3, size);
+
+				if (aarch64_may_use_b(ctx->code_buffer, addr)) {
+					|	bl &addr
+				} else {
+					ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_INT_TMP, (intptr_t)addr);
+					|	blr Rx(IR_REG_INT_TMP)
+				}
+			}
+		}
+		copy_stack_offset = 0;
+	}
+
 	/* 1. move all register arguments that should be passed through stack
 	 *    and collect arguments that should be passed through registers */
 	copies = ir_mem_malloc((n - 2) * sizeof(ir_copy));
@@ -4786,8 +4910,13 @@
 		src_reg = ir_get_alocated_reg(ctx, def, j);
 		arg_insn = &ctx->ir_base[arg];
 		type = arg_insn->type;
+
 #ifdef __APPLE__
 		if (j > last_named_input) {
+			if (arg_insn->op == IR_ARGVAL) {
+				do_pass3 = 1;
+				continue;
+			}
 			dst_reg = IR_REG_NONE; /* pass argument through stack */
 		} else
 #endif
@@ -4798,6 +4927,10 @@
 				dst_reg = IR_REG_NONE; /* pass argument through stack */
 			}
 			int_param++;
+			if (arg_insn->op == IR_ARGVAL) {
+				do_pass3 = 1;
+				continue;
+			}
 		} else {
 			IR_ASSERT(IR_IS_TYPE_FP(type));
 			if (fp_param < fp_reg_params_count) {
@@ -4808,7 +4941,9 @@
 			fp_param++;
 		}
 		if (dst_reg != IR_REG_NONE) {
-			if (src_reg == IR_REG_NONE) {
+			if (IR_IS_CONST_REF(arg) ||
+			    src_reg == IR_REG_NONE ||
+			    (IR_REG_SPILLED(src_reg) && !IR_REGSET_IN(IR_REGSET_PRESERVED, IR_REG_NUM(src_reg)))) {
 				/* delay CONST->REG and MEM->REG moves to third pass */
 				do_pass3 = 1;
 			} else {
@@ -4852,6 +4987,31 @@
 			src_reg = ir_get_alocated_reg(ctx, def, j);
 			arg_insn = &ctx->ir_base[arg];
 			type = arg_insn->type;
+			if (arg_insn->op == IR_ARGVAL) {
+				/* pass pointer to the copy on stack */
+				int size = arg_insn->op2;
+				int align = arg_insn->op3;
+
+				copy_stack_offset += size;
+				align = IR_MAX((int)sizeof(void*), align);
+				copy_stack_offset = IR_ALIGNED_SIZE(copy_stack_offset, align);
+#ifdef __APPLE__
+				if (j > last_named_input) {
+					|	add Rx(tmp_reg), sp, #(used_stack - copy_stack_offset)
+					ir_emit_store_mem_int(ctx, IR_ADDR, IR_MEM_BO(IR_REG_STACK_POINTER, stack_offset), tmp_reg);
+				} else
+#endif
+				if (int_param < int_reg_params_count) {
+					dst_reg = int_reg_params[int_param];
+					|	add Rx(dst_reg), sp, #(used_stack - copy_stack_offset)
+				} else {
+					|	add Rx(tmp_reg), sp, #(used_stack - copy_stack_offset)
+					ir_emit_store_mem_int(ctx, IR_ADDR, IR_MEM_BO(IR_REG_STACK_POINTER, stack_offset), tmp_reg);
+					stack_offset += sizeof(void*);
+				}
+				int_param++;
+				continue;
+			}
 #ifdef __APPLE__
 			if (j > last_named_input) {
 				dst_reg = IR_REG_NONE; /* pass argument through stack */
@@ -4874,7 +5034,9 @@
 				fp_param++;
 			}
 			if (dst_reg != IR_REG_NONE) {
-				if (src_reg == IR_REG_NONE) {
+				if (IR_IS_CONST_REF(arg) ||
+				    src_reg == IR_REG_NONE ||
+				    (IR_REG_SPILLED(src_reg) && !IR_REGSET_IN(IR_REGSET_PRESERVED, IR_REG_NUM(src_reg)))) {
 					if (IR_IS_CONST_REF(arg) && IR_IS_TYPE_INT(type)) {
 						if (ir_type_size[type] == 1) {
 							type = IR_ADDR;
@@ -5473,7 +5635,8 @@
 	int32_t stack_offset = 0;
 
 	if (ctx->flags & IR_USE_FRAME_POINTER) {
-		stack_offset = sizeof(void*) * 2; /* skip old frame pointer and return address */
+		/* skip old frame pointer and return address */
+		stack_offset = sizeof(void*) * 2 + ctx->stack_frame_size + ctx->call_stack_size;
 	} else {
 		stack_offset = ctx->stack_frame_size + ctx->call_stack_size;
 	}
@@ -5831,7 +5994,8 @@
 
 	for (i = 1, insn = ctx->ir_base + 1; i < ctx->insns_count;) {
 		if (insn->op == IR_CALL) {
-			call_stack_size = ir_call_used_stack(ctx, insn);
+			int32_t copy_stack;
+			call_stack_size = ir_call_used_stack(ctx, insn, &copy_stack);
 			if (call_stack_size > peak_call_stack_size) {
 				peak_call_stack_size = call_stack_size;
 			}
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_aarch64.h b/ext/opcache/jit/ir/ir_aarch64.h
--- a/ext/opcache/jit/ir/ir_aarch64.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_aarch64.h	2025-10-25 03:24:13.160477137 +0000
@@ -174,8 +174,8 @@
 		int8_t  reg;
 	};
 	uint8_t     type;
-	uint8_t     start;
-	uint8_t     end;
+	int8_t      start;
+	int8_t      end;
 } ir_tmp_reg;
 
 struct _ir_target_constraints {
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_builder.h b/ext/opcache/jit/ir/ir_builder.h
--- a/ext/opcache/jit/ir/ir_builder.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_builder.h	2025-10-25 03:24:13.160566661 +0000
@@ -586,6 +586,7 @@
 #define ir_VA_END(_list)                  _ir_VA_END(_ir_CTX, _list)
 #define ir_VA_COPY(_dst, _src)            _ir_VA_COPY(_ir_CTX, _dst, _src)
 #define ir_VA_ARG(_list, _type)           _ir_VA_ARG(_ir_CTX, _type, _list)
+#define ir_VA_ARG_EX(_list, _type, size)  _ir_VA_ARG_EX(_ir_CTX, _type, _list, size)
 
 #define ir_START()                        _ir_START(_ir_CTX)
 #define ir_ENTRY(_src, _num)              _ir_ENTRY(_ir_CTX, (_src), (_num))
@@ -661,6 +662,7 @@
 void   _ir_VA_END(ir_ctx *ctx, ir_ref list);
 void   _ir_VA_COPY(ir_ctx *ctx, ir_ref dst, ir_ref src);
 ir_ref _ir_VA_ARG(ir_ctx *ctx, ir_type type, ir_ref list);
+ir_ref _ir_VA_ARG_EX(ir_ctx *ctx, ir_type type, ir_ref list, size_t size);
 void   _ir_START(ir_ctx *ctx);
 void   _ir_ENTRY(ir_ctx *ctx, ir_ref src, ir_ref num);
 void   _ir_BEGIN(ir_ctx *ctx, ir_ref src);
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir.c b/ext/opcache/jit/ir/ir.c
--- a/ext/opcache/jit/ir/ir.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir.c	2025-10-25 03:24:13.159063217 +0000
@@ -227,6 +227,7 @@
 #define ir_op_flag_d0      ir_op_flag_d
 #define ir_op_flag_d1      (ir_op_flag_d | 1 | (1 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_d1X1    (ir_op_flag_d | 1 | (2 << IR_OP_FLAG_OPERANDS_SHIFT))
+#define ir_op_flag_d1X2    (ir_op_flag_d | 1 | (3 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_d2      (ir_op_flag_d | 2 | (2 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_d2C     (ir_op_flag_d | IR_OP_FLAG_COMMUTATIVE | 2 | (2 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_d3      (ir_op_flag_d | 3 | (3 << IR_OP_FLAG_OPERANDS_SHIFT))
@@ -270,6 +271,7 @@
 #define ir_op_flag_s3      (ir_op_flag_s | 3 | (3 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_x1      (IR_OP_FLAG_CONTROL|IR_OP_FLAG_MEM|IR_OP_FLAG_MEM_CALL | 1 | (1 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_x2      (IR_OP_FLAG_CONTROL|IR_OP_FLAG_MEM|IR_OP_FLAG_MEM_CALL | 2 | (2 << IR_OP_FLAG_OPERANDS_SHIFT))
+#define ir_op_flag_x2X1    (IR_OP_FLAG_CONTROL|IR_OP_FLAG_MEM|IR_OP_FLAG_MEM_CALL | 2 | (3 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_x3      (IR_OP_FLAG_CONTROL|IR_OP_FLAG_MEM|IR_OP_FLAG_MEM_CALL | 3 | (3 << IR_OP_FLAG_OPERANDS_SHIFT))
 #define ir_op_flag_xN      (IR_OP_FLAG_CONTROL|IR_OP_FLAG_MEM|IR_OP_FLAG_MEM_CALL | IR_OP_FLAG_VAR_INPUTS)
 #define ir_op_flag_a1      (IR_OP_FLAG_CONTROL|IR_OP_FLAG_MEM|IR_OP_FLAG_MEM_ALLOC | 1 | (1 << IR_OP_FLAG_OPERANDS_SHIFT))
@@ -392,6 +394,8 @@
 	ctx->insns_limit = insns_limit;
 	ctx->consts_count = -(IR_TRUE - 1);
 	ctx->consts_limit = consts_limit;
+	ctx->const_hash = ctx->_const_hash;
+	ctx->const_hash_mask = IR_CONST_HASH_SIZE - 1;
 	ctx->fold_cse_limit = IR_UNUSED + 1;
 	ctx->flags = flags;
 
@@ -414,6 +418,9 @@
 {
 	ir_insn *buf = ctx->ir_base - ctx->consts_limit;
 	ir_mem_free(buf);
+	if (ctx->value_params) {
+		ir_mem_free(ctx->value_params);
+	}
 	if (ctx->strtab.data) {
 		ir_strtab_free(&ctx->strtab);
 	}
@@ -468,6 +475,10 @@
 		ir_list_free((ir_list*)ctx->osr_entry_loads);
 		ir_mem_free(ctx->osr_entry_loads);
 	}
+
+	if (ctx->const_hash_mask != IR_CONST_HASH_SIZE - 1) {
+		ir_mem_free(ctx->const_hash);
+	}
 }
 
 ir_ref ir_unique_const_addr(ir_ctx *ctx, uintptr_t addr)
@@ -479,72 +490,64 @@
 	insn->val.u64 = addr;
 	/* don't insert into constants chain */
 	insn->prev_const = IR_UNUSED;
-#if 0
-	insn->prev_const = ctx->prev_const_chain[IR_ADDR];
-	ctx->prev_const_chain[IR_ADDR] = ref;
-#endif
-#if 0
-	ir_insn *prev_insn, *next_insn;
-	ir_ref next;
 
-	prev_insn = NULL;
-	next = ctx->prev_const_chain[IR_ADDR];
-	while (next) {
-		next_insn = &ctx->ir_base[next];
-		if (UNEXPECTED(next_insn->val.u64 >= addr)) {
-			break;
-		}
-		prev_insn = next_insn;
-		next = next_insn->prev_const;
-	}
+	return ref;
+}
 
-	if (prev_insn) {
-		insn->prev_const = prev_insn->prev_const;
-		prev_insn->prev_const = ref;
-	} else {
-		insn->prev_const = ctx->prev_const_chain[IR_ADDR];
-		ctx->prev_const_chain[IR_ADDR] = ref;
-	}
-#endif
+IR_ALWAYS_INLINE uintptr_t ir_const_hash(ir_val val, uint32_t optx)
+{
+	return (val.u64 ^ (val.u64 >> 32) ^ optx);
+}
 
-	return ref;
+static IR_NEVER_INLINE void ir_const_hash_rehash(ir_ctx *ctx)
+{
+	ir_insn *insn;
+	ir_ref ref;
+	uintptr_t hash;
+
+	if (ctx->const_hash_mask != IR_CONST_HASH_SIZE - 1) {
+		ir_mem_free(ctx->const_hash);
+	}
+	ctx->const_hash_mask = (ctx->const_hash_mask + 1) * 2 - 1;
+	ctx->const_hash = ir_mem_calloc(ctx->const_hash_mask + 1, sizeof(ir_ref));
+	for (ref = IR_TRUE - 1; ref > -ctx->consts_count; ref--) {
+		insn = &ctx->ir_base[ref];
+		hash = ir_const_hash(insn->val, insn->optx) & ctx->const_hash_mask;
+		insn->prev_const = ctx->const_hash[hash];
+		ctx->const_hash[hash] = ref;
+	}
 }
 
 ir_ref ir_const_ex(ir_ctx *ctx, ir_val val, uint8_t type, uint32_t optx)
 {
-	ir_insn *insn, *prev_insn;
+	ir_insn *insn;
 	ir_ref ref, prev;
+	uintptr_t hash;
 
 	if (type == IR_BOOL) {
 		return val.u64 ? IR_TRUE : IR_FALSE;
 	} else if (type == IR_ADDR && val.u64 == 0) {
 		return IR_NULL;
 	}
-	prev_insn = NULL;
-	ref = ctx->prev_const_chain[type];
+
+	hash = ir_const_hash(val, optx) & ctx->const_hash_mask;
+	ref = ctx->const_hash[hash];
 	while (ref) {
 		insn = &ctx->ir_base[ref];
-		if (UNEXPECTED(insn->val.u64 >= val.u64)) {
-			if (insn->val.u64 == val.u64) {
-				if (insn->optx == optx) {
-					return ref;
-				}
-			} else {
-				break;
-			}
+		if (insn->val.u64 == val.u64 && insn->optx == optx) {
+			return ref;
 		}
-		prev_insn = insn;
 		ref = insn->prev_const;
 	}
 
-	if (prev_insn) {
-		prev = prev_insn->prev_const;
-		prev_insn->prev_const = -ctx->consts_count;
-	} else {
-		prev = ctx->prev_const_chain[type];
-		ctx->prev_const_chain[type] = -ctx->consts_count;
+	if ((uintptr_t)ctx->consts_count > ctx->const_hash_mask) {
+		ir_const_hash_rehash(ctx);
+		hash = ir_const_hash(val, optx) & ctx->const_hash_mask;
 	}
 
+	prev = ctx->const_hash[hash];
+	ctx->const_hash[hash] = -ctx->consts_count;
+
 	ref = ir_next_const(ctx);
 	insn = &ctx->ir_base[ref];
 	insn->prev_const = prev;
@@ -624,7 +627,7 @@
 ir_ref ir_const_char(ir_ctx *ctx, char c)
 {
 	ir_val val;
-	val.i64 = c;
+	val.i64 = (signed char)c;
 	return ir_const(ctx, val, IR_CHAR);
 }
 
@@ -2092,10 +2095,10 @@
 				if (insn->type == type) {
 					return ref; /* load forwarding (L2L) */
 				} else if (ir_type_size[insn->type] == ir_type_size[type]) {
-					return ir_fold1(ctx, IR_OPT(IR_BITCAST, type), ref); /* load forwarding with bitcast (L2L) */
+					return ref; /* load forwarding with bitcast (L2L) */
 				} else if (ir_type_size[insn->type] > ir_type_size[type]
 						&& IR_IS_TYPE_INT(type) && IR_IS_TYPE_INT(insn->type)) {
-					return ir_fold1(ctx, IR_OPT(IR_TRUNC, type), ref); /* partial load forwarding (L2L) */
+					return ref; /* partial load forwarding (L2L) */
 				}
 			}
 		} else if (insn->op == IR_VSTORE) {
@@ -2105,10 +2108,10 @@
 				if (type2 == type) {
 					return insn->op3; /* store forwarding (S2L) */
 				} else if (ir_type_size[type2] == ir_type_size[type]) {
-					return ir_fold1(ctx, IR_OPT(IR_BITCAST, type), insn->op3); /* store forwarding with bitcast (S2L) */
+					return insn->op3; /* store forwarding with bitcast (S2L) */
 				} else if (ir_type_size[type2] > ir_type_size[type]
 						&& IR_IS_TYPE_INT(type) && IR_IS_TYPE_INT(type2)) {
-					return ir_fold1(ctx, IR_OPT(IR_TRUNC, type), insn->op3); /* partial store forwarding (S2L) */
+					return insn->op3; /* partial store forwarding (S2L) */
 				} else {
 					break;
 				}
@@ -3214,6 +3217,13 @@
 	return ctx->control = ir_emit2(ctx, IR_OPT(IR_VA_ARG, type), ctx->control, list);
 }
 
+ir_ref _ir_VA_ARG_EX(ir_ctx *ctx, ir_type type, ir_ref list, size_t size)
+{
+	IR_ASSERT(ctx->control);
+	IR_ASSERT(size <= 0x7fffffff);
+	return ctx->control = ir_emit3(ctx, IR_OPT(IR_VA_ARG, type), ctx->control, list, (ir_ref)size);
+}
+
 ir_ref _ir_BLOCK_BEGIN(ir_ctx *ctx)
 {
 	IR_ASSERT(ctx->control);
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_cfg.c b/ext/opcache/jit/ir/ir_cfg.c
--- a/ext/opcache/jit/ir/ir_cfg.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_cfg.c	2025-10-25 03:24:13.160775377 +0000
@@ -605,7 +605,7 @@
 
 /* Computes dominator tree using algorithm from "A Simple, Fast Dominance Algorithm" by
  * Cooper, Harvey and Kennedy. */
-static int ir_build_dominators_tree_slow(ir_ctx *ctx)
+static IR_NEVER_INLINE int ir_build_dominators_tree_slow(ir_ctx *ctx)
 {
 	uint32_t blocks_count, b, postnum;
 	ir_block *blocks, *bb;
@@ -690,28 +690,13 @@
 	/* Build dominators tree */
 	blocks[1].idom = 0;
 	blocks[1].dom_depth = 0;
-	for (b = 2, bb = &blocks[2]; b <= blocks_count; b++, bb++) {
-		uint32_t idom = bb->idom;
-		ir_block *idom_bb = &blocks[idom];
 
+	/* Construct children lists sorted by block number */
+	for (b = blocks_count, bb = &blocks[b]; b >= 2; b--, bb--) {
+		ir_block *idom_bb = &blocks[bb->idom];
 		bb->dom_depth = 0;
-		/* Sort by block number to traverse children in pre-order */
-		if (idom_bb->dom_child == 0) {
-			idom_bb->dom_child = b;
-		} else if (b < idom_bb->dom_child) {
-			bb->dom_next_child = idom_bb->dom_child;
-			idom_bb->dom_child = b;
-		} else {
-			int child = idom_bb->dom_child;
-			ir_block *child_bb = &blocks[child];
-
-			while (child_bb->dom_next_child > 0 && b > child_bb->dom_next_child) {
-				child = child_bb->dom_next_child;
-				child_bb = &blocks[child];
-			}
-			bb->dom_next_child = child_bb->dom_next_child;
-			child_bb->dom_next_child = b;
-		}
+		bb->dom_next_child = idom_bb->dom_child;
+		idom_bb->dom_child = b;
 	}
 
 	/* Recalculate dom_depth for all blocks */
@@ -769,6 +754,7 @@
 			ctx->flags2 &= ~IR_NO_LOOPS;
 //			IR_ASSERT(k > 1 && "Wrong blocks order: BB is before its single predecessor");
 			if (UNEXPECTED(k <= 1)) {
+slow_case:
 				ir_list_free(&worklist);
 				return ir_build_dominators_tree_slow(ctx);
 			}
@@ -780,7 +766,9 @@
 				if (idom < b) {
 					break;
 				}
-				IR_ASSERT(k > 0);
+				if (UNEXPECTED(k == 0)) {
+					goto slow_case;
+				}
 				ir_list_push(&worklist, idom);
 			}
 		}
@@ -808,25 +796,14 @@
 		}
 		bb->idom = idom;
 		idom_bb = &blocks[idom];
-
 		bb->dom_depth = idom_bb->dom_depth + 1;
-		/* Sort by block number to traverse children in pre-order */
-		if (idom_bb->dom_child == 0) {
-			idom_bb->dom_child = b;
-		} else if (b < idom_bb->dom_child) {
-			bb->dom_next_child = idom_bb->dom_child;
-			idom_bb->dom_child = b;
-		} else {
-			int child = idom_bb->dom_child;
-			ir_block *child_bb = &blocks[child];
-
-			while (child_bb->dom_next_child > 0 && b > child_bb->dom_next_child) {
-				child = child_bb->dom_next_child;
-				child_bb = &blocks[child];
-			}
-			bb->dom_next_child = child_bb->dom_next_child;
-			child_bb->dom_next_child = b;
-		}
+	}
+
+	/* Construct children lists sorted by block number */
+	for (b = blocks_count, bb = &blocks[b]; b >= 2; b--, bb--) {
+		ir_block *idom_bb = &blocks[bb->idom];
+		bb->dom_next_child = idom_bb->dom_child;
+		idom_bb->dom_child = b;
 	}
 
 	blocks[1].idom = 0;
@@ -945,23 +922,13 @@
 		ir_block *idom_bb = &blocks[idom];
 
 		bb->dom_depth = idom_bb->dom_depth + 1;
-		/* Sort by block number to traverse children in pre-order */
-		if (idom_bb->dom_child == 0) {
-			idom_bb->dom_child = b;
-		} else if (b < idom_bb->dom_child) {
-			bb->dom_next_child = idom_bb->dom_child;
-			idom_bb->dom_child = b;
-		} else {
-			int child = idom_bb->dom_child;
-			ir_block *child_bb = &blocks[child];
-
-			while (child_bb->dom_next_child > 0 && b > child_bb->dom_next_child) {
-				child = child_bb->dom_next_child;
-				child_bb = &blocks[child];
-			}
-			bb->dom_next_child = child_bb->dom_next_child;
-			child_bb->dom_next_child = b;
-		}
+	}
+
+	/* Construct children lists sorted by block number */
+	for (b = blocks_count, bb = &blocks[b]; b >= 2; b--, bb--) {
+		ir_block *idom_bb = &blocks[bb->idom];
+		bb->dom_next_child = idom_bb->dom_child;
+		idom_bb->dom_child = b;
 	}
 
 	return 1;
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_dump.c b/ext/opcache/jit/ir/ir_dump.c
--- a/ext/opcache/jit/ir/ir_dump.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_dump.c	2025-10-25 03:24:13.161034278 +0000
@@ -660,6 +660,12 @@
 			}
 			if (first) {
 				fprintf(f, ";");
+			} else if (ctx->value_params
+			 && insn->op == IR_PARAM
+			 && ctx->value_params[insn->op3 - 1].align) {
+				fprintf(f, ") ByVal(%d, %d);",
+					ctx->value_params[insn->op3 - 1].size,
+					ctx->value_params[insn->op3 - 1].align);
 			} else {
 				fprintf(f, ");");
 			}
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_emit.c b/ext/opcache/jit/ir/ir_emit.c
--- a/ext/opcache/jit/ir/ir_emit.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_emit.c	2025-10-25 03:24:13.161165479 +0000
@@ -167,11 +167,24 @@
 		if (insn->op == IR_PARAM) {
 			if (IR_IS_TYPE_INT(insn->type)) {
 				if (use == ref) {
+#if defined(IR_TARGET_X64) || defined(IR_TARGET_X86)
+					if (ctx->value_params && ctx->value_params[insn->op3 - 1].align) {
+						/* struct passed by value on stack */
+						return IR_REG_NONE;
+					} else
+#endif
 					if (int_param < int_reg_params_count) {
 						return int_reg_params[int_param];
 					} else {
 						return IR_REG_NONE;
 					}
+#if defined(IR_TARGET_X64) || defined(IR_TARGET_X86)
+				} else {
+					if (ctx->value_params && ctx->value_params[insn->op3 - 1].align) {
+						/* struct passed by value on stack */
+						continue;
+					}
+#endif
 				}
 				int_param++;
 #ifdef _WIN64
@@ -222,9 +235,12 @@
 	n = insn->inputs_count;
 	n = IR_MIN(n, IR_MAX_REG_ARGS + 2);
 	for (j = 3; j <= n; j++) {
-		type = ctx->ir_base[ir_insn_op(insn, j)].type;
+		ir_insn *arg = &ctx->ir_base[ir_insn_op(insn, j)];
+		type = arg->type;
 		if (IR_IS_TYPE_INT(type)) {
-			if (int_param < int_reg_params_count) {
+			if (arg->op == IR_ARGVAL) {
+				continue;
+			} else if (int_param < int_reg_params_count) {
 				regs[j] = int_reg_params[int_param];
 				count = j + 1;
 			} else {
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_fold.h b/ext/opcache/jit/ir/ir_fold.h
--- a/ext/opcache/jit/ir/ir_fold.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_fold.h	2025-10-25 03:24:13.161353902 +0000
@@ -1703,6 +1703,11 @@
 {
 	if (op2_insn->val.u64 == 0) {
 		/* a +/- 0 => a */
+		if (op1_insn->type != IR_OPT_TYPE(opt)) {
+			opt = IR_BITCAST | (opt & IR_OPT_TYPE_MASK);
+			op2 = IR_UNUSED;
+			IR_FOLD_RESTART;
+		}
 		IR_FOLD_COPY(op1);
 	}
 	IR_FOLD_NEXT;
@@ -1721,6 +1726,12 @@
 {
 	if (op1_insn->val.u64 == 0) {
 		/* 0 + a => a */
+		if (op2_insn->type != IR_OPT_TYPE(opt)) {
+			opt = IR_BITCAST | (opt & IR_OPT_TYPE_MASK);
+			op1 = op2;
+			op2 = IR_UNUSED;
+			IR_FOLD_RESTART;
+		}
 		IR_FOLD_COPY(op2);
 	}
 	IR_FOLD_NEXT;
@@ -2927,7 +2938,7 @@
 		/* c1 - (x - c2) => (c1 + c2) - x */
 		val.u64 = op1_insn->val.u64 + ctx->ir_base[op2_insn->op2].val.u64;
 		op2 = op2_insn->op1;
-		op1 = ir_const(ctx, val, op1_insn->op1);
+		op1 = ir_const(ctx, val, op1_insn->type);
 		IR_FOLD_RESTART;
 	} else if (IR_IS_CONST_REF(op2_insn->op1) && !IR_IS_SYM_CONST(ctx->ir_base[op2_insn->op1].op)) {
 		/* c1 - (c2 - x) => x + (c1 - c2) */
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_gcm.c b/ext/opcache/jit/ir/ir_gcm.c
--- a/ext/opcache/jit/ir/ir_gcm.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_gcm.c	2025-10-25 03:24:13.161592935 +0000
@@ -792,21 +792,26 @@
 	ir_ref *p = insn->ops + 1;
 
 	if (n == 1) {
-		return *p < start;
+		return ctx->cfg_map[*p] < b;
 	} else {
 		IR_ASSERT(n > 1);
 		for (; n > 0; p++, n--) {
 			ir_ref input = *p;
-			if (input < start) {
-				/* ordered */
-			} else if ((bb->flags & IR_BB_LOOP_HEADER)
-			  && (ctx->cfg_map[input] == b || ctx->cfg_blocks[ctx->cfg_map[input]].loop_header == b)) {
-				/* back-edge of reducible loop */
-			} else if ((bb->flags & IR_BB_IRREDUCIBLE_LOOP)
-			  && (ctx->cfg_blocks[ctx->cfg_map[input]].loop_header == ctx->cfg_blocks[b].loop_header)) {
-				/* closing edge of irreducible loop */
-			} else {
-				return 0;
+
+			if (!IR_IS_CONST_REF(input)) {
+				uint32_t input_b = ctx->cfg_map[input];
+
+				if (input_b < b) {
+					/* ordered */
+				} else if ((bb->flags & IR_BB_LOOP_HEADER)
+				  && (input_b == b || ctx->cfg_blocks[input_b].loop_header == b)) {
+					/* back-edge of reducible loop */
+				} else if ((bb->flags & IR_BB_IRREDUCIBLE_LOOP)
+				  && (ctx->cfg_blocks[input_b].loop_header == bb->loop_header)) {
+					/* closing edge of irreducible loop */
+				} else {
+					return 0;
+				}
 			}
 		}
 		return 1;
@@ -925,121 +930,54 @@
 	ir_ref *_xlat;
 	ir_ref *edges;
 	ir_ref prev_b_end;
-	uint32_t b, prev_b;
+	uint32_t b;
 	uint32_t *_blocks = ctx->cfg_map;
 	ir_ref *_next = ir_mem_malloc(ctx->insns_count * sizeof(ir_ref));
 	ir_ref *_prev = ir_mem_malloc(ctx->insns_count * sizeof(ir_ref));
-	ir_ref _move_down = 0;
 	ir_block *bb;
 	ir_insn *insn, *new_insn;
 	ir_use_list *lists, *use_list, *new_list;
 	bool bad_bb_order = 0;
 
+
 	/* Create a double-linked list of nodes ordered by BB, respecting BB->start and BB->end */
 	IR_ASSERT(_blocks[1] == 1);
-	prev_b = 1;
-	prev_b_end = ctx->cfg_blocks[1].end;
+
+	/* link BB boundaries */
 	_prev[1] = 0;
-	_prev[prev_b_end] = 0;
+	prev_b_end = ctx->cfg_blocks[1].end;
+	_next[1] = prev_b_end;
+	_prev[prev_b_end] = 1;
+	for (b = 2, bb = ctx->cfg_blocks + 2; b <= ctx->cfg_blocks_count; b++, bb++) {
+		_next[prev_b_end] = bb->start;
+		_prev[bb->start] = prev_b_end;
+		_next[bb->start] = bb->end;
+		_prev[bb->end] = bb->start;
+		prev_b_end = bb->end;
+		if (!ir_is_good_bb_order(ctx, b, bb, bb->start)) {
+			bad_bb_order = 1;
+		}
+	}
+	_next[prev_b_end] = 0;
+
+	/* insert intermediate BB nodes */
 	for (i = 2, j = 1; i < ctx->insns_count; i++) {
 		b = _blocks[i];
-		IR_ASSERT((int32_t)b >= 0);
-		if (b == prev_b && i <= prev_b_end) {
-			/* add to the end of the list */
-			_next[j] = i;
-			_prev[i] = j;
-			j = i;
-		} else if (b > prev_b) {
-			bb = &ctx->cfg_blocks[b];
-			if (i == bb->start) {
-				if (bb->end > bb->start) {
-					prev_b = b;
-					prev_b_end = bb->end;
-					/* add to the end of the list */
-					_next[j] = i;
-					_prev[i] = j;
-					j = i;
-				} else {
-					prev_b = 0;
-					prev_b_end = 0;
-					k = bb->end;
-					while (_blocks[_prev[k]] == b) {
-						k = _prev[k];
-					}
-					/* insert before "k" */
-					_prev[i] = _prev[k];
-					_next[i] = k;
-					_next[_prev[k]] = i;
-					_prev[k] = i;
-				}
-				if (!ir_is_good_bb_order(ctx, b, bb, i)) {
-					bad_bb_order = 1;
-				}
-			} else if (i != bb->end) {
-				/* move down late (see the following loop) */
-				_next[i] = _move_down;
-				_move_down = i;
-			} else {
-				prev_b = 0;
-				prev_b_end = 0;
-				if (bb->start > bb->end) {
-					/* add to the end of the list */
-					_next[j] = i;
-					_prev[i] = j;
-					j = i;
-				} else {
-					k = bb->start;
-					while (_blocks[_next[k]] == b) {
-						k = _next[k];
-					}
-					/* insert after "k" */
-					_next[i] = _next[k];
-					_prev[i] = k;
-					_prev[_next[k]] = i;
-					_next[k] = i;
-				}
-			}
-		} else if (b) {
-			bb = &ctx->cfg_blocks[b];
-			IR_ASSERT(i != bb->start);
-			if (i > bb->end) {
-				/* move up, insert before the end of the already scheduled BB */
-				k = bb->end;
-			} else {
-				IR_ASSERT(i > bb->start);
-				/* move up, insert at the end of the block */
-				k = ctx->cfg_blocks[b + 1].start;
-			}
-			/* insert before "k" */
-			_prev[i] = _prev[k];
-			_next[i] = k;
-			_next[_prev[k]] = i;
-			_prev[k] = i;
-		}
-	}
-	_next[j] = 0;
-
-	while (_move_down) {
-		i = _move_down;
-		_move_down = _next[i];
-		b = _blocks[i];
+		if (!b) continue;
 		bb = &ctx->cfg_blocks[b];
-		k = _next[bb->start];
-
-		if (bb->flags & (IR_BB_HAS_PHI|IR_BB_HAS_PI|IR_BB_HAS_PARAM|IR_BB_HAS_VAR)) {
-			/* insert after the start of the block and all PARAM, VAR, PI, PHI */
-			insn = &ctx->ir_base[k];
-			while (insn->op == IR_PHI || insn->op == IR_PARAM || insn->op == IR_VAR || insn->op == IR_PI) {
-				k = _next[k];
-				insn = &ctx->ir_base[k];
-			}
+		if (i != bb->start && i != bb->end) {
+			/* insert before "end" */
+			ir_ref n = bb->end;
+			ir_ref p = _prev[n];
+			_prev[i] = p;
+			_next[i] = n;
+			_next[p] = i;
+			_prev[n] = i;
 		}
+	}
 
-		/* insert before "k" */
-		_prev[i] = _prev[k];
-		_next[i] = k;
-		_next[_prev[k]] = i;
-		_prev[k] = i;
+	if (bad_bb_order) {
+		ir_fix_bb_order(ctx, _prev, _next);
 	}
 
 #ifdef IR_DEBUG
@@ -1051,10 +989,6 @@
 	}
 #endif
 
-	if (bad_bb_order) {
-		ir_fix_bb_order(ctx, _prev, _next);
-	}
-
 	_xlat = ir_mem_calloc((ctx->consts_count + ctx->insns_count), sizeof(ir_ref));
 	_xlat += ctx->consts_count;
 	_xlat[IR_TRUE] = IR_TRUE;
@@ -1168,7 +1102,11 @@
 			if (end->op == IR_IF) {
 				/* Move condition closer to IF */
 				input = end->op2;
-				if (input > 0 && _blocks[input] == b && !_xlat[input] && _prev[j] != input) {
+				if (input > 0
+				 && _blocks[input] == b
+				 && !_xlat[input]
+				 && _prev[j] != input
+				 && (!(ir_op_flags[ctx->ir_base[input].op] & IR_OP_FLAG_CONTROL) || end->op1 == input)) {
 					if (input == i) {
 						i = _next[i];
 						insn = &ctx->ir_base[i];
@@ -1188,6 +1126,7 @@
 			ir_ref n, j, *p, input;
 
 restart:
+			IR_ASSERT(_blocks[i] == b);
 			n = insn->inputs_count;
 			for (j = n, p = insn->ops + 1; j > 0; p++, j--) {
 				input = *p;
@@ -1221,6 +1160,7 @@
 			}
 			_xlat[i] = insns_count;
 			insns_count += ir_insn_inputs_to_len(n);
+			IR_ASSERT(_next[i] != IR_UNUSED);
 			i = _next[i];
 			insn = &ctx->ir_base[i];
 		}
@@ -1274,6 +1214,7 @@
 	new_ctx.insns_count = insns_count;
 	new_ctx.flags2 = ctx->flags2;
 	new_ctx.ret_type = ctx->ret_type;
+	new_ctx.value_params = ctx->value_params;
 	new_ctx.mflags = ctx->mflags;
 	new_ctx.spill_base = ctx->spill_base;
 	new_ctx.fixed_stack_red_zone = ctx->fixed_stack_red_zone;
@@ -1511,6 +1452,7 @@
 	new_ctx.cfg_edges = ctx->cfg_edges;
 	ctx->cfg_blocks = NULL;
 	ctx->cfg_edges = NULL;
+	ctx->value_params = NULL;
 	ir_code_buffer *saved_code_buffer = ctx->code_buffer;
 
 	ir_free(ctx);
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir.h b/ext/opcache/jit/ir/ir.h
--- a/ext/opcache/jit/ir/ir.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir.h	2025-10-25 03:24:13.159375957 +0000
@@ -310,6 +310,8 @@
 	_(PHI,          pN,   reg, def, def) /* SSA Phi function            */ \
 	_(COPY,         d1X1, def, opt, ___) /* COPY (last foldable op)     */ \
 	_(PI,           p2,   reg, def, ___) /* e-SSA Pi constraint ???     */ \
+	_(ARGVAL,       d1X2, def, num, num) /* pass struct arg by value    */ \
+	                                     /* (op2 - size, op3 - align)   */ \
 	/* (USE, RENAME)                                                    */ \
 	\
 	/* data ops                                                         */ \
@@ -343,7 +345,8 @@
 	_(VA_START,     x2,   src, def, ___) /* va_start(va_list)           */ \
 	_(VA_END,       x2,   src, def, ___) /* va_end(va_list)             */ \
 	_(VA_COPY,      x3,   src, def, def) /* va_copy(dst, stc)           */ \
-	_(VA_ARG,       x2,   src, def, ___) /* va_arg(va_list)             */ \
+	_(VA_ARG,       x2X1, src, def, opt) /* va_arg(va_list)             */ \
+	                                     /* op3 - (size<<3)+log2(align) */ \
 	\
 	/* guards                                                           */ \
 	_(GUARD,        c3,   src, def, def) /* IF without second successor */ \
@@ -583,12 +586,22 @@
 	void *pos;
 } ir_code_buffer;
 
+typedef struct {
+	int   size;
+	int   align;
+	int   offset;
+} ir_value_param;
+
+#define IR_CONST_HASH_SIZE 64
+
 struct _ir_ctx {
 	ir_insn           *ir_base;                 /* two directional array - instructions grow down, constants grow up */
 	ir_ref             insns_count;             /* number of instructions stored in instructions buffer */
 	ir_ref             insns_limit;             /* size of allocated instructions buffer (it's extended when overflow) */
 	ir_ref             consts_count;            /* number of constants stored in constants buffer */
 	ir_ref             consts_limit;            /* size of allocated constants buffer (it's extended when overflow) */
+	uintptr_t          const_hash_mask;
+	ir_ref            *const_hash;
 	uint32_t           flags;                   /* IR context flags (see IR_* defines above) */
 	uint32_t           flags2;                  /* IR context private flags (see IR_* defines in ir_private.h) */
 	ir_type            ret_type;                /* Function return type */
@@ -596,6 +609,7 @@
 	int32_t            status;                  /* non-zero error code (see IR_ERROR_... macros), app may use negative codes */
 	ir_ref             fold_cse_limit;          /* CSE finds identical insns backward from "insn_count" to "fold_cse_limit" */
 	ir_insn            fold_insn;               /* temporary storage for folding engine */
+	ir_value_param    *value_params;            /* information about "by-val" struct parameters */
 	ir_hashtab        *binding;
 	ir_use_list       *use_lists;               /* def->use lists for each instruction */
 	ir_ref            *use_edges;               /* the actual uses: use = ctx->use_edges[ctx->use_lists[def].refs + n] */
@@ -655,7 +669,7 @@
 	ir_loader         *loader;
 	ir_strtab          strtab;
 	ir_ref             prev_insn_chain[IR_LAST_FOLDABLE_OP + 1];
-	ir_ref             prev_const_chain[IR_LAST_TYPE];
+	ir_ref             _const_hash[IR_CONST_HASH_SIZE];
 };
 
 /* Basic IR Construction API (implementation in ir.c) */
@@ -896,6 +910,7 @@
 #define IR_SAVE_SAFE_NAMES (1<<5) /* add '@' prefix to symbol names */
 
 void ir_print_proto(const ir_ctx *ctx, ir_ref proto, FILE *f);
+void ir_print_proto_ex(uint8_t flags, ir_type ret_type, uint32_t params_count, const uint8_t *param_types, FILE *f);
 void ir_save(const ir_ctx *ctx, uint32_t save_flags, FILE *f);
 
 /* IR debug dump API (implementation in ir_dump.c) */
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_ra.c b/ext/opcache/jit/ir/ir_ra.c
--- a/ext/opcache/jit/ir/ir_ra.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_ra.c	2025-10-25 03:24:13.161943616 +0000
@@ -1193,7 +1193,7 @@
 		n = IR_INPUT_EDGES_COUNT(flags);
 		j = 1;
 		p = insn->ops + j;
-		if (flags & IR_OP_FLAG_CONTROL) {
+		if (flags & (IR_OP_FLAG_CONTROL|IR_OP_FLAG_PINNED)) {
 			j++;
 			p++;
 		}
@@ -1340,7 +1340,7 @@
 					  || (ctx->rules[ref] & IR_RULE_MASK) == IR_ALLOCA)
 					 && ctx->use_lists[ref].count > 0) {
 						insn = &ctx->ir_base[ref];
-						if (insn->op != IR_VADDR) {
+						if (insn->op != IR_VADDR && insn->op != IR_PARAM) {
 							insn->op3 = ctx->vars;
 							ctx->vars = ref;
 						}
@@ -1630,6 +1630,10 @@
 	if (ctx->ir_base[IR_LIVE_POS_TO_REF(ctx->live_intervals[r1]->use_pos->pos)].op != IR_VLOAD) {
 		ctx->live_intervals[r1]->flags &= ~IR_LIVE_INTERVAL_MEM_LOAD;
 	}
+	if (ival->flags & IR_LIVE_INTERVAL_MEM_PARAM) {
+		IR_ASSERT(!(ctx->live_intervals[r1]->flags & IR_LIVE_INTERVAL_MEM_PARAM));
+		ctx->live_intervals[r1]->flags |= IR_LIVE_INTERVAL_MEM_PARAM;
+	}
 	ctx->live_intervals[r2] = NULL;
 
 	// TODO: remember to reuse ???
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_save.c b/ext/opcache/jit/ir/ir_save.c
--- a/ext/opcache/jit/ir/ir_save.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_save.c	2025-10-25 03:24:13.162230131 +0000
@@ -10,31 +10,35 @@
 
 void ir_print_proto(const ir_ctx *ctx, ir_ref func_proto, FILE *f)
 {
-	ir_ref j;
-
 	if (func_proto) {
 		const ir_proto_t *proto = (const ir_proto_t *)ir_get_str(ctx, func_proto);
+		ir_print_proto_ex(proto->flags, proto->ret_type, proto->params_count, proto->param_types, f);
+	} else {
+		fprintf(f, "(): int32_t");
+	}
+}
 
-		fprintf(f, "(");
-		if (proto->params_count > 0) {
-			fprintf(f, "%s", ir_type_cname[proto->param_types[0]]);
-			for (j = 1; j < proto->params_count; j++) {
-				fprintf(f, ", %s", ir_type_cname[proto->param_types[j]]);
-			}
-			if (proto->flags & IR_VARARG_FUNC) {
-				fprintf(f, ", ...");
-			}
-		} else if (proto->flags & IR_VARARG_FUNC) {
-			fprintf(f, "...");
+void ir_print_proto_ex(uint8_t flags, ir_type ret_type, uint32_t params_count, const uint8_t *param_types, FILE *f)
+{
+	uint32_t j;
+
+	fprintf(f, "(");
+	if (params_count > 0) {
+		fprintf(f, "%s", ir_type_cname[param_types[0]]);
+		for (j = 1; j < params_count; j++) {
+			fprintf(f, ", %s", ir_type_cname[param_types[j]]);
 		}
-		fprintf(f, "): %s", ir_type_cname[proto->ret_type]);
-		if (proto->flags & IR_FASTCALL_FUNC) {
-			fprintf(f, " __fastcall");
-		} else if (proto->flags & IR_BUILTIN_FUNC) {
-			fprintf(f, " __builtin");
+		if (flags & IR_VARARG_FUNC) {
+			fprintf(f, ", ...");
 		}
-	} else {
-		fprintf(f, "(): int32_t");
+	} else if (flags & IR_VARARG_FUNC) {
+		fprintf(f, "...");
+	}
+	fprintf(f, "): %s", ir_type_cname[ret_type]);
+	if (flags & IR_FASTCALL_FUNC) {
+		fprintf(f, " __fastcall");
+	} else if (flags & IR_BUILTIN_FUNC) {
+		fprintf(f, " __builtin");
 	}
 }
 
@@ -280,6 +284,12 @@
 		}
 		if (first) {
 			fprintf(f, ";");
+		} else if (ctx->value_params
+		 && insn->op == IR_PARAM
+		 && ctx->value_params[insn->op3 - 1].align) {
+			fprintf(f, ") ByVal(%d, %d);",
+				ctx->value_params[insn->op3 - 1].size,
+				ctx->value_params[insn->op3 - 1].align);
 		} else {
 			fprintf(f, ");");
 		}
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_sccp.c b/ext/opcache/jit/ir/ir_sccp.c
--- a/ext/opcache/jit/ir/ir_sccp.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_sccp.c	2025-10-25 03:24:13.162440675 +0000
@@ -1875,6 +1875,7 @@
 		case IR_I8:
 		case IR_U8:
 		case IR_BOOL:
+		case IR_CHAR:
 			if (op == IR_SEXT) {
 				new_val.i64 = (int64_t)val_insn->val.i8;
 			} else {
@@ -1928,7 +1929,7 @@
 	return ref;
 }
 
-static uint32_t _ir_estimated_control(ir_ctx *ctx, ir_ref val)
+static uint32_t _ir_estimated_control(ir_ctx *ctx, ir_ref val, ir_ref loop)
 {
 	ir_insn *insn;
 	ir_ref n, *p, input, result, ctrl;
@@ -1953,7 +1954,8 @@
 	result = 1;
 	for (; n > 0; p++, n--) {
 		input = *p;
-		ctrl = _ir_estimated_control(ctx, input);
+		ctrl = _ir_estimated_control(ctx, input, loop);
+		if (ctrl >= loop) return ctrl;
 		if (ctrl > result) { // TODO: check dominance depth instead of order
 			result = ctrl;
 		}
@@ -1963,7 +1965,7 @@
 
 static bool ir_is_loop_invariant(ir_ctx *ctx, ir_ref ref, ir_ref loop)
 {
-	ref = _ir_estimated_control(ctx, ref);
+	ref = _ir_estimated_control(ctx, ref, loop);
 	return ref < loop; // TODO: check dominance instead of order
 }
 
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_x86.dasc b/ext/opcache/jit/ir/ir_x86.dasc
--- a/ext/opcache/jit/ir/ir_x86.dasc	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_x86.dasc	2025-10-25 03:24:13.163178533 +0000
@@ -1387,6 +1387,12 @@
 			constraints->tmp_regs[n] = IR_TMP_REG(3, IR_ADDR, IR_LOAD_SUB_REF, IR_DEF_SUB_REF);
 			n++;
 			break;
+		case IR_ARGVAL:
+			constraints->tmp_regs[0] = IR_SCRATCH_REG(IR_REG_RSI, IR_DEF_SUB_REF - IR_SUB_REFS_COUNT, IR_USE_SUB_REF);
+			constraints->tmp_regs[1] = IR_SCRATCH_REG(IR_REG_RDI, IR_DEF_SUB_REF - IR_SUB_REFS_COUNT, IR_USE_SUB_REF);
+			constraints->tmp_regs[2] = IR_SCRATCH_REG(IR_REG_RCX, IR_DEF_SUB_REF - IR_SUB_REFS_COUNT, IR_USE_SUB_REF);
+			n = 3;
+			break;
 		case IR_CALL:
 			insn = &ctx->ir_base[ref];
 			if (IR_IS_TYPE_INT(insn->type)) {
@@ -2431,6 +2437,11 @@
 		case IR_VAR:
 			return IR_SKIPPED | IR_VAR;
 		case IR_PARAM:
+#ifndef _WIN64
+			if (ctx->value_params && ctx->value_params[insn->op3 - 1].align) {
+				return IR_STATIC_ALLOCA;
+			}
+#endif
 			return ctx->use_lists[ref].count > 0 ? IR_PARAM : IR_SKIPPED | IR_PARAM;
 		case IR_ALLOCA:
 			/* alloca() may be used only in functions */
@@ -2976,6 +2987,8 @@
 				}
 			}
 			return IR_SKIPPED | IR_NOP;
+		case IR_ARGVAL:
+			return IR_FUSED | IR_ARGVAL;
 		case IR_NOP:
 			return IR_SKIPPED | IR_NOP;
 		default:
@@ -3153,6 +3166,17 @@
 	}
 }
 
+static int32_t ir_local_offset(ir_ctx *ctx, ir_insn *insn)
+{
+	if (insn->op != IR_PARAM) {
+		IR_ASSERT(insn->op == IR_VAR || insn->op == IR_ALLOCA || insn->op == IR_VADDR);
+		return IR_SPILL_POS_TO_OFFSET(insn->op3);
+	} else {
+		IR_ASSERT(ctx->value_params && ctx->value_params[insn->op3 - 1].align);
+		return IR_SPILL_POS_TO_OFFSET(ctx->value_params[insn->op3 - 1].offset);
+	}
+}
+
 static void ir_load_local_addr(ir_ctx *ctx, ir_reg reg, ir_ref src)
 {
 	ir_backend_data *data = ctx->data;
@@ -3166,8 +3190,7 @@
 	if (var_insn->op == IR_VADDR) {
 		var_insn = &ctx->ir_base[var_insn->op1];
 	}
-	IR_ASSERT(var_insn->op == IR_VAR || var_insn->op == IR_ALLOCA);
-	offset = IR_SPILL_POS_TO_OFFSET(var_insn->op3);
+	offset = ir_local_offset(ctx, var_insn);
 	if (offset == 0) {
 		| mov Ra(reg), Ra(base)
 	} else {
@@ -3385,7 +3408,7 @@
 		case IR_LEA_OB:
 			offset_insn = insn;
 			if (ir_rule(ctx, insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 			} else {
@@ -3407,12 +3430,12 @@
 			break;
 		case IR_LEA_IB:
 			if (ir_rule(ctx, insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = ref * sizeof(ir_ref) + 2;
 			} else if (ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = ref * sizeof(ir_ref) + 1;
@@ -3428,12 +3451,12 @@
 			offset_insn = op1_insn;
 			scale = 1;
 			if (ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = insn->op1 * sizeof(ir_ref) + 1;
 			} else if (ir_rule(ctx, op1_insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[op1_insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[op1_insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = ref * sizeof(ir_ref) + 2;
@@ -3447,12 +3470,12 @@
 			offset_insn = op2_insn;
 			scale = 1;
 			if (ir_rule(ctx, insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = insn->op2 * sizeof(ir_ref) + 1;
 			} else if (ir_rule(ctx, op2_insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[op2_insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[op2_insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = ref * sizeof(ir_ref) + 1;
@@ -3479,12 +3502,12 @@
 			offset_insn = insn;
 			scale = 1;
 			if (ir_rule(ctx, op1_insn->op2) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[op1_insn->op2].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[op1_insn->op2]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = insn->op1 * sizeof(ir_ref) + 1;
 			} else if (ir_rule(ctx, op1_insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[op1_insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[op1_insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 				index_reg_ref = insn->op1 * sizeof(ir_ref) + 2;
@@ -3500,7 +3523,7 @@
 			op2_insn = &ctx->ir_base[insn->op2];
 			scale = ctx->ir_base[op2_insn->op2].val.i32;
 			if (ir_rule(ctx, op1_insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[op1_insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[op1_insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 			} else {
@@ -3514,7 +3537,7 @@
 			op2_insn = &ctx->ir_base[insn->op2];
 			offset_insn = op2_insn;
 			if (ir_rule(ctx, op2_insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[op2_insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[op2_insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 			} else {
@@ -3523,7 +3546,7 @@
 			break;
 		case IR_LEA_B_SI:
 			if (ir_rule(ctx, insn->op1) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op1].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op1]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 			} else {
@@ -3537,7 +3560,7 @@
 		case IR_LEA_SI_B:
 			index_reg_ref = insn->op1 * sizeof(ir_ref) + 1;
 			if (ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA) {
-				offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+				offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 				base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 				base_reg_ref = IR_UNUSED;
 			} else {
@@ -3580,7 +3603,7 @@
 			offset_insn = NULL;
 			break;
 		case IR_ALLOCA:
-			offset = IR_SPILL_POS_TO_OFFSET(insn->op3);
+			offset = ir_local_offset(ctx, insn);
 			base_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
 			base_reg_ref = index_reg_ref = IR_UNUSED;
 			scale = 1;
@@ -8306,7 +8329,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 
 	if (ctx->flags & IR_USE_FRAME_POINTER) {
@@ -8340,7 +8363,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 
 	if (ctx->flags & IR_USE_FRAME_POINTER) {
@@ -8407,7 +8430,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op2_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		op2_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	if (op3_reg != IR_REG_NONE) {
 		if (IR_REG_SPILLED(op3_reg)) {
@@ -8418,7 +8441,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op3) == IR_STATIC_ALLOCA);
 		op3_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op3_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op3].op3);
+		op3_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op3]);
 	}
 	|	mov Ra(tmp_reg), aword [Ra(op3_reg)+op3_offset]
 	|	mov aword [Ra(op2_reg)+op2_offset], Ra(tmp_reg)
@@ -8441,7 +8464,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op2_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		op2_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	if (op3_reg != IR_REG_NONE) {
 		if (IR_REG_SPILLED(op3_reg)) {
@@ -8452,7 +8475,7 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op3) == IR_STATIC_ALLOCA);
 		op3_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		op3_offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op3].op3);
+		op3_offset = ir_local_offset(ctx, &ctx->ir_base[insn->op3]);
 	}
 	|	mov Rd(tmp_reg), dword [Ra(op3_reg)+(op3_offset+offsetof(ir_va_list, gp_offset))]
 	|	mov dword [Ra(op2_reg)+(op2_offset+offsetof(ir_va_list, gp_offset))], Rd(tmp_reg)
@@ -8493,11 +8516,29 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
 	|	mov Ra(tmp_reg), aword [Ra(op2_reg)+offset]
+#ifdef _WIN64
 	ir_emit_load_mem(ctx, type, def_reg, IR_MEM_B(tmp_reg));
 	|	add Ra(tmp_reg), IR_MAX(ir_type_size[type], sizeof(void*))
+#else
+	if (!insn->op3) {
+		ir_emit_load_mem(ctx, type, def_reg, IR_MEM_B(tmp_reg));
+		|	add Ra(tmp_reg), IR_MAX(ir_type_size[type], sizeof(void*))
+	} else {
+		IR_ASSERT(type == IR_ADDR);
+		int align = 1U << (insn->op3 & 0x7);
+		int size = (uint32_t)insn->op3 >> 3;
+
+		if (align > (int)sizeof(void*)) {
+			|	add Ra(tmp_reg), (align-1)
+			|	and Ra(tmp_reg), ~(align-1)
+		}
+		|	mov Ra(def_reg), Ra(tmp_reg)
+		|	add Ra(tmp_reg), IR_ALIGNED_SIZE(size, sizeof(void*))
+	}
+#endif
 	|	mov aword [Ra(op2_reg)+offset], Ra(tmp_reg)
 	if (IR_REG_SPILLED(ctx->regs[def][0])) {
 		ir_emit_store(ctx, type, def, def_reg);
@@ -8526,9 +8567,23 @@
 	} else {
 		IR_ASSERT(ir_rule(ctx, insn->op2) == IR_STATIC_ALLOCA);
 		op2_reg = (ctx->flags & IR_USE_FRAME_POINTER) ? IR_REG_FRAME_POINTER : IR_REG_STACK_POINTER;
-		offset = IR_SPILL_POS_TO_OFFSET(ctx->ir_base[insn->op2].op3);
+		offset = ir_local_offset(ctx, &ctx->ir_base[insn->op2]);
 	}
-	if (IR_IS_TYPE_INT(type)) {
+	if (insn->op3) {
+		/* long struct arguemnt */
+		IR_ASSERT(type == IR_ADDR);
+		int align = 1U << (insn->op3 & 0x7);
+		int size = (uint32_t)insn->op3 >> 3;
+
+		|	mov Ra(tmp_reg), aword [Ra(op2_reg)+(offset+offsetof(ir_va_list, overflow_arg_area))]
+		if (align > (int)sizeof(void*)) {
+			|	add Ra(tmp_reg), (align-1)
+			|	and Ra(tmp_reg), ~(align-1)
+		}
+		|	mov Ra(def_reg), Ra(tmp_reg)
+		|	add Ra(tmp_reg), IR_ALIGNED_SIZE(size, sizeof(void*))
+		|	mov aword [Ra(op2_reg)+(offset+offsetof(ir_va_list, overflow_arg_area))], Ra(tmp_reg)
+	} else if (IR_IS_TYPE_INT(type)) {
 		|	mov Rd(tmp_reg), dword [Ra(op2_reg)+(offset+offsetof(ir_va_list, gp_offset))]
 		|	cmp Rd(tmp_reg), sizeof(void*)*IR_REG_INT_ARGS
 		|	jge >1
@@ -8847,7 +8902,7 @@
 	}
 }
 
-static int32_t ir_call_used_stack(ir_ctx *ctx, ir_insn *insn)
+static int32_t ir_call_used_stack(ir_ctx *ctx, ir_insn *insn, int *copy_stack_ptr)
 {
 	int j, n;
 	ir_type type;
@@ -8856,6 +8911,9 @@
 	int int_reg_params_count = IR_REG_INT_ARGS;
 	int fp_reg_params_count = IR_REG_FP_ARGS;
 	int32_t used_stack = 0;
+#ifdef _WIN64
+	int32_t copy_stack = 0;
+#endif
 
 #ifdef IR_HAVE_FASTCALL
 	if (sizeof(void*) == 4 && ir_is_fastcall(ctx, insn)) {
@@ -8866,8 +8924,26 @@
 
 	n = insn->inputs_count;
 	for (j = 3; j <= n; j++) {
-		type = ctx->ir_base[ir_insn_op(insn, j)].type;
+		ir_insn *arg = &ctx->ir_base[ir_insn_op(insn, j)];
+		type = arg->type;
 		if (IR_IS_TYPE_INT(type)) {
+			if (arg->op == IR_ARGVAL) {
+				int size = arg->op2;
+				int align = arg->op3;
+
+#ifdef _WIN64
+				copy_stack += size;
+				align = IR_MAX((int)sizeof(void*), align);
+				copy_stack = IR_ALIGNED_SIZE(copy_stack, align);
+				type = IR_ADDR;
+#else
+				align = IR_MAX((int)sizeof(void*), align);
+				used_stack = IR_ALIGNED_SIZE(used_stack, align);
+				used_stack += size;
+				used_stack = IR_ALIGNED_SIZE(used_stack, sizeof(void*));
+				continue;
+#endif
+			}
 			if (int_param >= int_reg_params_count) {
 				used_stack += IR_MAX(sizeof(void*), ir_type_size[type]);
 			}
@@ -8892,6 +8968,14 @@
 	/* Reserved "home space" or "shadow store" for register arguments (used in Windows64 ABI) */
 	used_stack += IR_SHADOW_ARGS;
 
+#ifdef _WIN64
+	copy_stack = IR_ALIGNED_SIZE(copy_stack, 16);
+	used_stack += copy_stack;
+	*copy_stack_ptr = copy_stack;
+#else
+	*copy_stack_ptr = 0;
+#endif
+
 	return used_stack;
 }
 
@@ -8911,7 +8995,7 @@
 	int fp_reg_params_count = IR_REG_FP_ARGS;
 	const int8_t *int_reg_params = _ir_int_reg_params;
 	const int8_t *fp_reg_params = _ir_fp_reg_params;
-	int32_t used_stack, stack_offset = IR_SHADOW_ARGS;
+	int32_t used_stack, copy_stack = 0, stack_offset = IR_SHADOW_ARGS;
 	ir_copy *copies;
 	bool do_pass3 = 0;
 	/* For temporaries we may use any scratch registers except for registers used for parameters */
@@ -8942,9 +9026,13 @@
 #endif
 	) {
 		// TODO: support for preallocated stack
+#ifdef _WIN64
+		used_stack = ir_call_used_stack(ctx, insn, &copy_stack);
+#else
 		used_stack = 0;
+#endif
 	} else {
-		used_stack = ir_call_used_stack(ctx, insn);
+		used_stack = ir_call_used_stack(ctx, insn, &copy_stack);
 		if (IR_SHADOW_ARGS
 		 && insn->op == IR_TAILCALL
 		 && used_stack == IR_SHADOW_ARGS) {
@@ -8967,6 +9055,46 @@
 		}
 	}
 
+#ifdef _WIN64
+|.if X64
+	if (copy_stack) {
+		/* Copy struct arguments */
+		int copy_stack_offset = 0;
+
+		for (j = 3; j <= n; j++) {
+			arg = ir_insn_op(insn, j);
+			src_reg = ir_get_alocated_reg(ctx, def, j);
+			arg_insn = &ctx->ir_base[arg];
+			type = arg_insn->type;
+
+			if (arg_insn->op == IR_ARGVAL) {
+				/* make a stack copy */
+				int size = arg_insn->op2;
+				int align = arg_insn->op3;
+
+				copy_stack_offset += size;
+				align = IR_MAX((int)sizeof(void*), align);
+				copy_stack_offset = IR_ALIGNED_SIZE(copy_stack_offset, align);
+				src_reg = ctx->regs[arg][1];
+
+				|	lea	rdi, [rsp + (used_stack - copy_stack_offset)]
+				if (src_reg != IR_REG_NONE) {
+					if (IR_REG_SPILLED(src_reg)) {
+						src_reg = IR_REG_NUM(src_reg);
+						ir_emit_load(ctx, IR_ADDR, src_reg, arg_insn->op1);
+					}
+					|	mov rsi, Ra(src_reg)
+				} else {
+					ir_emit_load(ctx, IR_ADDR, IR_REG_RSI, arg_insn->op1);
+				}
+				ir_emit_load_imm_int(ctx, IR_ADDR, IR_REG_RCX, size);
+				|	rep; movsb
+			}
+		}
+	}
+|.endif
+#endif
+
 	/* 1. move all register arguments that should be passed through stack
 	 *    and collect arguments that should be passed through registers */
 	copies = ir_mem_malloc((n - 2) * sizeof(ir_copy));
@@ -8976,6 +9104,55 @@
 		arg_insn = &ctx->ir_base[arg];
 		type = arg_insn->type;
 		if (IR_IS_TYPE_INT(type)) {
+#ifndef _WIN64
+			if (arg_insn->op == IR_ARGVAL) {
+				int size = arg_insn->op2;
+				int align = arg_insn->op3;
+				align = IR_MAX((int)sizeof(void*), align);
+				stack_offset = IR_ALIGNED_SIZE(stack_offset, align);
+				if (size) {
+					src_reg = ctx->regs[arg][1];
+					if (src_reg != IR_REG_NONE) {
+						if (IR_REG_SPILLED(src_reg)) {
+							src_reg = IR_REG_NUM(src_reg);
+							ir_emit_load(ctx, IR_ADDR, src_reg, arg_insn->op1);
+						}
+						if (src_reg != IR_REG_RSI) {
+							|.if X64
+							|	mov rsi, Ra(src_reg)
+							|.else
+							|	mov	esi, Ra(src_reg)
+							|.endif
+						}
+					} else {
+						ir_emit_load(ctx, IR_ADDR, IR_REG_RSI, arg_insn->op1);
+					}
+					if (stack_offset == 0) {
+						|.if X64
+						|	mov	rdi, rsp
+						|.else
+						|	mov	edi, esp
+						|.endif
+					} else {
+						|.if X64
+						|	lea	rdi, [rsp+stack_offset]
+						|.else
+						|	lea	edi, [esp+stack_offset]
+						|.endif
+					}
+					|.if X64
+					|	mov rcx, size
+					|	rep; movsb
+					|.else
+					|	mov ecx, size
+					|	rep; movsb
+					|.endif
+				}
+				stack_offset += size;
+				stack_offset = IR_ALIGNED_SIZE(stack_offset, sizeof(void*));
+				continue;
+			}
+#endif
 			if (int_param < int_reg_params_count) {
 				dst_reg = int_reg_params[int_param];
 			} else {
@@ -8985,6 +9162,10 @@
 #ifdef _WIN64
 			/* WIN64 calling convention use common couter for int and fp registers */
 			fp_param++;
+			if (arg_insn->op == IR_ARGVAL) {
+				do_pass3 = 3;
+				continue;
+			}
 #endif
 		} else {
 			IR_ASSERT(IR_IS_TYPE_FP(type));
@@ -9000,7 +9181,9 @@
 #endif
 		}
 		if (dst_reg != IR_REG_NONE) {
-			if (src_reg == IR_REG_NONE) {
+			if (IR_IS_CONST_REF(arg) ||
+			    src_reg == IR_REG_NONE ||
+			    (IR_REG_SPILLED(src_reg) && !IR_REGSET_IN(IR_REGSET_PRESERVED, IR_REG_NUM(src_reg)))) {
 				/* delay CONST->REG and MEM->REG moves to third pass */
 				do_pass3 = 1;
 			} else {
@@ -9035,6 +9218,10 @@
 
 	/* 3. move the remaining memory and immediate values */
 	if (do_pass3) {
+#ifdef _WIN64
+		int copy_stack_offset = 0;
+#endif
+
 		stack_offset = IR_SHADOW_ARGS;
 		int_param = 0;
 		fp_param = 0;
@@ -9044,6 +9231,37 @@
 			arg_insn = &ctx->ir_base[arg];
 			type = arg_insn->type;
 			if (IR_IS_TYPE_INT(type)) {
+				if (arg_insn->op == IR_ARGVAL) {
+					int size = arg_insn->op2;
+					int align = arg_insn->op3;
+
+#ifndef _WIN64
+					align = IR_MAX((int)sizeof(void*), align);
+					stack_offset = IR_ALIGNED_SIZE(stack_offset, align);
+					stack_offset += size;
+					stack_offset = IR_ALIGNED_SIZE(stack_offset, sizeof(void*));
+					continue;
+#else
+|.if X64
+					/* pass pointer to the copy on stack */
+					copy_stack_offset += size;
+					align = IR_MAX((int)sizeof(void*), align);
+					copy_stack_offset = IR_ALIGNED_SIZE(copy_stack_offset, align);
+					if (int_param < int_reg_params_count) {
+						dst_reg = int_reg_params[int_param];
+						|	lea Ra(dst_reg), [rsp + (used_stack - copy_stack_offset)]
+					} else {
+						|	lea Ra(tmp_reg), [rsp + (used_stack - copy_stack_offset)]
+						ir_emit_store_mem_int(ctx, IR_ADDR, IR_MEM_BO(IR_REG_STACK_POINTER, stack_offset), tmp_reg);
+						stack_offset += sizeof(void*);
+					}
+					int_param++;
+					/* WIN64 calling convention use common couter for int and fp registers */
+					fp_param++;
+					continue;
+|.endif
+#endif
+				}
 				if (int_param < int_reg_params_count) {
 					dst_reg = int_reg_params[int_param];
 				} else {
@@ -9068,7 +9286,9 @@
 #endif
 			}
 			if (dst_reg != IR_REG_NONE) {
-				if (src_reg == IR_REG_NONE) {
+				if (IR_IS_CONST_REF(arg) ||
+				    src_reg == IR_REG_NONE ||
+				    (IR_REG_SPILLED(src_reg) && !IR_REGSET_IN(IR_REGSET_PRESERVED, IR_REG_NUM(src_reg)))) {
 					if (IR_IS_TYPE_INT(type)) {
 						if (IR_IS_CONST_REF(arg)) {
 							if (type == IR_I8 || type == IR_I16) {
@@ -9157,6 +9377,9 @@
 			}
 		}
 	}
+	if (insn->op == IR_CALL && (ctx->flags & IR_PREALLOCATED_STACK)) {
+		used_stack = 0;
+	}
 #endif
 #ifdef IR_REG_VARARG_FP_REGS
 	/* set hidden argument to specify the number of vector registers used */
@@ -10226,7 +10449,16 @@
 		insn = &ctx->ir_base[use];
 		if (insn->op == IR_PARAM) {
 			if (IR_IS_TYPE_INT(insn->type)) {
-				if (int_param_num < int_reg_params_count) {
+				if (ctx->value_params && ctx->value_params[insn->op3 - 1].align) {
+					/* struct passed by value on stack */
+					size_t align = ctx->value_params[insn->op3 - 1].align;
+
+					align = IR_MAX(sizeof(void*), align);
+					stack_offset = IR_ALIGNED_SIZE(stack_offset, align);
+					stack_offset += ctx->value_params[insn->op3 - 1].size;
+					stack_offset = IR_ALIGNED_SIZE(stack_offset, sizeof(void*));
+					continue;
+				} else if (int_param_num < int_reg_params_count) {
 					src_reg = int_reg_params[int_param_num];
 				} else {
 					src_reg = IR_REG_NONE;
@@ -10354,6 +10586,19 @@
 		insn = &ctx->ir_base[use];
 		if (insn->op == IR_PARAM) {
 			if (IR_IS_TYPE_INT(insn->type)) {
+#ifndef _WIN64
+				if (ctx->value_params && ctx->value_params[insn->op3 - 1].align) {
+					/* struct passed by value on stack */
+					size_t align = ctx->value_params[insn->op3 - 1].align;
+
+					align = IR_MAX(sizeof(void*), align);
+					stack_offset = IR_ALIGNED_SIZE(stack_offset, align);
+					ctx->value_params[insn->op3 - 1].offset = stack_start + stack_offset;
+					stack_offset += ctx->value_params[insn->op3 - 1].size;
+					stack_offset = IR_ALIGNED_SIZE(stack_offset, sizeof(void*));
+					continue;
+				}
+#endif
 				if (int_param_num < int_reg_params_count) {
 					src_reg = int_reg_params[int_param_num];
 				} else {
@@ -10614,13 +10859,13 @@
 
 static void ir_preallocate_call_stack(ir_ctx *ctx)
 {
-	int call_stack_size, peak_call_stack_size = 0;
+	int call_stack_size, copy_stack, peak_call_stack_size = 0;
 	ir_ref i, n;
 	ir_insn *insn;
 
 	for (i = 1, insn = ctx->ir_base + 1; i < ctx->insns_count;) {
 		if (insn->op == IR_CALL) {
-			call_stack_size = ir_call_used_stack(ctx, insn);
+			call_stack_size = ir_call_used_stack(ctx, insn, &copy_stack);
 			if (call_stack_size > peak_call_stack_size
 #ifdef IR_HAVE_FASTCALL
 			 && !ir_is_fastcall(ctx, insn) /* fast call functions restore stack pointer */
diff '--color=auto' -Naur a/ext/opcache/jit/ir/ir_x86.h b/ext/opcache/jit/ir/ir_x86.h
--- a/ext/opcache/jit/ir/ir_x86.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/ir_x86.h	2025-10-25 03:24:13.164310367 +0000
@@ -218,8 +218,8 @@
 		int8_t  reg;
 	};
 	uint8_t     type;
-	uint8_t     start;
-	uint8_t     end;
+	int8_t      start;
+	int8_t      end;
 } ir_tmp_reg;
 
 struct _ir_target_constraints {
diff '--color=auto' -Naur a/ext/opcache/jit/ir/LICENSE b/ext/opcache/jit/ir/LICENSE
--- a/ext/opcache/jit/ir/LICENSE	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/ir/LICENSE	2025-10-25 03:24:13.158912709 +0000
@@ -1,6 +1,7 @@
 MIT License
 
 Copyright (c) 2022 Zend by Perforce
+Copyright (c) 2025 Dmitry Stogov
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff '--color=auto' -Naur a/ext/opcache/jit/zend_jit.c b/ext/opcache/jit/zend_jit.c
--- a/ext/opcache/jit/zend_jit.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/zend_jit.c	2025-10-25 03:24:13.164511036 +0000
@@ -2945,8 +2945,9 @@
 	bool do_bailout = 0;
 
 	zend_shared_alloc_lock();
+	jit_extension = (zend_jit_op_array_extension*)ZEND_FUNC_INFO(op_array);
 
-	if (ZEND_FUNC_INFO(op_array)) {
+	if (jit_extension && !(jit_extension->func_info.flags & ZEND_FUNC_JITED)) {
 
 		SHM_UNPROTECT();
 		zend_jit_unprotect();
@@ -2958,11 +2959,12 @@
 					opline++;
 				}
 			}
-			jit_extension = (zend_jit_op_array_extension*)ZEND_FUNC_INFO(op_array);
-			opline->handler = jit_extension->orig_handler;
+			((zend_op*)opline)->handler = jit_extension->orig_handler;
 
 			/* perform real JIT for this function */
 			zend_real_jit_func(op_array, NULL, NULL, ZEND_JIT_ON_FIRST_EXEC);
+
+			jit_extension->func_info.flags |= ZEND_FUNC_JITED;
 		} zend_catch {
 			do_bailout = true;
 		} zend_end_try();
@@ -3024,7 +3026,7 @@
 	zend_shared_alloc_lock();
 	jit_extension = (zend_jit_op_array_hot_extension*)ZEND_FUNC_INFO(op_array);
 
-	if (jit_extension) {
+	if (jit_extension && !(jit_extension->func_info.flags & ZEND_FUNC_JITED)) {
 		SHM_UNPROTECT();
 		zend_jit_unprotect();
 
@@ -3039,6 +3041,8 @@
 
 			/* perform real JIT for this function */
 			zend_real_jit_func(op_array, NULL, opline, ZEND_JIT_ON_HOT_COUNTERS);
+
+			jit_extension->func_info.flags |= ZEND_FUNC_JITED;
 		} zend_catch {
 			do_bailout = 1;
 		} zend_end_try();
diff '--color=auto' -Naur a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c
--- a/ext/opcache/jit/zend_jit_helpers.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/zend_jit_helpers.c	2025-10-25 03:24:13.164863791 +0000
@@ -1965,8 +1965,13 @@
 	void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);
 
 	retval = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, result);
-	if (retval == result && UNEXPECTED(Z_ISREF_P(retval))) {
-		zend_unwrap_reference(retval);
+	if (UNEXPECTED(Z_ISREF_P(retval))) {
+		if (retval == result) {
+			zend_unwrap_reference(retval);
+		} else {
+			retval = Z_REFVAL_P(retval);
+		}
+		ZEND_ASSERT(!Z_REFCOUNTED_P(retval));
 	}
 	return retval;
 }
diff '--color=auto' -Naur a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
--- a/ext/opcache/jit/zend_jit_ir.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/opcache/jit/zend_jit_ir.c	2025-10-25 03:24:13.166178546 +0000
@@ -4902,33 +4902,30 @@
 			int32_t exit_point;
 			const void *exit_addr;
 			zend_jit_trace_stack *stack;
-			uint32_t old_res_info = 0;
+			uint32_t old_res_info = 0, old_op1_info = 0;
 
 			stack = JIT_G(current_frame)->stack;
 			if (opline->result_type != IS_UNUSED) {
 				old_res_info = STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var));
+				SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_LONG, 0);
 				if (opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) {
-					SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_LONG, 0);
+					SET_STACK_REF(stack, EX_VAR_TO_NUM(opline->result.var), ref);
+				} else {
+					SET_STACK_REF(stack, EX_VAR_TO_NUM(opline->result.var), op1_lval_ref);
 				}
 			}
+			old_op1_info = STACK_INFO(stack, EX_VAR_TO_NUM(opline->op1.var));
+			SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->op1.var), IS_LONG, 0);
+			SET_STACK_REF(stack, EX_VAR_TO_NUM(opline->op1.var), ref);
+
 			exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
 			exit_addr = zend_jit_trace_get_exit_addr(exit_point);
-			if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
-			    opline->result_type != IS_UNUSED) {
-				if_overflow = ir_IF(ir_OVERFLOW(ref));
-				ir_IF_FALSE_cold(if_overflow);
-				jit_set_Z_LVAL(jit, res_addr, ref);
-				if (Z_MODE(res_addr) != IS_REG) {
-					jit_set_Z_TYPE_INFO(jit, res_addr, IS_LONG);
-				}
-				jit_SIDE_EXIT(jit, ir_CONST_ADDR(exit_addr));
-				ir_IF_TRUE(if_overflow);
-			} else {
-				ir_GUARD(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));
-			}
+			ir_GUARD(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));
+
 			if (opline->result_type != IS_UNUSED) {
 				SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
 			}
+			SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->op1.var), old_op1_info);
 		} else {
 			if_overflow = ir_IF(ir_OVERFLOW(ref));
 			ir_IF_FALSE(if_overflow);
diff '--color=auto' -Naur a/ext/opcache/tests/jit/gh19669-001.phpt b/ext/opcache/tests/jit/gh19669-001.phpt
--- a/ext/opcache/tests/jit/gh19669-001.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/opcache/tests/jit/gh19669-001.phpt	2025-10-25 03:24:13.167368759 +0000
@@ -0,0 +1,24 @@
+--TEST--
+GH-19669: assertion failure zend_jit_trace_type_to_info_ex
+--CREDITS--
+YuanchengJiang
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE !== 8) {
+  die('skip output depends PHP_INT_SIZE=8');
+}
+?>
+--FILE--
+<?php
+function test() {
+    $a = PHP_INT_MIN;
+    $b = 0;
+    while ($b++ < 2) {
+        $a = (int) ($a-- + $a - $b);
+    }
+    return $a;
+}
+var_dump(test());
+?>
+--EXPECT--
+int(-3)
diff '--color=auto' -Naur a/ext/opcache/tests/jit/gh19669-002.phpt b/ext/opcache/tests/jit/gh19669-002.phpt
--- a/ext/opcache/tests/jit/gh19669-002.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/opcache/tests/jit/gh19669-002.phpt	2025-10-25 03:24:13.167444661 +0000
@@ -0,0 +1,24 @@
+--TEST--
+GH-19669 002: assertion failure zend_jit_trace_type_to_info_ex
+--CREDITS--
+YuanchengJiang
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE !== 8) {
+  die('skip output depends PHP_INT_SIZE=8');
+}
+?>
+--FILE--
+<?php
+function test() {
+    $a = PHP_INT_MIN;
+    $b = -1;
+    while ($b++ < 2) {
+        $a = (int) (--$a + $a - $b);
+    }
+    return $a;
+}
+var_dump(test());
+?>
+--EXPECT--
+int(-10)
diff '--color=auto' -Naur a/ext/opcache/tests/jit/gh19831_001.phpt b/ext/opcache/tests/jit/gh19831_001.phpt
--- a/ext/opcache/tests/jit/gh19831_001.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/opcache/tests/jit/gh19831_001.phpt	2025-10-25 03:24:13.167562399 +0000
@@ -0,0 +1,33 @@
+--TEST--
+GH-19831 001: fetch obj slow R REG + reference
+--CREDITS--
+dktapps
+--ENV--
+RT_COND=1
+--INI--
+opcache.jit=1203
+--FILE--
+<?php
+
+if (getenv('RT_COND')) {
+    class Base {
+    }
+}
+
+// Class is not linked
+class Test extends Base {
+	public int $layers = 1;
+
+	public function getLayers(): int {
+        // Prop info is not known, but res_addr is REG
+		return $this->layers;
+	}
+}
+
+$t = new Test();
+$a = &$t->layers;
+var_dump($t->getLayers());
+
+?>
+--EXPECT--
+int(1)
diff '--color=auto' -Naur a/ext/opcache/tests/jit/gh19831_002.phpt b/ext/opcache/tests/jit/gh19831_002.phpt
--- a/ext/opcache/tests/jit/gh19831_002.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/opcache/tests/jit/gh19831_002.phpt	2025-10-25 03:24:13.167691286 +0000
@@ -0,0 +1,39 @@
+--TEST--
+GH-19831 002: fetch obj slow R REG + __get + reference
+--CREDITS--
+dktapps
+--ENV--
+RT_COND=1
+--INI--
+opcache.jit=1203
+--FILE--
+<?php
+
+if (getenv('RT_COND')) {
+    class Base {
+    }
+}
+
+// Class is not linked
+class Test extends Base {
+	public int $layers = 1;
+
+    public function &__get($name) {
+        global $a;
+        $a = 1;
+        return $a;
+    }
+
+	public function getLayers(): int {
+        // Prop info is not known, but res_addr is REG
+		return $this->layers;
+	}
+}
+
+$t = new Test();
+unset($t->layers);
+var_dump($t->getLayers());
+
+?>
+--EXPECT--
+int(1)
diff '--color=auto' -Naur a/ext/opcache/tests/opt/gh19792.phpt b/ext/opcache/tests/opt/gh19792.phpt
--- a/ext/opcache/tests/opt/gh19792.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/opcache/tests/opt/gh19792.phpt	2025-10-25 03:24:13.167833139 +0000
@@ -0,0 +1,27 @@
+--TEST--
+GH-19792 (SCCP causes UAF for return value if both warning and exception are triggered)
+--EXTENSIONS--
+opcache
+zend_test
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+
+function foo()
+{
+    return \zend_test_gh19792();
+}
+
+try {
+    foo();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Warning: a warning in %s on line %d
+an exception
diff '--color=auto' -Naur a/ext/phar/tar.c b/ext/phar/tar.c
--- a/ext/phar/tar.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/phar/tar.c	2025-10-25 03:24:13.168008940 +0000
@@ -1170,7 +1170,16 @@
 	}
 
 	zend_hash_apply_with_argument(&phar->manifest, phar_tar_writeheaders, (void *) &pass);
-	/* TODO: memory leak and incorrect continuation if phar_tar_writeheaders fails? */
+
+	if (error && *error) {
+		if (must_close_old_file) {
+			php_stream_close(oldfile);
+		}
+
+		/* on error in the hash iterator above, error is set */
+		php_stream_close(newfile);
+		return;
+	}
 
 	/* add signature for executable tars or tars explicitly set with setSignatureAlgorithm */
 	if (!phar->is_data || phar->sig_flags) {
diff '--color=auto' -Naur a/ext/phar/tests/tar_flush_too_long_filename.phpt b/ext/phar/tests/tar_flush_too_long_filename.phpt
--- a/ext/phar/tests/tar_flush_too_long_filename.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/phar/tests/tar_flush_too_long_filename.phpt	2025-10-25 03:24:13.168242583 +0000
@@ -0,0 +1,41 @@
+--TEST--
+Tar flush with too long file name
+--EXTENSIONS--
+phar
+--SKIPIF--
+<?php
+if (getenv('SKIP_SLOW_TESTS')) die('skip');
+if (function_exists('openssl_sign')) die('skip requires openssl disabled for mocking purposes');
+?>
+--INI--
+phar.require_hash=0
+--FILE--
+<?php
+$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.tar';
+
+// Mock sign to fail at second invocation, tricks failure in phar_create_signature()
+function openssl_sign() {
+    static $counter = 0;
+    $counter++;
+    if ($counter === 2) {
+        return false;
+    }
+    return true;
+}
+
+$phar = new PharData($fname);
+$phar->addEmptyDir('blah1/');
+$phar->setSignatureAlgorithm(Phar::OPENSSL, "randomcrap");
+try {
+    $phar->addEmptyDir('blah2/' . str_repeat('X', 1000));
+} catch (PharException $e) {
+    echo $e->getMessage();
+}
+
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . '/' . basename(__FILE__, '.clean.php') . '.tar');
+?>
+--EXPECTF--
+tar-based phar "%s" cannot be created, filename "%s" is too long for tar file format
diff '--color=auto' -Naur a/ext/phar/zip.c b/ext/phar/zip.c
--- a/ext/phar/zip.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/phar/zip.c	2025-10-25 03:24:13.168422504 +0000
@@ -1223,7 +1223,9 @@
 		entry.fp_type = PHAR_MOD;
 		entry.is_modified = 1;
 		if (entry.fp == NULL) {
+			efree(signature);
 			spprintf(pass->error, 0, "phar error: unable to create temporary file for signature");
+			php_stream_close(newfile);
 			return FAILURE;
 		}
 
@@ -1441,11 +1443,12 @@
 
 	phar_metadata_tracker_try_ensure_has_serialized_data(&phar->metadata_tracker, phar->is_persistent);
 	if (temperr) {
+temperror:
 		if (error) {
 			spprintf(error, 4096, "phar zip flush of \"%s\" failed: %s", phar->fname, temperr);
 		}
 		efree(temperr);
-temperror:
+notemperror:
 		php_stream_close(pass.centralfp);
 nocentralerror:
 		php_stream_close(pass.filefp);
@@ -1473,7 +1476,7 @@
 			if (error) {
 				spprintf(error, 4096, "phar zip flush of \"%s\" failed: unable to write central-directory", phar->fname);
 			}
-			goto temperror;
+			goto notemperror;
 		}
 	}
 
diff '--color=auto' -Naur a/ext/random/tests/03_randomizer/gh_19765_unserialize.phpt b/ext/random/tests/03_randomizer/gh_19765_unserialize.phpt
--- a/ext/random/tests/03_randomizer/gh_19765_unserialize.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/random/tests/03_randomizer/gh_19765_unserialize.phpt	2025-10-25 03:24:13.168706004 +0000
@@ -0,0 +1,21 @@
+--TEST--
+GH-19765: object_properties_load() bypasses readonly property checks
+--FILE--
+<?php
+
+use Random\Engine\Mt19937;
+use Random\Engine\PcgOneseq128XslRr64;
+use Random\Randomizer;
+
+try {
+    $r = new Randomizer(new Mt19937());
+    $r->__unserialize([['engine' => new PcgOneseq128XslRr64()]]);
+} catch (Exception $error) {
+    echo $error->getMessage() . "\n";
+}
+var_dump($r->engine::class);
+
+?>
+--EXPECT--
+Invalid serialization data for Random\Randomizer object
+string(21) "Random\Engine\Mt19937"
diff '--color=auto' -Naur a/ext/random/tests/03_randomizer/gh_9186_unserialize.phpt b/ext/random/tests/03_randomizer/gh_9186_unserialize.phpt
--- a/ext/random/tests/03_randomizer/gh_9186_unserialize.phpt	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/random/tests/03_randomizer/gh_9186_unserialize.phpt	2025-10-25 03:24:13.168802169 +0000
@@ -1,5 +1,5 @@
 --TEST--
-Fix GH-9186 @strict-properties can be bypassed using unserialization
+GH-9186: @strict-properties can be bypassed using unserialization
 --FILE--
 <?php
 
diff '--color=auto' -Naur a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
--- a/ext/simplexml/simplexml.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/simplexml/simplexml.c	2025-10-25 03:24:13.169043185 +0000
@@ -1529,10 +1529,10 @@
 				/* Attributes in the xmlns namespace should be treated as namespace declarations too. */
 				if (attr->ns && xmlStrEqual(attr->ns->href, (const xmlChar *) "http://www.w3.org/2000/xmlns/")) {
 					const char *prefix = attr->ns->prefix ? (const char *) attr->name : "";
-					bool free;
-					xmlChar *href = php_libxml_attr_value(attr, &free);
+					bool should_free;
+					xmlChar *href = php_libxml_attr_value(attr, &should_free);
 					sxe_add_namespace_name_raw(return_value, prefix, (const char *) href);
-					if (free) {
+					if (should_free) {
 						xmlFree(href);
 					}
 				}
@@ -1629,7 +1629,7 @@
 	node = php_sxe_get_first_node_non_destructive(sxe, node);
 	if (node) {
 		namelen = xmlStrlen(node->name);
-		RETURN_STRINGL((char*)node->name, namelen);
+		RETURN_STRINGL_FAST((const char *) node->name, namelen);
 	} else {
 		RETURN_EMPTY_STRING();
 	}
diff '--color=auto' -Naur a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
--- a/ext/soap/php_encoding.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/soap/php_encoding.c	2025-10-25 03:24:13.169568146 +0000
@@ -3610,6 +3610,11 @@
 				soap_error0(E_ERROR,  "Encoding: SoapVar has no 'enc_type' property");
 			}
 			cur_type = Z_LVAL_P(ztype);
+			if (cur_type == UNKNOWN_TYPE) {
+				/* Mimic guess_xml_convert() where we use the type of the data.
+				 * UNDEFs are handled transparently as it will error out upon encoding the data. */
+				cur_type = Z_TYPE_P(Z_VAR_ENC_VALUE_P(tmp));
+			}
 
 			zval *zstype = Z_VAR_ENC_STYPE_P(tmp);
 			if (Z_TYPE_P(zstype) == IS_STRING) {
diff '--color=auto' -Naur a/ext/soap/soap.c b/ext/soap/soap.c
--- a/ext/soap/soap.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/soap/soap.c	2025-10-25 03:24:13.170229616 +0000
@@ -1002,7 +1002,13 @@
 	service->soap_functions.ft = zend_new_array(0);
 
 	if (wsdl) {
-		service->sdl = get_sdl(ZEND_THIS, ZSTR_VAL(wsdl), cache_wsdl);
+		zend_try {
+			service->sdl = get_sdl(ZEND_THIS, ZSTR_VAL(wsdl), cache_wsdl);
+		} zend_catch {
+			xmlCharEncCloseFunc(service->encoding);
+			service->encoding = NULL;
+			zend_bailout();
+		} zend_end_try();
 		if (service->uri == NULL) {
 			if (service->sdl->target_ns) {
 				service->uri = estrdup(service->sdl->target_ns);
diff '--color=auto' -Naur a/ext/soap/tests/bugs/gh19784.phpt b/ext/soap/tests/bugs/gh19784.phpt
--- a/ext/soap/tests/bugs/gh19784.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/soap/tests/bugs/gh19784.phpt	2025-10-25 03:24:13.170742714 +0000
@@ -0,0 +1,14 @@
+--TEST--
+GH-19784 (SoapServer memory leak)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+$v_5256 = 'zpHOks6TzpTOlc6WzpfOmM6ZzprOm86czp3Ons6fzqDOoc6jzqTOpc6mzqfOqM6p';
+$v_5257 = base64_decode($v_5256,);
+$v_5238 = array('encoding' => $v_5257);
+new SoapServer('foobarbaz',$v_5238,);
+?>
+--EXPECTF--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>%s</faultcode><faultstring>%a
diff '--color=auto' -Naur a/ext/soap/tests/bugs/gh20011.phpt b/ext/soap/tests/bugs/gh20011.phpt
--- a/ext/soap/tests/bugs/gh20011.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/soap/tests/bugs/gh20011.phpt	2025-10-25 03:24:13.170821047 +0000
@@ -0,0 +1,20 @@
+--TEST--
+GH-20011 (Array of SoapVar of unknown type causes crash)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+class TestSoapClient extends SoapClient {
+    public function __doRequest($request, $location, $action, $version, $one_way = false): ?string {
+        die($request);
+    }
+}
+
+$array = [new SoapVar('test string', NULL)];
+
+$client = new TestSoapClient(NULL, ['location' => 'test://', 'uri' => 'http://soapinterop.org/']);
+$client->echoStringArray($array);
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://soapinterop.org/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:echoStringArray><param0 SOAP-ENC:arrayType="xsd:string[1]" xsi:type="SOAP-ENC:Array"><item xsi:type="xsd:string">test string</item></param0></ns1:echoStringArray></SOAP-ENV:Body></SOAP-ENV:Envelope>
diff '--color=auto' -Naur a/ext/standard/array.c b/ext/standard/array.c
--- a/ext/standard/array.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/standard/array.c	2025-10-25 03:24:13.171299279 +0000
@@ -3497,6 +3497,12 @@
 	HT_SET_ITERATORS_COUNT(in_hash, 0);
 	in_hash->pDestructor = NULL;
 
+	/* Set internal pointer to 0 directly instead of calling zend_hash_internal_pointer_reset().
+	 * This avoids the COW violation assertion and delays advancing to the first valid position
+	 * until after we've switched to the new array structure (out_hash). The iterator will be
+	 * advanced when actually accessed, at which point it will find valid indexes in the new array. */
+	in_hash->nInternalPointer = 0;
+
 	if (UNEXPECTED(GC_DELREF(in_hash) == 0)) {
 		/* Array was completely deallocated during the operation */
 		zend_array_destroy(in_hash);
@@ -3515,8 +3521,6 @@
 	in_hash->nNextFreeElement  = out_hash.nNextFreeElement;
 	in_hash->arData            = out_hash.arData;
 	in_hash->pDestructor       = out_hash.pDestructor;
-
-	zend_hash_internal_pointer_reset(in_hash);
 }
 /* }}} */
 
@@ -5027,6 +5031,11 @@
 	ZVAL_UNDEF(&arTmp[i].b.val);
 	zend_sort((void *) arTmp, i, sizeof(struct bucketindex),
 			(compare_func_t) cmp, (swap_func_t) array_bucketindex_swap);
+
+	if (UNEXPECTED(EG(exception))) {
+		goto out;
+	}
+
 	/* go through the sorted array and delete duplicates from the copy */
 	lastkept = arTmp;
 	for (cmpdata = arTmp + 1; Z_TYPE(cmpdata->b.val) != IS_UNDEF; cmpdata++) {
@@ -5046,6 +5055,8 @@
 			}
 		}
 	}
+
+out:
 	pefree(arTmp, GC_FLAGS(Z_ARRVAL_P(array)) & IS_ARRAY_PERSISTENT);
 
 	if (in_place) {
diff '--color=auto' -Naur a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
--- a/ext/standard/basic_functions.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/standard/basic_functions.c	2025-10-25 03:24:13.171799144 +0000
@@ -2015,10 +2015,8 @@
 #define _CHECK_PATH(var, var_len, ini) php_ini_check_path(var, var_len, ini, sizeof(ini))
 	/* open basedir check */
 	if (PG(open_basedir)) {
-		if (_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "error_log") ||
-			_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.class.path") ||
+		if (_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.class.path") ||
 			_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.home") ||
-			_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "mail.log") ||
 			_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.library.path") ||
 			_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "vpopmail.directory")) {
 			if (php_check_open_basedir(ZSTR_VAL(new_value_str))) {
diff '--color=auto' -Naur a/ext/standard/tests/array/gh19926.phpt b/ext/standard/tests/array/gh19926.phpt
--- a/ext/standard/tests/array/gh19926.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/array/gh19926.phpt	2025-10-25 03:24:13.172022905 +0000
@@ -0,0 +1,20 @@
+--TEST--
+GH-19926 (Assertion failure zend_hash_internal_pointer_reset_ex)
+--FILE--
+<?php
+class ThrowingDestructor {
+    function __destruct() {
+        throw new Exception();
+    }
+}
+
+$arr = [new ThrowingDestructor(), new ThrowingDestructor()];
+
+try {
+    array_splice($arr, 0, 2);
+} catch (Exception $e) {
+    echo "Exception caught, no assertion failure\n";
+}
+?>
+--EXPECT--
+Exception caught, no assertion failure
diff '--color=auto' -Naur a/ext/standard/tests/array/gh19926_pointer.phpt b/ext/standard/tests/array/gh19926_pointer.phpt
--- a/ext/standard/tests/array/gh19926_pointer.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/array/gh19926_pointer.phpt	2025-10-25 03:24:13.172099107 +0000
@@ -0,0 +1,19 @@
+--TEST--
+GH-19926 (internal pointer behavior after array_splice)
+--FILE--
+<?php
+$a = [1, 2, 3];
+unset($a[0]);
+next($a);
+
+echo "Before array_splice: ";
+var_dump(current($a));
+
+array_splice($a, 0, 0, [999]);
+
+echo "After array_splice: ";
+var_dump(current($a));
+?>
+--EXPECT--
+Before array_splice: int(3)
+After array_splice: int(999)
diff '--color=auto' -Naur a/ext/standard/tests/array/gh20043.phpt b/ext/standard/tests/array/gh20043.phpt
--- a/ext/standard/tests/array/gh20043.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/array/gh20043.phpt	2025-10-25 03:24:13.172196018 +0000
@@ -0,0 +1,12 @@
+--TEST--
+GH-20043 (array_unique assertion failure with RC1 array causing an exception on sort)
+--FILE--
+<?php
+try {
+	array_unique([new stdClass, new stdClass], SORT_STRING | SORT_FLAG_CASE);
+} catch (Error $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+Object of class stdClass could not be converted to string
diff '--color=auto' -Naur a/ext/standard/tests/file/bug46347.phpt b/ext/standard/tests/file/bug46347.phpt
--- a/ext/standard/tests/file/bug46347.phpt	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/standard/tests/file/bug46347.phpt	2025-10-25 03:24:13.172340112 +0000
@@ -8,14 +8,14 @@
 part1.*.part2 = 1
 EOF;
 
-$file = __DIR__ . '/parse.ini';
+$file = __DIR__ . '/bug46347.ini';
 file_put_contents($file, $str);
 
 var_dump(parse_ini_file($file));
 ?>
 --CLEAN--
 <?php
-unlink(__DIR__.'/parse.ini');
+unlink(__DIR__.'/bug46347.ini');
 ?>
 --EXPECT--
 array(1) {
diff '--color=auto' -Naur a/ext/standard/tests/filters/convert.phpt b/ext/standard/tests/filters/convert.phpt
--- a/ext/standard/tests/filters/convert.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/filters/convert.phpt	2025-10-25 03:24:13.172502490 +0000
@@ -0,0 +1,130 @@
+--TEST--
+convert stream filter tests
+--FILE--
+<?php
+
+$text = "Hello World!";
+$binary = "ABC\xFF";
+
+function test_roundtrip($data, $encode, $decode, $opts = null, $is_binary = false) {
+    echo "Filter: $encode\n";
+
+    $fp = tmpfile();
+    fwrite($fp, $data);
+    rewind($fp);
+
+    if ($opts === null) {
+        stream_filter_prepend($fp, $encode, STREAM_FILTER_READ);
+    } else {
+        stream_filter_prepend($fp, $encode, STREAM_FILTER_READ, $opts);
+    }
+    $encoded = stream_get_contents($fp);
+    fclose($fp);
+
+    if ($is_binary) {
+        echo "Original (hex): " . bin2hex($data) . "\n";
+        echo "Encoded: $encoded\n";
+    } else {
+        echo "Original: $data\n";
+        echo "Encoded: $encoded\n";
+    }
+
+    $fp2 = tmpfile();
+    fwrite($fp2, $encoded);
+    rewind($fp2);
+
+    if ($opts === null) {
+        stream_filter_prepend($fp2, $decode, STREAM_FILTER_READ);
+    } else {
+        stream_filter_prepend($fp2, $decode, STREAM_FILTER_READ, $opts);
+    }
+    $decoded = stream_get_contents($fp2);
+    fclose($fp2);
+
+    if ($is_binary) {
+        echo "Decoded (hex): " . bin2hex($decoded) . "\n";
+    } else {
+        echo "Decoded: $decoded\n";
+    }
+    var_dump($data === $decoded);
+    echo "\n";
+}
+
+test_roundtrip($text, "convert.base64-encode", "convert.base64-decode");
+test_roundtrip($binary, "convert.base64-encode", "convert.base64-decode", null, true);
+test_roundtrip("", "convert.base64-encode", "convert.base64-decode");
+test_roundtrip("A", "convert.base64-encode", "convert.base64-decode");
+
+test_roundtrip($text, "convert.quoted-printable-encode", "convert.quoted-printable-decode");
+test_roundtrip("Line1\r\nLine2", "convert.quoted-printable-encode", "convert.quoted-printable-decode");
+
+$opts = array('line-length' => 20, 'line-break-chars' => "\n");
+test_roundtrip("Long text that will be wrapped", "convert.base64-encode", "convert.base64-decode", $opts);
+
+$opts2 = array('binary' => true);
+test_roundtrip("Text\t\r\n", "convert.quoted-printable-encode", "convert.quoted-printable-decode", $opts2);
+
+$fp = tmpfile();
+fwrite($fp, "Test");
+rewind($fp);
+stream_filter_prepend($fp, 'convert.base64-encode', STREAM_FILTER_READ);
+$result = stream_get_contents($fp);
+fclose($fp);
+var_dump($result === base64_encode("Test"));
+
+?>
+--EXPECTF--
+Filter: convert.base64-encode
+Original: Hello World!
+Encoded: SGVsbG8gV29ybGQh
+Decoded: Hello World!
+bool(true)
+
+Filter: convert.base64-encode
+Original (hex): 414243ff
+Encoded: QUJD/w==
+Decoded (hex): 414243ff
+bool(true)
+
+Filter: convert.base64-encode
+Original: 
+Encoded: 
+Decoded: 
+bool(true)
+
+Filter: convert.base64-encode
+Original: A
+Encoded: QQ==
+Decoded: A
+bool(true)
+
+Filter: convert.quoted-printable-encode
+Original: Hello World!
+Encoded: Hello World!
+Decoded: Hello World!
+bool(true)
+
+Filter: convert.quoted-printable-encode
+Original: Line1
+Line2
+Encoded: Line1=0D=0ALine2
+Decoded: Line1
+Line2
+bool(true)
+
+Filter: convert.base64-encode
+Original: Long text that will be wrapped
+Encoded: TG9uZyB0ZXh0IHRoYXQg
+d2lsbCBiZSB3cmFwcGVk
+Decoded: Long text that will be wrapped
+bool(true)
+
+Filter: convert.quoted-printable-encode
+Original: Text	
+
+Encoded: Text=09=0D=0A
+Decoded: Text	
+
+bool(true)
+
+bool(true)
diff '--color=auto' -Naur a/ext/standard/tests/filters/gh17345.phpt b/ext/standard/tests/filters/gh17345.phpt
--- a/ext/standard/tests/filters/gh17345.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/filters/gh17345.phpt	2025-10-25 03:24:13.172566964 +0000
@@ -0,0 +1,49 @@
+--TEST--
+GH-17345 (Bug #35916 was not completely fixed)
+--FILE--
+<?php
+$file = __DIR__ . "/gh17345.txt";
+@unlink($file);
+
+class strtoupper_filter extends php_user_filter
+{
+    function filter($in, $out, &$consumed, $closing): int
+    {
+        while ($bucket=stream_bucket_make_writeable($in)) {
+            $bucket->data = strtoupper($bucket->data);
+            $consumed += $bucket->datalen;
+            stream_bucket_prepend($out, $bucket);
+            // Interleave new bucket
+            stream_bucket_prepend($out, clone $bucket);
+            stream_bucket_prepend($out, $bucket);
+        }
+        return PSFS_PASS_ON;
+    }
+
+    function onCreate(): bool
+    {
+        echo "fffffffffff\n";
+        return true;
+    }
+
+    function onClose(): void
+    {
+        echo "hello\n";
+    }
+}
+
+stream_filter_register("strtoupper", "strtoupper_filter");
+$fp=fopen($file, "w");
+stream_filter_append($fp,  "strtoupper");
+fread($fp, 1024);
+fwrite($fp, "Thank you\n");
+fclose($fp);
+readfile($file);
+unlink($file);
+?>
+--EXPECTF--
+fffffffffff
+
+Notice: fread(): Read of 8192 bytes failed with errno=9 Bad file descriptor in %s on line %d
+hello
+THANK YOU
diff '--color=auto' -Naur a/ext/standard/tests/general_functions/debug_zval_dump_gh19801_memory_leak.phpt b/ext/standard/tests/general_functions/debug_zval_dump_gh19801_memory_leak.phpt
--- a/ext/standard/tests/general_functions/debug_zval_dump_gh19801_memory_leak.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/general_functions/debug_zval_dump_gh19801_memory_leak.phpt	2025-10-25 03:24:13.172723372 +0000
@@ -0,0 +1,32 @@
+--TEST--
+GH-19801 (debug_zval_dump() leak with __debugInfo() that modifies circular references)
+--FILE--
+<?php
+
+$a = [
+    new class {
+        function __debugInfo() {
+            global $b;
+            $b->a = null;
+            gc_collect_cycles();
+            return [];
+        }
+    },
+];
+
+$b = new stdClass;
+$b->a = &$a;
+
+debug_zval_dump($b);
+?>
+--EXPECTF--
+object(stdClass)#2 (1) refcount(%d){
+  ["a"]=>
+  reference refcount(%d) {
+    array(1) packed refcount(%d){
+      [0]=>
+      object(class@anonymous)#1 (0) refcount(%d){
+      }
+    }
+  }
+}
diff '--color=auto' -Naur a/ext/standard/tests/general_functions/var_dump_gh19801_memory_leak.phpt b/ext/standard/tests/general_functions/var_dump_gh19801_memory_leak.phpt
--- a/ext/standard/tests/general_functions/var_dump_gh19801_memory_leak.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/general_functions/var_dump_gh19801_memory_leak.phpt	2025-10-25 03:24:13.172804194 +0000
@@ -0,0 +1,30 @@
+--TEST--
+GH-19801 (var_dump() memory leak with __debugInfo() that modifies circular references)
+--FILE--
+<?php
+
+$a = [
+    new class {
+        function __debugInfo() {
+            global $b;
+            $b->a = null;
+            gc_collect_cycles();
+            return [];
+        }
+    },
+];
+
+$b = new stdClass;
+$b->a = &$a;
+
+var_dump($b);
+?>
+--EXPECTF--
+object(stdClass)#2 (1) {
+  ["a"]=>
+  &array(1) {
+    [0]=>
+    object(class@anonymous)#1 (0) {
+    }
+  }
+}
diff '--color=auto' -Naur a/ext/standard/tests/serialize/gh12265b.phpt b/ext/standard/tests/serialize/gh12265b.phpt
--- a/ext/standard/tests/serialize/gh12265b.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/serialize/gh12265b.phpt	2025-10-25 03:24:13.173050503 +0000
@@ -0,0 +1,48 @@
+--TEST--
+GH-12265 (Cloning an object breaks serialization recursion) - __sleep variation
+--FILE--
+<?php
+
+class A {
+    public function __construct(public B $x) {
+    }
+}
+
+class B {
+    public A $a;
+
+    public function __sleep()
+    {
+        $this->a = new A($this);
+        return ['a'];
+    }
+}
+
+class C {
+    public B $b;
+
+    public function __construct() {
+        $this->b = new B;
+    }
+}
+
+$b = new B();
+$sb = serialize($b);
+$stb = serialize(new B);
+
+printf("serialized original:    %s\n", $sb);
+printf("serialized temp    :    %s\n", $stb);
+
+$c = new C;
+$sc = serialize($c);
+$stc = serialize(new C);
+
+printf("serialized original:    %s\n", $sc);
+printf("serialized temp    :    %s\n", $stc);
+
+?>
+--EXPECT--
+serialized original:    O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:1;}}
+serialized temp    :    O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:1;}}
+serialized original:    O:1:"C":1:{s:1:"b";O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:2;}}}
+serialized temp    :    O:1:"C":1:{s:1:"b";O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:2;}}}
diff '--color=auto' -Naur a/ext/standard/tests/serialize/gh12265.phpt b/ext/standard/tests/serialize/gh12265.phpt
--- a/ext/standard/tests/serialize/gh12265.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/serialize/gh12265.phpt	2025-10-25 03:24:13.172972217 +0000
@@ -0,0 +1,47 @@
+--TEST--
+GH-12265 (Cloning an object breaks serialization recursion) - __serialize variation
+--FILE--
+<?php
+
+class A {
+    public function __construct(public B $x) {
+    }
+}
+
+class B {
+    public A $a;
+
+    public function __serialize()
+    {
+        return ['a' => new A($this)];
+    }
+}
+
+class C {
+    public B $b;
+
+    public function __construct() {
+        $this->b = new B;
+    }
+}
+
+$b = new B();
+$sb = serialize($b);
+$stb = serialize(new B);
+
+printf("serialized original:    %s\n", $sb);
+printf("serialized temp    :    %s\n", $stb);
+
+$c = new C;
+$sc = serialize($c);
+$stc = serialize(new C);
+
+printf("serialized original:    %s\n", $sc);
+printf("serialized temp    :    %s\n", $stc);
+
+?>
+--EXPECT--
+serialized original:    O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:1;}}
+serialized temp    :    O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:1;}}
+serialized original:    O:1:"C":1:{s:1:"b";O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:2;}}}
+serialized temp    :    O:1:"C":1:{s:1:"b";O:1:"B":1:{s:1:"a";O:1:"A":1:{s:1:"x";r:2;}}}
diff '--color=auto' -Naur a/ext/standard/tests/serialize/gh19701.phpt b/ext/standard/tests/serialize/gh19701.phpt
--- a/ext/standard/tests/serialize/gh19701.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/serialize/gh19701.phpt	2025-10-25 03:24:13.173166015 +0000
@@ -0,0 +1,30 @@
+--TEST--
+GH-19701 (Serialize/deserialize loses some data)
+--CREDITS--
+cuchac
+DanielEScherzer
+--FILE--
+<?php
+
+class Item {
+    public $children = [];
+    public $parent = null;
+
+    public function __sleep() {
+        return ["children", "parent"];
+    }
+}
+
+$baseProduct = new Item();
+
+$child = new Item();
+$child->parent = $baseProduct;
+$baseProduct->children = [ $child ];
+
+$data = [clone $baseProduct, $baseProduct];
+
+echo serialize($data), "\n";
+
+?>
+--EXPECT--
+a:2:{i:0;O:4:"Item":2:{s:8:"children";a:1:{i:0;O:4:"Item":2:{s:8:"children";a:0:{}s:6:"parent";O:4:"Item":2:{s:8:"children";a:1:{i:0;r:4;}s:6:"parent";N;}}}s:6:"parent";N;}i:1;r:6;}
diff '--color=auto' -Naur a/ext/standard/tests/streams/gh19570.phpt b/ext/standard/tests/streams/gh19570.phpt
--- a/ext/standard/tests/streams/gh19570.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/streams/gh19570.phpt	2025-10-25 03:24:13.173305028 +0000
@@ -0,0 +1,22 @@
+--TEST--
+GH-19570 (unable to fseek in /dev/zero and /dev/null)
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== "Linux") die("skip only for Linux");
+?>
+--FILE--
+<?php
+$devices = [
+    // Note: could test others but they're not necessarily available
+    "/dev/zero",
+    "/dev/null",
+    "/dev/full",
+];
+foreach ($devices as $device) {
+    var_dump(fseek(fopen($device, "rb"), 1*1024*1024, SEEK_SET));
+}
+?>
+--EXPECT--
+int(0)
+int(0)
+int(0)
diff '--color=auto' -Naur a/ext/standard/tests/streams/gh19705.phpt b/ext/standard/tests/streams/gh19705.phpt
--- a/ext/standard/tests/streams/gh19705.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/standard/tests/streams/gh19705.phpt	2025-10-25 03:24:13.173379365 +0000
@@ -0,0 +1,11 @@
+--TEST--
+GH-19705 segmentation fault with non writable stream at stream_filter_append call.
+--EXTENSIONS--
+zlib
+--FILE--
+<?php
+$fh = fopen('data://text/plain,', 'w+',);
+var_dump(stream_filter_append($fh, 'zlib.deflate',STREAM_FILTER_WRITE));
+?>
+--EXPECTF--
+resource(%d) of type (stream filter)
diff '--color=auto' -Naur a/ext/standard/user_filters.c b/ext/standard/user_filters.c
--- a/ext/standard/user_filters.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/standard/user_filters.c	2025-10-25 03:24:13.173548103 +0000
@@ -408,17 +408,19 @@
 		memcpy(bucket->buf, Z_STRVAL_P(pzdata), bucket->buflen);
 	}
 
+	/* If the bucket is already on a brigade we have to unlink it first to keep the
+	 * linked list consistent. Furthermore, we can transfer the refcount in that case. */
+	if (bucket->brigade) {
+		php_stream_bucket_unlink(bucket);
+	} else {
+		bucket->refcount++;
+	}
+
 	if (append) {
 		php_stream_bucket_append(brigade, bucket);
 	} else {
 		php_stream_bucket_prepend(brigade, bucket);
 	}
-	/* This is a hack necessary to accommodate situations where bucket is appended to the stream
- 	 * multiple times. See bug35916.phpt for reference.
-	 */
-	if (bucket->refcount == 1) {
-		bucket->refcount++;
-	}
 }
 /* }}} */
 
diff '--color=auto' -Naur a/ext/standard/var.c b/ext/standard/var.c
--- a/ext/standard/var.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/standard/var.c	2025-10-25 03:24:13.173740594 +0000
@@ -153,7 +153,7 @@
 			} ZEND_HASH_FOREACH_END();
 			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
 				GC_UNPROTECT_RECURSION(myht);
-				GC_DELREF(myht);
+				GC_DTOR_NO_REF(myht);
 			}
 			if (level > 1) {
 				php_printf("%*c", level-1, ' ');
@@ -354,7 +354,7 @@
 		} ZEND_HASH_FOREACH_END();
 		if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
 			GC_UNPROTECT_RECURSION(myht);
-			GC_DELREF(myht);
+			GC_DTOR_NO_REF(myht);
 		}
 		if (level > 1) {
 			php_printf("%*c", level - 1, ' ');
@@ -737,7 +737,10 @@
 		return 0;
 	} else if (!in_rcn_array
 	 && Z_REFCOUNT_P(var) == 1
-	 && (Z_OBJ_P(var)->properties == NULL || GC_REFCOUNT(Z_OBJ_P(var)->properties) == 1)) {
+	 && (Z_OBJ_P(var)->properties == NULL || GC_REFCOUNT(Z_OBJ_P(var)->properties) == 1)
+	 /* __serialize and __sleep may arbitrarily increase the refcount */
+	 && Z_OBJCE_P(var)->__serialize == NULL
+	 && zend_hash_find_known_hash(&Z_OBJCE_P(var)->function_table, ZSTR_KNOWN(ZEND_STR_SLEEP)) == NULL) {
 		return 0;
 	}
 
@@ -998,18 +1001,11 @@
 			/* we should still add element even if it's not OK,
 			 * since we already wrote the length of the array before */
 			if (Z_TYPE_P(data) == IS_ARRAY) {
-				if (UNEXPECTED(Z_IS_RECURSIVE_P(data))
-					|| UNEXPECTED(Z_TYPE_P(struc) == IS_ARRAY && Z_ARR_P(data) == Z_ARR_P(struc))) {
+				if (UNEXPECTED(Z_TYPE_P(struc) == IS_ARRAY && Z_ARR_P(data) == Z_ARR_P(struc))) {
 					php_add_var_hash(var_hash, struc, in_rcn_array);
 					smart_str_appendl(buf, "N;", 2);
 				} else {
-					if (Z_REFCOUNTED_P(data)) {
-						Z_PROTECT_RECURSION_P(data);
-					}
 					php_var_serialize_intern(buf, data, var_hash, in_rcn_array, false);
-					if (Z_REFCOUNTED_P(data)) {
-						Z_UNPROTECT_RECURSION_P(data);
-					}
 				}
 			} else {
 				php_var_serialize_intern(buf, data, var_hash, in_rcn_array, false);
diff '--color=auto' -Naur a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
--- a/ext/xmlreader/php_xmlreader.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/xmlreader/php_xmlreader.c	2025-10-25 03:24:13.174094916 +0000
@@ -542,6 +542,7 @@
 
 			RETURN_TRUE;
 		} else {
+			xmlRelaxNGFree(schema);
 			php_error_docref(NULL, E_WARNING, "Schema contains errors");
 			RETURN_FALSE;
 		}
diff '--color=auto' -Naur a/ext/xsl/tests/gh19988.phpt b/ext/xsl/tests/gh19988.phpt
--- a/ext/xsl/tests/gh19988.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/xsl/tests/gh19988.phpt	2025-10-25 03:24:13.174271691 +0000
@@ -0,0 +1,19 @@
+--TEST--
+GH-19988 (zend_string_init with NULL pointer in simplexml (UB))
+--EXTENSIONS--
+simplexml
+xsl
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+$sxe = simplexml_load_file(__DIR__ . '/53965/collection.xml');
+$processor = new XSLTProcessor;
+$dom = new DOMDocument;
+$dom->load(__DIR__ . '/53965/collection.xsl');
+$processor->importStylesheet($dom);
+$result = $processor->transformToDoc($sxe, SimpleXMLElement::class);
+var_dump($result->getName());
+?>
+--EXPECT--
+string(0) ""
diff '--color=auto' -Naur a/ext/zend_test/observer.c b/ext/zend_test/observer.c
--- a/ext/zend_test/observer.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/zend_test/observer.c	2025-10-25 03:24:13.174372308 +0000
@@ -155,7 +155,7 @@
 			php_printf("%*s<!-- init %s() -->\n", 2 * ZT_G(observer_nesting_depth), "", ZSTR_VAL(fbc->common.function_name));
 		}
 	} else {
-		php_printf("%*s<!-- init '%s' -->\n", 2 * ZT_G(observer_nesting_depth), "", ZSTR_VAL(fbc->op_array.filename));
+		php_printf("%*s<!-- init '%s' -->\n", 2 * ZT_G(observer_nesting_depth), "", fbc->op_array.filename ? ZSTR_VAL(fbc->op_array.filename) : "[no active file]");
 	}
 }
 
@@ -178,7 +178,7 @@
 				php_printf("%*s%s()\n", indent, "", ZSTR_VAL(fbc->common.function_name));
 			}
 		} else {
-			php_printf("%*s{main} %s\n", indent, "", ZSTR_VAL(fbc->op_array.filename));
+			php_printf("%*s{main} %s\n", indent, "", fbc->op_array.filename ? ZSTR_VAL(fbc->op_array.filename) : "[no active file]");
 		}
 	} while ((ex = ex->prev_execute_data) != NULL);
 	php_printf("%*s-->\n", 2 * ZT_G(observer_nesting_depth), "");
diff '--color=auto' -Naur a/ext/zend_test/test_arginfo.h b/ext/zend_test/test_arginfo.h
--- a/ext/zend_test/test_arginfo.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/zend_test/test_arginfo.h	2025-10-25 03:24:13.174810095 +0000
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: e6374018fbb4fa793905bd5cb34e5a56b9e310fe */
+ * Stub hash: 6f76138d313c37244148004e2691ee47534f87a4 */
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_zend_test_array_return, 0, 0, IS_ARRAY, 0)
 ZEND_END_ARG_INFO()
@@ -171,6 +171,8 @@
 
 #define arginfo_zend_test_gh18756 arginfo_zend_test_void_return
 
+#define arginfo_zend_test_gh19792 arginfo_zend_test_void_return
+
 #define arginfo_ZendTestNS2_namespaced_func arginfo_zend_test_is_pcre_bundled
 
 #define arginfo_ZendTestNS2_namespaced_deprecated_func arginfo_zend_test_void_return
@@ -306,6 +308,7 @@
 static ZEND_FUNCTION(zend_test_is_zend_ptr);
 static ZEND_FUNCTION(zend_test_log_err_debug);
 static ZEND_FUNCTION(zend_test_gh18756);
+static ZEND_FUNCTION(zend_test_gh19792);
 static ZEND_FUNCTION(ZendTestNS2_namespaced_func);
 static ZEND_FUNCTION(ZendTestNS2_namespaced_deprecated_func);
 static ZEND_FUNCTION(ZendTestNS2_ZendSubNS_namespaced_func);
@@ -413,6 +416,15 @@
 	ZEND_FE(zend_test_log_err_debug, arginfo_zend_test_log_err_debug)
 	ZEND_FE(zend_test_gh18756, arginfo_zend_test_gh18756)
 #if (PHP_VERSION_ID >= 80400)
+	ZEND_RAW_FENTRY("zend_test_gh19792", zif_zend_test_gh19792, arginfo_zend_test_gh19792, ZEND_ACC_COMPILE_TIME_EVAL, NULL, NULL)
+#else
+#if (PHP_VERSION_ID >= 80200)
+	ZEND_RAW_FENTRY("zend_test_gh19792", zif_zend_test_gh19792, arginfo_zend_test_gh19792, ZEND_ACC_COMPILE_TIME_EVAL)
+#elif (PHP_VERSION_ID >= 80000)
+	ZEND_RAW_FENTRY("zend_test_gh19792", zif_zend_test_gh19792, arginfo_zend_test_gh19792, 0)
+#endif
+#endif
+#if (PHP_VERSION_ID >= 80400)
 	ZEND_RAW_FENTRY(ZEND_NS_NAME("ZendTestNS2", "namespaced_func"), zif_ZendTestNS2_namespaced_func, arginfo_ZendTestNS2_namespaced_func, 0, NULL, NULL)
 #else
 	ZEND_RAW_FENTRY(ZEND_NS_NAME("ZendTestNS2", "namespaced_func"), zif_ZendTestNS2_namespaced_func, arginfo_ZendTestNS2_namespaced_func, 0)
diff '--color=auto' -Naur a/ext/zend_test/test.c b/ext/zend_test/test.c
--- a/ext/zend_test/test.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/zend_test/test.c	2025-10-25 03:24:13.174511509 +0000
@@ -1588,3 +1588,12 @@
 	zend_mm_gc(heap);
 	zend_mm_shutdown(heap, true, false);
 }
+
+static PHP_FUNCTION(zend_test_gh19792)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+
+	RETVAL_STRING("this is a non-interned string");
+	zend_error(E_WARNING, "a warning");
+	zend_throw_error(NULL, "an exception");
+}
diff '--color=auto' -Naur a/ext/zend_test/tests/observer_fiber_backtrace_crash.phpt b/ext/zend_test/tests/observer_fiber_backtrace_crash.phpt
--- a/ext/zend_test/tests/observer_fiber_backtrace_crash.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/zend_test/tests/observer_fiber_backtrace_crash.phpt	2025-10-25 03:24:13.175094340 +0000
@@ -0,0 +1,48 @@
+--TEST--
+GH-16319 (Fiber backtrace with null filename should not crash)
+--EXTENSIONS--
+zend_test
+--INI--
+zend_test.observer.enabled=1
+zend_test.observer.show_init_backtrace=1
+zend_test.observer.show_output=1
+zend_test.observer.observe_all=1
+zend_test.observer.show_opcode=0
+opcache.jit=0
+--FILE--
+<?php
+$fiber = new Fiber(function() {});
+$fiber->start();
+echo "Test completed without crash\n";
+?>
+--EXPECTF--
+<!-- init %s -->
+<!--
+    {main} %s
+-->
+<file %s>
+  <!-- init Fiber::__construct() -->
+  <!--
+      Fiber::__construct()
+      {main} %s
+  -->
+  <Fiber::__construct>
+  </Fiber::__construct>
+  <!-- init Fiber::start() -->
+  <!--
+      Fiber::start()
+      {main} %s
+  -->
+  <Fiber::start>
+    <!-- init {closure:%s:%d}() -->
+    <!--
+        {closure:%s:%d}()
+        {main} [no active file]
+        Fiber::start()
+        {main} %s
+    -->
+    <{closure:%s:%d}>
+    </{closure:%s:%d}>
+  </Fiber::start>
+Test completed without crash
+</file %s>
diff '--color=auto' -Naur a/ext/zend_test/test.stub.php b/ext/zend_test/test.stub.php
--- a/ext/zend_test/test.stub.php	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/zend_test/test.stub.php	2025-10-25 03:24:13.174657572 +0000
@@ -318,6 +318,9 @@
     function zend_test_log_err_debug(string $str): void {}
 
     function zend_test_gh18756(): void {}
+
+    /** @compile-time-eval */
+    function zend_test_gh19792(): void {}
 }
 
 namespace ZendTestNS {
diff '--color=auto' -Naur a/ext/zip/php_zip.c b/ext/zip/php_zip.c
--- a/ext/zip/php_zip.c	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/zip/php_zip.c	2025-10-25 03:24:13.175330742 +0000
@@ -1790,7 +1790,7 @@
 					basename = php_basename(Z_STRVAL_P(zval_file), Z_STRLEN_P(zval_file), NULL, 0);
 					file_stripped = ZSTR_VAL(basename);
 					file_stripped_len = ZSTR_LEN(basename);
-				} else if (opts.remove_path && !memcmp(Z_STRVAL_P(zval_file), opts.remove_path, opts.remove_path_len)) {
+				} else if (opts.remove_path && Z_STRLEN_P(zval_file) > opts.remove_path_len && !memcmp(Z_STRVAL_P(zval_file), opts.remove_path, opts.remove_path_len)) {
 					if (IS_SLASH(Z_STRVAL_P(zval_file)[opts.remove_path_len])) {
 						file_stripped = Z_STRVAL_P(zval_file) + opts.remove_path_len + 1;
 						file_stripped_len = Z_STRLEN_P(zval_file) - opts.remove_path_len - 1;
@@ -2386,6 +2386,11 @@
 		RETURN_FALSE;
 	}
 
+	if (UNEXPECTED(zip_file_set_encryption(intern, idx, ZIP_EM_NONE, NULL) < 0)) {
+		php_error_docref(NULL, E_WARNING, "password reset failed");
+		RETURN_FALSE;
+	}
+
 	if (zip_file_set_encryption(intern, idx, (zip_uint16_t)method, password)) {
 		RETURN_FALSE;
 	}
@@ -2409,6 +2414,11 @@
 
 	ZIP_FROM_OBJECT(intern, self);
 
+	if (UNEXPECTED(zip_file_set_encryption(intern, index, ZIP_EM_NONE, NULL) < 0)) {
+		php_error_docref(NULL, E_WARNING, "password reset failed");
+		RETURN_FALSE;
+	}
+
 	if (zip_file_set_encryption(intern, index, (zip_uint16_t)method, password)) {
 		RETURN_FALSE;
 	}
diff '--color=auto' -Naur a/ext/zip/php_zip.h b/ext/zip/php_zip.h
--- a/ext/zip/php_zip.h	2025-09-23 14:14:32.000000000 +0000
+++ b/ext/zip/php_zip.h	2025-10-25 03:24:13.175727125 +0000
@@ -39,7 +39,7 @@
 /* Additionnal flags not from libzip */
 #define ZIP_FL_OPEN_FILE_NOW (1u<<30)
 
-#define PHP_ZIP_VERSION "1.22.6"
+#define PHP_ZIP_VERSION "1.22.7"
 
 #ifdef HAVE_LIBZIP_VERSION
 #define LIBZIP_VERSION_STR zip_libzip_version()
diff '--color=auto' -Naur a/ext/zip/tests/gh19688.phpt b/ext/zip/tests/gh19688.phpt
--- a/ext/zip/tests/gh19688.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/zip/tests/gh19688.phpt	2025-10-25 03:24:13.175811267 +0000
@@ -0,0 +1,21 @@
+--TEST--
+GH-19688 (Remove pattern overflow in zip addGlob())
+--EXTENSIONS--
+zip
+--FILE--
+<?php
+$dir = __DIR__ . '/';
+$testfile = $dir . '001.phpt';
+$zip = new ZipArchive();
+$filename = $dir . '/gh19688.zip';
+$zip->open($filename, ZipArchive::CREATE | ZipArchive::OVERWRITE);
+$options = array('remove_path' => $dir . 'a very long string here that will overrun');
+$zip->addGlob($testfile, 0, $options);
+var_dump($zip->getNameIndex(0));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__  . '/gh19688.zip');
+?>
+--EXPECTF--
+string(%d) "%s001.phpt"
diff '--color=auto' -Naur a/ext/zip/tests/gh19932.phpt b/ext/zip/tests/gh19932.phpt
--- a/ext/zip/tests/gh19932.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/zip/tests/gh19932.phpt	2025-10-25 03:24:13.175865449 +0000
@@ -0,0 +1,25 @@
+--TEST--
+GH-19932 (ZipArchive::setEncryptionName()/setEncryptionIndex() memory leak)
+--EXTENSIONS--
+zip
+--SKIPIF--
+<?php if (!method_exists('ZipArchive', 'setEncryptionName')) die('skip encryption not supported'); ?>
+--FILE--
+<?php
+$zip = new ZipArchive();
+$zip->open(__DIR__ . "/gh19932.zip", ZipArchive::CREATE);
+$zip->addFromString("test.txt", "test");
+$zip->setEncryptionName("test.txt", ZipArchive::EM_AES_256, "password");
+$zip->setEncryptionName("test.txt", ZipArchive::EM_AES_256, "password");
+$zip->setEncryptionIndex("0", ZipArchive::EM_AES_256, "password");
+$zip->setEncryptionIndex("0", ZipArchive::EM_AES_256, "password");
+$zip->close();
+echo "OK";
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/gh19932.zip");
+?>
+--EXPECT--
+OK
+
diff '--color=auto' -Naur a/ext/zlib/tests/gh19922.phpt b/ext/zlib/tests/gh19922.phpt
--- a/ext/zlib/tests/gh19922.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/ext/zlib/tests/gh19922.phpt	2025-10-25 03:24:13.176026104 +0000
@@ -0,0 +1,12 @@
+--TEST--
+GH-19922 (gzopen double free on debug build and unseekable stream)
+--EXTENSIONS--
+zlib
+--FILE--
+<?php
+var_dump(gzopen("php://output", 14));
+?>
+--EXPECTF--
+
+Warning: gzopen(php://output): could not make seekable - php://output in %s on line %d
+bool(false)
diff '--color=auto' -Naur a/.gdbinit b/.gdbinit
--- a/.gdbinit	2025-09-23 14:14:32.000000000 +0000
+++ b/.gdbinit	2025-10-25 03:24:13.146251669 +0000
@@ -42,7 +42,7 @@
 
 	printf "Compiled variables count: %d\n\n", $cv_count
 	while $cv_idx < $cv_count
-		printf "[%d] '%s'\n", $cv_idx, $cv[$cv_idx].val
+		printf "[%d] '$%s'\n", $cv_idx, $cv[$cv_idx].val@$cv[$cv_idx].len
 		set $zvalue = ((zval *) $cv_ex_ptr) + $callFrameSize + $cv_idx
 		printzv $zvalue
 		set $cv_idx = $cv_idx + 1
diff '--color=auto' -Naur a/.github/actions/apk/action.yml b/.github/actions/apk/action.yml
--- a/.github/actions/apk/action.yml	2025-09-23 14:14:32.000000000 +0000
+++ b/.github/actions/apk/action.yml	2025-10-25 03:24:13.146362284 +0000
@@ -7,6 +7,9 @@
         set -x
 
         OPCACHE_TLS_TESTS_DEPS="clang gcc binutils-gold lld"
+        # compiler-rt provides libclang_rt.asan-x86_64.a for clang20
+        # https://pkgs.alpinelinux.org/contents?file=libclang_rt.asan-x86_64.a&path=&name=&branch=v3.22
+        ASAN_DEPS="clang20 compiler-rt"
 
         apk update -q
         apk add \
@@ -52,8 +55,9 @@
             net-snmp-dev \
             openldap-dev \
             unixodbc-dev \
-            postgresql14-dev \
+            postgresql-dev \
             tzdata \
             musl-locales \
             musl-locales-lang \
-            $OPCACHE_TLS_TESTS_DEPS
+            $OPCACHE_TLS_TESTS_DEPS \
+            $ASAN_DEPS
diff '--color=auto' -Naur a/.github/nightly_matrix.php b/.github/nightly_matrix.php
--- a/.github/nightly_matrix.php	2025-09-23 14:14:32.000000000 +0000
+++ b/.github/nightly_matrix.php	2025-10-25 03:24:13.146425128 +0000
@@ -1,7 +1,8 @@
 <?php
 
 const BRANCHES = [
-    ['ref' => 'master', 'version' => [8, 5]],
+    ['ref' => 'master', 'version' => [8, 6]],
+    ['ref' => 'PHP-8.5', 'version' => [8, 5]],
     ['ref' => 'PHP-8.4', 'version' => [8, 4]],
     ['ref' => 'PHP-8.3', 'version' => [8, 3]],
     ['ref' => 'PHP-8.2', 'version' => [8, 2]],
diff '--color=auto' -Naur a/.github/scripts/windows/find-target-branch.bat b/.github/scripts/windows/find-target-branch.bat
--- a/.github/scripts/windows/find-target-branch.bat	2025-09-23 14:14:32.000000000 +0000
+++ b/.github/scripts/windows/find-target-branch.bat	2025-10-25 03:24:13.146488527 +0000
@@ -3,6 +3,6 @@
 for /f "usebackq tokens=3" %%i in (`findstr PHP_MAJOR_VERSION main\php_version.h`) do set BRANCH=%%i
 for /f "usebackq tokens=3" %%i in (`findstr PHP_MINOR_VERSION main\php_version.h`) do set BRANCH=%BRANCH%.%%i
 
-if /i "%BRANCH%" equ "8.5" (
+if /i "%BRANCH%" equ "8.6" (
 	set BRANCH=master
 )
diff '--color=auto' -Naur a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
--- a/.github/workflows/nightly.yml	2025-09-23 14:14:32.000000000 +0000
+++ b/.github/workflows/nightly.yml	2025-10-25 03:24:13.146646180 +0000
@@ -44,6 +44,9 @@
       skip_wordpress:
         required: true
         type: boolean
+      variation_enable_zend_max_execution_timers:
+        required: true
+        type: boolean
 permissions:
   contents: read
 jobs:
@@ -90,9 +93,9 @@
   ALPINE:
     if: inputs.run_alpine
     name: ALPINE_X64_ASAN_UBSAN_DEBUG_ZTS
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     container:
-      image: 'alpine:3.20.1'
+      image: 'alpine:3.22'
     steps:
       - name: git checkout
         uses: actions/checkout@v5
@@ -100,11 +103,6 @@
           ref: ${{ inputs.branch }}
       - name: apk
         uses: ./.github/actions/apk
-      - name: LLVM 17 (ASAN-only)
-        # libclang_rt.asan-x86_64.a is provided by compiler-rt, and only for clang17:
-        # https://pkgs.alpinelinux.org/contents?file=libclang_rt.asan-x86_64.a&path=&name=&branch=v3.20
-        run: |
-          apk add clang17 compiler-rt
       - name: System info
         run: |
           echo "::group::Show host CPU info"
@@ -119,8 +117,8 @@
           configurationParameters: >-
             CFLAGS="-fsanitize=undefined,address -fno-sanitize=function -DZEND_TRACK_ARENA_ALLOC"
             LDFLAGS="-fsanitize=undefined,address -fno-sanitize=function"
-            CC=clang-17
-            CXX=clang++-17
+            CC=clang-20
+            CXX=clang++-20
             --enable-debug
             --enable-zts
           skipSlow: true # FIXME: This should likely include slow extensions
@@ -199,6 +197,7 @@
             zts: true
             configuration_parameters: >-
               CFLAGS="-DZEND_RC_DEBUG=1 -DPROFITABILITY_CHECKS=0 -DZEND_VERIFY_FUNC_INFO=1 -DZEND_VERIFY_TYPE_INFERENCE"
+              ${{ inputs.variation_enable_zend_max_execution_timers && '--enable-zend-max-execution-timers' || '' }}
             run_tests_parameters: -d zend_test.observer.enabled=1 -d zend_test.observer.show_output=0
             timeout_minutes: 360
             test_function_jit: true
diff '--color=auto' -Naur a/.github/workflows/push.yml b/.github/workflows/push.yml
--- a/.github/workflows/push.yml	2025-09-23 14:14:32.000000000 +0000
+++ b/.github/workflows/push.yml	2025-10-25 03:24:13.146857088 +0000
@@ -40,6 +40,47 @@
   CC: ccache gcc
   CXX: ccache g++
 jobs:
+  ALPINE:
+    if: github.repository == 'php/php-src' || github.event_name == 'pull_request'
+    name: ALPINE_X64_ASAN_UBSAN_DEBUG_ZTS
+    runs-on: ubuntu-24.04
+    container:
+      image: 'alpine:3.22'
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v5
+      - name: apk
+        uses: ./.github/actions/apk
+      - name: System info
+        run: |
+          echo "::group::Show host CPU info"
+          lscpu
+          echo "::endgroup::"
+          echo "::group::Show installed package versions"
+          apk list
+          echo "::endgroup::"
+      - name: ./configure
+        uses: ./.github/actions/configure-alpine
+        with:
+          configurationParameters: >-
+            CFLAGS="-fsanitize=undefined,address -fno-sanitize=function -DZEND_TRACK_ARENA_ALLOC"
+            LDFLAGS="-fsanitize=undefined,address -fno-sanitize=function"
+            CC=clang-20
+            CXX=clang++-20
+            --enable-debug
+            --enable-zts
+          skipSlow: true # FIXME: This should likely include slow extensions
+      - name: make
+        run: make -j$(/usr/bin/nproc) >/dev/null
+      - name: make install
+        uses: ./.github/actions/install-alpine
+      - name: Test Tracing JIT
+        uses: ./.github/actions/test-alpine
+        with:
+          jitType: tracing
+          runTestsParameters: >-
+            --asan -x
+            -d opcache.enable_cli=1
   LINUX_X64:
     if: github.repository == 'php/php-src' || github.event_name == 'pull_request'
     services:
@@ -163,6 +204,7 @@
         with:
           key: "${{github.job}}-${{hashFiles('main/php_version.h')}}"
           append-timestamp: false
+          save: ${{ github.event_name != 'pull_request' }}
       - name: ./configure
         uses: ./.github/actions/configure-x32
         with:
diff '--color=auto' -Naur a/.github/workflows/root.yml b/.github/workflows/root.yml
--- a/.github/workflows/root.yml	2025-09-23 14:14:32.000000000 +0000
+++ b/.github/workflows/root.yml	2025-10-25 03:24:13.146976441 +0000
@@ -64,4 +64,5 @@
       skip_laravel: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
       skip_symfony: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
       skip_wordpress: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
+      variation_enable_zend_max_execution_timers: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 3) || matrix.branch.version[0] >= 9 }}
     secrets: inherit
diff '--color=auto' -Naur a/main/debug_gdb_scripts.c b/main/debug_gdb_scripts.c
--- a/main/debug_gdb_scripts.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/debug_gdb_scripts.c	2025-10-25 03:24:13.176175363 +0000
@@ -55,7 +55,7 @@
     ".ascii \"\\n\"\n"
     ".ascii \"	printf \\\"Compiled variables count: %d\\\\\\\\n\\\\\\\\n\\\", $cv_count\\n\"\n"
     ".ascii \"	while $cv_idx < $cv_count\\n\"\n"
-    ".ascii \"		printf \\\"[%d] \\\\'%s\\\\'\\\\\\\\n\\\", $cv_idx, $cv[$cv_idx].val\\n\"\n"
+    ".ascii \"		printf \\\"[%d] \\\\'$%s\\\\'\\\\\\\\n\\\", $cv_idx, $cv[$cv_idx].val@$cv[$cv_idx].len\\n\"\n"
     ".ascii \"		set $zvalue = ((zval *) $cv_ex_ptr) + $callFrameSize + $cv_idx\\n\"\n"
     ".ascii \"		printzv $zvalue\\n\"\n"
     ".ascii \"		set $cv_idx = $cv_idx + 1\\n\"\n"
diff '--color=auto' -Naur a/main/main.c b/main/main.c
--- a/main/main.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/main.c	2025-10-25 03:24:13.176492383 +0000
@@ -667,12 +667,13 @@
 {
 	/* Only do the safemode/open_basedir check at runtime */
 	if ((stage == PHP_INI_STAGE_RUNTIME || stage == PHP_INI_STAGE_HTACCESS) &&
-			new_value && zend_string_equals_literal(new_value, "syslog")) {
+			new_value && !zend_string_equals_literal(new_value, "syslog") && ZSTR_LEN(new_value) > 0) {
 		if (PG(open_basedir) && php_check_open_basedir(ZSTR_VAL(new_value))) {
 			return FAILURE;
 		}
 	}
-	OnUpdateString(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
+	char **p = (char **) ZEND_INI_GET_ADDR();
+	*p = new_value && ZSTR_LEN(new_value) > 0 ? ZSTR_VAL(new_value) : NULL;
 	return SUCCESS;
 }
 /* }}} */
@@ -680,13 +681,14 @@
 /* {{{ PHP_INI_MH */
 static PHP_INI_MH(OnUpdateMailLog)
 {
-	/* Only do the safemode/open_basedir check at runtime */
-	if ((stage == PHP_INI_STAGE_RUNTIME || stage == PHP_INI_STAGE_HTACCESS) && new_value) {
+	/* Only do the open_basedir check at runtime */
+	if ((stage == PHP_INI_STAGE_RUNTIME || stage == PHP_INI_STAGE_HTACCESS) && new_value && ZSTR_LEN(new_value) > 0) {
 		if (PG(open_basedir) && php_check_open_basedir(ZSTR_VAL(new_value))) {
 			return FAILURE;
 		}
 	}
-	OnUpdateString(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
+	char **p = (char **) ZEND_INI_GET_ADDR();
+	*p = new_value && ZSTR_LEN(new_value) > 0 ? ZSTR_VAL(new_value) : NULL;
 	return SUCCESS;
 }
 /* }}} */
diff '--color=auto' -Naur a/main/network.c b/main/network.c
--- a/main/network.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/network.c	2025-10-25 03:24:13.176915927 +0000
@@ -1036,6 +1036,28 @@
 }
 /* }}} */
 
+#ifdef PHP_WIN32
+char *php_socket_strerror_s(long err, char *buf, size_t bufsize)
+{
+	if (buf == NULL) {
+		char ebuf[1024];
+		errno_t res = strerror_s(ebuf, sizeof(ebuf), err);
+		if (res == 0) {
+			buf = estrdup(ebuf);
+		} else {
+			buf = estrdup("Unknown error");
+		}
+	} else {
+		errno_t res = strerror_s(buf, bufsize, err);
+		if (res != 0) {
+			strncpy(buf, "Unknown error", bufsize);
+			buf[bufsize?(bufsize-1):0] = 0;
+		}
+	}
+	return buf;
+}
+#endif
+
 /* Given a socket error code, if buf == NULL:
  *   emallocs storage for the error message and returns
  * else
@@ -1045,16 +1067,40 @@
 PHPAPI char *php_socket_strerror(long err, char *buf, size_t bufsize)
 {
 #ifndef PHP_WIN32
-	char *errstr;
-
-	errstr = strerror(err);
+# ifdef HAVE_STRERROR_R
+	if (buf == NULL) {
+		char ebuf[1024];
+#  ifdef STRERROR_R_CHAR_P
+		char *errstr = strerror_r(err, ebuf, sizeof(ebuf));
+		buf = estrdup(errstr);
+#  else
+		int res = (int) strerror_r(err, ebuf, sizeof(ebuf));
+		if (res == 0) {
+			buf = estrdup(ebuf);
+		} else {
+			buf = estrdup("Unknown error");
+		}
+#  endif
+	} else {
+#  ifdef STRERROR_R_CHAR_P
+		buf = strerror_r(err, buf, bufsize);
+#  else
+		int res = (int) strerror_r(err, buf, bufsize);
+		if (res != 0) {
+			strncpy(buf, "Unknown error", bufsize);
+			buf[bufsize?(bufsize-1):0] = 0;
+		}
+#  endif
+	}
+# else
+	char *errstr = strerror(err);
 	if (buf == NULL) {
 		buf = estrdup(errstr);
 	} else {
 		strncpy(buf, errstr, bufsize);
 		buf[bufsize?(bufsize-1):0] = 0;
 	}
-	return buf;
+# endif
 #else
 	char *sysbuf = php_win32_error_to_msg(err);
 	if (!sysbuf[0]) {
@@ -1069,9 +1115,8 @@
 	}
 
 	php_win32_error_msg_free(sysbuf);
-
-	return buf;
 #endif
+	return buf;
 }
 /* }}} */
 
@@ -1079,9 +1124,22 @@
 PHPAPI zend_string *php_socket_error_str(long err)
 {
 #ifndef PHP_WIN32
-	char *errstr;
-
-	errstr = strerror(err);
+# ifdef HAVE_STRERROR_R
+	char ebuf[1024];
+#  ifdef STRERROR_R_CHAR_P
+	char *errstr = strerror_r(err, ebuf, sizeof(ebuf));
+#  else
+	const char *errstr;
+	int res = (int) strerror_r(err, ebuf, sizeof(ebuf));
+	if (res == 0) {
+		errstr = ebuf;
+	} else {
+		errstr = "Unknown error";
+	}
+#  endif
+# else
+	char *errstr = strerror(err);
+# endif
 	return zend_string_init(errstr, strlen(errstr), 0);
 #else
 	zend_string *ret;
diff '--color=auto' -Naur a/main/php_network.h b/main/php_network.h
--- a/main/php_network.h	2025-09-23 14:14:32.000000000 +0000
+++ b/main/php_network.h	2025-10-25 03:24:13.177204149 +0000
@@ -64,6 +64,11 @@
  * unless buf is not NULL.
  * Also works sensibly for win32 */
 BEGIN_EXTERN_C()
+#ifdef PHP_WIN32
+char *php_socket_strerror_s(long err, char *buf, size_t bufsize);
+#else
+#define php_socket_strerror_s php_socket_strerror
+#endif
 PHPAPI char *php_socket_strerror(long err, char *buf, size_t bufsize);
 PHPAPI zend_string *php_socket_error_str(long err);
 END_EXTERN_C()
diff '--color=auto' -Naur a/main/php_version.h b/main/php_version.h
--- a/main/php_version.h	2025-09-23 14:14:32.000000000 +0000
+++ b/main/php_version.h	2025-10-25 03:24:49.394315296 +0000
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 8
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 13
+#define PHP_RELEASE_VERSION 14
 #define PHP_EXTRA_VERSION ""
-#define PHP_VERSION "8.4.13"
-#define PHP_VERSION_ID 80413
+#define PHP_VERSION "8.4.14"
+#define PHP_VERSION_ID 80414
diff '--color=auto' -Naur a/main/php_version.h.orig b/main/php_version.h.orig
--- a/main/php_version.h.orig	1970-01-01 00:00:00.000000000 +0000
+++ b/main/php_version.h.orig	2025-09-23 14:14:32.000000000 +0000
@@ -0,0 +1,8 @@
+/* automatically generated by configure */
+/* edit configure.ac to change version number */
+#define PHP_MAJOR_VERSION 8
+#define PHP_MINOR_VERSION 4
+#define PHP_RELEASE_VERSION 13
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "8.4.13"
+#define PHP_VERSION_ID 80413
diff '--color=auto' -Naur a/main/rfc1867.c b/main/rfc1867.c
--- a/main/rfc1867.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/rfc1867.c	2025-10-25 03:24:13.177505640 +0000
@@ -1048,7 +1048,8 @@
 					if (wlen == (size_t)-1) {
 						/* write failed */
 #if DEBUG_FILE_UPLOAD
-						sapi_module.sapi_error(E_NOTICE, "write() failed - %s", strerror(errno));
+						char errstr[256];
+						sapi_module.sapi_error(E_NOTICE, "write() failed - %s", php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 #endif
 						cancel_upload = PHP_UPLOAD_ERROR_F;
 					} else if (wlen < blen) {
diff '--color=auto' -Naur a/main/streams/filter.c b/main/streams/filter.c
--- a/main/streams/filter.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/streams/filter.c	2025-10-25 03:24:13.177654001 +0000
@@ -173,6 +173,7 @@
 
 PHPAPI void php_stream_bucket_append(php_stream_bucket_brigade *brigade, php_stream_bucket *bucket)
 {
+	/* TODO: this was added as a bad workaround for bug #35916 and should be removed in the future. */
 	if (brigade->tail == bucket) {
 		return;
 	}
diff '--color=auto' -Naur a/main/streams/plain_wrapper.c b/main/streams/plain_wrapper.c
--- a/main/streams/plain_wrapper.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/streams/plain_wrapper.c	2025-10-25 03:24:13.177795948 +0000
@@ -43,6 +43,10 @@
 # include <limits.h>
 #endif
 
+#ifdef __linux__
+# include <sys/sysmacros.h>
+#endif
+
 #define php_stream_fopen_from_fd_int(fd, mode, persistent_id)	_php_stream_fopen_from_fd_int((fd), (mode), (persistent_id) STREAMS_CC)
 #define php_stream_fopen_from_fd_int_rel(fd, mode, persistent_id)	 _php_stream_fopen_from_fd_int((fd), (mode), (persistent_id) STREAMS_REL_CC)
 #define php_stream_fopen_from_file_int(file, mode)	_php_stream_fopen_from_file_int((file), (mode) STREAMS_CC)
@@ -255,7 +259,28 @@
 static void detect_is_seekable(php_stdio_stream_data *self) {
 #if defined(S_ISFIFO) && defined(S_ISCHR)
 	if (self->fd >= 0 && do_fstat(self, 0) == 0) {
+#ifdef __linux__
+		if (S_ISCHR(self->sb.st_mode)) {
+			/* Some character devices are exceptions, check their major/minor ID
+			 * https://www.kernel.org/doc/Documentation/admin-guide/devices.txt */
+			if (major(self->sb.st_rdev) == 1) {
+				unsigned m = minor(self->sb.st_rdev);
+				self->is_seekable =
+					m == 1 ||   /* /dev/mem   */
+					m == 2 ||   /* /dev/kmem  */
+					m == 3 ||   /* /dev/null  */
+					m == 4 ||   /* /dev/port  (seekable, offset = I/O port) */
+					m == 5 ||   /* /dev/zero  */
+					m == 7;     /* /dev/full  */
+			} else {
+				self->is_seekable = false;
+			}
+		} else {
+			self->is_seekable = !S_ISFIFO(self->sb.st_mode);
+		}
+#else
 		self->is_seekable = !(S_ISFIFO(self->sb.st_mode) || S_ISCHR(self->sb.st_mode));
+#endif
 		self->is_pipe = S_ISFIFO(self->sb.st_mode);
 	}
 #elif defined(PHP_WIN32)
@@ -368,7 +393,9 @@
 				return bytes_written;
 			}
 			if (!(stream->flags & PHP_STREAM_FLAG_SUPPRESS_ERRORS)) {
-				php_error_docref(NULL, E_NOTICE, "Write of %zu bytes failed with errno=%d %s", count, errno, strerror(errno));
+				char errstr[256];
+				php_error_docref(NULL, E_NOTICE, "Write of %zu bytes failed with errno=%d %s",
+						count, errno, php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 			}
 		}
 	} else {
@@ -444,7 +471,9 @@
 				/* TODO: Should this be treated as a proper error or not? */
 			} else {
 				if (!(stream->flags & PHP_STREAM_FLAG_SUPPRESS_ERRORS)) {
-					php_error_docref(NULL, E_NOTICE, "Read of %zu bytes failed with errno=%d %s", count, errno, strerror(errno));
+					char errstr[256];
+					php_error_docref(NULL, E_NOTICE, "Read of %zu bytes failed with errno=%d %s",
+							count, errno, php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 				}
 
 				/* TODO: Remove this special-case? */
@@ -1278,7 +1307,9 @@
 	ret = VCWD_UNLINK(url);
 	if (ret == -1) {
 		if (options & REPORT_ERRORS) {
-			php_error_docref1(NULL, url, E_WARNING, "%s", strerror(errno));
+			char errstr[256];
+			php_error_docref1(NULL, url, E_WARNING, "%s",
+					php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 		}
 		return 0;
 	}
@@ -1324,6 +1355,7 @@
 
 	if (ret == -1) {
 #ifndef PHP_WIN32
+		char errstr[256];
 # ifdef EXDEV
 		if (errno == EXDEV) {
 			zend_stat_t sb;
@@ -1344,7 +1376,8 @@
 					 * access to the file in the meantime.
 					 */
 					if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
-						php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
+						php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s",
+								php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 						if (errno != EPERM) {
 							success = 0;
 						}
@@ -1352,7 +1385,8 @@
 
 					if (success) {
 						if (VCWD_CHMOD(url_to, sb.st_mode)) {
-							php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
+							php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s",
+									php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 							if (errno != EPERM) {
 								success = 0;
 							}
@@ -1363,10 +1397,12 @@
 						VCWD_UNLINK(url_from);
 					}
 				} else {
-					php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
+					php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s",
+							php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 				}
 			} else {
-				php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
+				php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s",
+						php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 			}
 #  if !defined(ZTS) && !defined(TSRM_WIN32)
 			umask(oldmask);
@@ -1379,7 +1415,8 @@
 #ifdef PHP_WIN32
 		php_win32_docref2_from_error(GetLastError(), url_from, url_to);
 #else
-		php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s", strerror(errno));
+		php_error_docref2(NULL, url_from, url_to, E_WARNING, "%s",
+				php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 #endif
 		return 0;
 	}
@@ -1459,11 +1496,12 @@
 	if (!p) {
 		p = buf;
 	}
+	char errstr[256];
 	while (true) {
 		int ret = VCWD_MKDIR(buf, (mode_t) mode);
 		if (ret < 0 && errno != EEXIST) {
 			if (options & REPORT_ERRORS) {
-				php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
+				php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 			}
 			return 0;
 		}
@@ -1483,7 +1521,7 @@
 			/* issue a warning to client when the last directory was created failed */
 			if (ret < 0) {
 				if (options & REPORT_ERRORS) {
-					php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
+					php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 				}
 				return 0;
 			}
@@ -1502,15 +1540,16 @@
 		return 0;
 	}
 
+	char errstr[256];
 #ifdef PHP_WIN32
 	if (!php_win32_check_trailing_space(url, strlen(url))) {
-		php_error_docref1(NULL, url, E_WARNING, "%s", strerror(ENOENT));
+		php_error_docref1(NULL, url, E_WARNING, "%s", php_socket_strerror_s(ENOENT, errstr, sizeof(errstr)));
 		return 0;
 	}
 #endif
 
 	if (VCWD_RMDIR(url) < 0) {
-		php_error_docref1(NULL, url, E_WARNING, "%s", strerror(errno));
+		php_error_docref1(NULL, url, E_WARNING, "%s", php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 		return 0;
 	}
 
@@ -1529,10 +1568,11 @@
 #endif
 	mode_t mode;
 	int ret = 0;
+	char errstr[256];
 
 #ifdef PHP_WIN32
 	if (!php_win32_check_trailing_space(url, strlen(url))) {
-		php_error_docref1(NULL, url, E_WARNING, "%s", strerror(ENOENT));
+		php_error_docref1(NULL, url, E_WARNING, "%s", php_socket_strerror_s(ENOENT, errstr, sizeof(errstr)));
 		return 0;
 	}
 #endif
@@ -1551,7 +1591,8 @@
 			if (VCWD_ACCESS(url, F_OK) != 0) {
 				FILE *file = VCWD_FOPEN(url, "w");
 				if (file == NULL) {
-					php_error_docref1(NULL, url, E_WARNING, "Unable to create file %s because %s", url, strerror(errno));
+					php_error_docref1(NULL, url, E_WARNING, "Unable to create file %s because %s", url,
+							php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 					return 0;
 				}
 				fclose(file);
@@ -1594,7 +1635,8 @@
 			return 0;
 	}
 	if (ret == -1) {
-		php_error_docref1(NULL, url, E_WARNING, "Operation failed: %s", strerror(errno));
+		php_error_docref1(NULL, url, E_WARNING, "Operation failed: %s",
+				php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 		return 0;
 	}
 	php_clear_stat_cache(0, NULL, 0);
diff '--color=auto' -Naur a/main/streams/streams.c b/main/streams/streams.c
--- a/main/streams/streams.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/streams/streams.c	2025-10-25 03:24:13.178156498 +0000
@@ -154,6 +154,7 @@
 {
 	char *tmp;
 	char *msg;
+	char errstr[256];
 	int free_msg = 0;
 
 	if (EG(exception)) {
@@ -203,7 +204,7 @@
 			free_msg = 1;
 		} else {
 			if (wrapper == &php_plain_files_wrapper) {
-				msg = strerror(errno); /* TODO: not ts on linux */
+				msg = php_socket_strerror_s(errno, errstr, sizeof(errstr));
 			} else {
 				msg = "operation failed";
 			}
@@ -1294,7 +1295,7 @@
 {
 	int ret = 0;
 
-	if (stream->writefilters.head) {
+	if (stream->writefilters.head && stream->ops->write) {
 		_php_stream_write_filtered(stream, NULL, 0, closing ? PSFS_FLAG_FLUSH_CLOSE : PSFS_FLAG_FLUSH_INC );
 	}
 
@@ -2219,7 +2220,6 @@
 	int persistent = options & STREAM_OPEN_PERSISTENT;
 	zend_string *path_str = NULL;
 	zend_string *resolved_path = NULL;
-	char *copy_of_path = NULL;
 
 	if (opened_path) {
 		if (options & STREAM_OPEN_FOR_ZEND_STREAM) {
@@ -2296,8 +2296,7 @@
 		if (stream->orig_path) {
 			pefree(stream->orig_path, persistent);
 		}
-		copy_of_path = pestrdup(path, persistent);
-		stream->orig_path = copy_of_path;
+		stream->orig_path = pestrdup(path, persistent);
 #if ZEND_DEBUG
 		stream->open_filename = __zend_orig_filename ? __zend_orig_filename : __zend_filename;
 		stream->open_lineno = __zend_orig_lineno ? __zend_orig_lineno : __zend_lineno;
@@ -2356,11 +2355,6 @@
 		}
 	}
 	php_stream_tidy_wrapper_error_log(wrapper);
-#if ZEND_DEBUG
-	if (stream == NULL && copy_of_path != NULL) {
-		pefree(copy_of_path, persistent);
-	}
-#endif
 	if (resolved_path) {
 		zend_string_release_ex(resolved_path, 0);
 	}
diff '--color=auto' -Naur a/main/streams/xp_socket.c b/main/streams/xp_socket.c
--- a/main/streams/xp_socket.c	2025-09-23 14:14:32.000000000 +0000
+++ b/main/streams/xp_socket.c	2025-10-25 03:24:13.178396887 +0000
@@ -678,9 +678,10 @@
 
 		if (sock->socket == SOCK_ERR) {
 			if (xparam->want_errortext) {
+				char errstr[256];
 				xparam->outputs.error_text = strpprintf(0, "Failed to create unix%s socket %s",
 						stream->ops == &php_stream_unix_socket_ops ? "" : "datagram",
-						strerror(errno));
+						php_socket_strerror_s(errno, errstr, sizeof(errstr)));
 			}
 			return -1;
 		}
diff '--color=auto' -Naur a/NEWS.orig b/NEWS.orig
--- a/NEWS.orig	1970-01-01 00:00:00.000000000 +0000
+++ b/NEWS.orig	2025-09-23 14:14:32.000000000 +0000
@@ -0,0 +1,1617 @@
+PHP                                                                        NEWS
+|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+25 Sep 2025, PHP 8.4.13
+
+- Core:
+  . Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler()
+    triggers "Constant already defined" warning). (ilutov)
+  . Partially fixed bug GH-19542 (Scanning of string literals >=2GB will fail
+    due to signed int overflow). (ilutov)
+  . Fixed bug GH-19544 (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap
+    references). (Arnaud, timwolla)
+  . Fixed bug GH-19613 (Stale array iterator pointer). (ilutov)
+  . Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge). (Arnaud)
+  . Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0). (Remi)
+  . Fixed bug GH-19720 (Assertion failure when error handler throws when
+    accessing a deprecated constant). (nielsdos)
+
+- CLI:
+  . Fixed bug GH-19461 (Improve error message on listening error with IPv6
+    address). (alexandre-daubois)
+
+- Date:
+  . Fixed date_sunrise() and date_sunset() with partial-hour UTC offset.
+    (ilutov)
+
+- DBA:
+  . Fixed bug GH-19706 (dba stream resource mismanagement). (nielsdos)
+
+- DOM:
+  . Fixed bug GH-19612 (Mitigate libxml2 tree dictionary bug). (nielsdos)
+
+- FPM:
+  . Fixed failed debug assertion when php_admin_value setting fails. (ilutov)
+
+- Intl:
+  . Fixed bug GH-11952 (Fix locale strings canonicalization for IntlDateFormatter
+    and NumberFormatter). (alexandre-daubois)
+
+- Opcache:
+  . Fixed bug GH-19493 (JIT variable not stored before YIELD). (Arnaud)
+
+- OpenSSL:
+  . Fixed bug GH-19245 (Success error message on TLS stream accept failure).
+    (Jakub Zelenka)
+
+- PGSQL:
+  . Fixed bug GH-19485 (potential use after free when using persistent pgsql
+    connections). (Mark Karpeles)
+
+- Phar:
+  . Fixed memory leaks when verifying OpenSSL signature. (Girgias)
+  . Fix memory leak in phar tar temporary file error handling code. (nielsdos)
+  . Fix metadata leak when phar convert logic fails. (nielsdos)
+  . Fix memory leak on failure in phar_convert_to_other(). (nielsdos)
+  . Fixed bug GH-19752 (Phar decompression with invalid extension
+    can cause UAF). (nielsdos)
+
+- Standard:
+  . Fixed bug GH-16649 (UAF during array_splice). (alexandre-daubois)
+  . Fixed bug GH-19577 (Avoid integer overflow when using a small offset
+    and PHP_INT_MAX with LimitIterator). (alexandre-daubois)
+
+- Streams:
+  . Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata().
+    (nielsdos)
+  . Fix OSS-Fuzz #385993744. (nielsdos)
+
+- Zip:
+  . Fix memory leak in zip when encountering empty glob result. (nielsdos)
+
+28 Aug 2025, PHP 8.4.12
+
+- Core:
+  . Fixed GH-19169 build issue with C++17 and ZEND_STATIC_ASSERT macro.
+    (psumbera)
+  . Fixed bug GH-19053 (Duplicate property slot with hooks and interface
+    property). (ilutov)
+  . Fixed bug GH-19044 (Protected properties are not scoped according to their
+    prototype). (Bob)
+  . Fixed bug GH-18581 (Coerce numeric string keys from iterators when argument
+    unpacking). (ilutov)
+  . Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in
+    binary const expr). (ilutov)
+  . Fixed bug GH-19305 (Operands may be being released during comparison).
+    (Arnaud)
+  . Fixed bug GH-19303 (Unpacking empty packed array into uninitialized array
+    causes assertion failure). (nielsdos)
+  . Fixed bug GH-19306 (Generator can be resumed while fetching next value from
+    delegated Generator). (Arnaud)
+  . Fixed bug GH-19326 (Calling Generator::throw() on a running generator with
+    a non-Generator delegate crashes). (Arnaud)
+  . Fixed bug GH-19280 (Stale array iterator position on rehashing). (ilutov)
+  . Fixed bug GH-18736 (Circumvented type check with return by ref + finally).
+    (ilutov)
+  . Fixed bug GH-19065 (Long match statement can segfault compiler during
+    recursive SSA renaming). (nielsdos, Arnaud)
+
+- Calendar:
+  . Fixed bug GH-19371 (integer overflow in calendar.c). (nielsdos)
+
+- FTP:
+  . Fix theoretical issues with hrtime() not being available. (nielsdos)
+
+- GD:
+  . Fix incorrect comparison with result of php_stream_can_cast(). (Girgias)
+
+- Hash:
+  . Fix crash on clone failure. (nielsdos)
+
+- Intl:
+  . Fix memleak on failure in collator_get_sort_key(). (nielsdos)
+  . Fix return value on failure for resourcebundle count handler. (Girgias)
+
+- LDAP:
+  . Fixed bug GH-18529 (additional inheriting of TLS int options).
+    (Jakub Zelenka)
+
+- LibXML:
+  . Fixed bug GH-19098 (libxml<2.13 segmentation fault caused by
+    php_libxml_node_free). (nielsdos)
+
+- MbString:
+  . Fixed bug GH-19397 (mb_list_encodings() can cause crashes on shutdown).
+    (nielsdos)
+
+- Opcache:
+  . Reset global pointers to prevent use-after-free in zend_jit_status().
+    (Florian Engelhardt)
+  . Fix issue with JIT restart and hooks. (nielsdos)
+  . Fix crash with dynamic function defs in hooks during preload. (nielsdos)
+
+- OpenSSL:
+  . Fixed bug GH-18986 (OpenSSL backend: incorrect RAND_{load,write}_file()
+    return value check). (nielsdos, botovq)
+  . Fix error return check of EVP_CIPHER_CTX_ctrl(). (nielsdos)
+  . Fixed bug GH-19428 (openssl_pkey_derive segfaults for DH derive with low
+    key_length param). (Jakub Zelenka)
+
+- PDO Pgsql:
+  . Fixed dangling pointer access on _pdo_pgsql_trim_message helper.
+    (dixyes)
+
+- SOAP:
+  . Fixed bug GH-18640 (heap-use-after-free ext/soap/php_encoding.c:299:32
+    in soap_check_zval_ref). (nielsdos)
+
+- Sockets:
+  . Fix some potential crashes on incorrect argument value. (nielsdos)
+
+- Standard:
+  . Fixed OSS Fuzz #433303828 (Leak in failed unserialize() with opcache).
+    (ilutov)
+  . Fix theoretical issues with hrtime() not being available. (nielsdos)
+  . Fixed bug GH-19300 (Nested array_multisort invocation with error breaks).
+    (nielsdos)
+
+- Windows:
+ . Free opened_path when opened_path_len >= MAXPATHLEN. (dixyes)
+
+31 Jul 2025, PHP 8.4.11
+
+- Calendar:
+  . Fixed jewishtojd overflow on year argument. (David Carlier)
+
+- Core:
+  . Fixed bug GH-18833 (Use after free with weakmaps dependent on destruction
+    order). (Daniil Gentili)
+  . Fixed bug GH-18907 (Leak when creating cycle in hook). (ilutov)
+  . Fix OSS-Fuzz #427814456. (nielsdos)
+  . Fix OSS-Fuzz #428983568 and #428760800. (nielsdos)
+
+- Curl:
+  . Fix memory leaks when returning refcounted value from curl callback.
+    (nielsdos)
+  . Remove incorrect string release. (nielsdos)
+
+- DOM:
+  . Fixed bug GH-18979 (Dom\XMLDocument::createComment() triggers undefined
+    behavior with null byte). (nielsdos)
+
+- LDAP:
+  . Fixed GH-18902 ldap_exop/ldap_exop_sync assert triggered on empty
+    request OID. (David Carlier)
+
+- MbString:
+  . Fixed bug GH-18901 (integer overflow mb_split). (nielsdos)
+
+- Opcache:
+  . Fixed bug GH-18639 (Internal class aliases can break preloading + JIT).
+    (nielsdos)
+  . Fixed bug GH-18899 (JIT function crash when emitting undefined variable
+    warning and opline is not set yet). (nielsdos)
+  . Fixed bug GH-14082 (Segmentation fault on unknown address 0x600000000018
+    in ext/opcache/jit/zend_jit.c). (nielsdos)
+  . Fixed bug GH-18898 (SEGV zend_jit_op_array_hot with property hooks
+    and preloading). (nielsdos)
+
+- OpenSSL:
+  . Fixed bug #80770 (It is not possible to get client peer certificate with
+    stream_socket_server). (Jakub Zelenka)
+
+- PCNTL:
+  . Fixed bug GH-18958 (Fatal error during shutdown after pcntl_rfork() or
+    pcntl_forkx() with zend-max-execution-timers). (Arnaud)
+
+- Phar:
+  . Fix stream double free in phar. (nielsdos, dixyes)
+  . Fix phar crash and file corruption with SplFileObject. (nielsdos)
+
+- SOAP:
+  . Fixed bug GH-18990, bug #81029, bug #47314 (SOAP HTTP socket not closing
+    on object destruction). (nielsdos)
+  . Fix memory leak when URL parsing fails in redirect. (Girgias)
+
+- SPL:
+  . Fixed bug GH-19094 (Attaching class with no Iterator implementation to
+    MultipleIterator causes crash). (nielsdos)
+
+- Standard:
+  . Fix misleading errors in printf(). (nielsdos)
+  . Fix RCN violations in array functions. (nielsdos)
+  . Fixed GH-18976 pack() overflow with h/H format and INT_MAX repeater value.
+    (David Carlier)
+
+- Streams:
+  . Fixed GH-13264 (fgets() and stream_get_line() do not return false on filter
+    fatal error). (Jakub Zelenka)
+
+- Zip:
+  . Fix leak when path is too long in ZipArchive::extractTo(). (nielsdos)
+
+03 Jul 2025, PHP 8.4.10
+
+- BcMath:
+  . Fixed bug GH-18641 (Accessing a BcMath\Number property by ref crashes).
+    (nielsdos)
+
+- Core:
+  . Fixed bugs GH-17711 and GH-18022 (Infinite recursion on deprecated attribute
+    evaluation) and GH-18464 (Recursion protection for deprecation constants not
+    released on bailout). (DanielEScherzer and ilutov)
+  . Fixed GH-18695 (zend_ast_export() - float number is not preserved).
+    (Oleg Efimov)
+  . Fix handling of references in zval_try_get_long(). (nielsdos)
+  . Do not delete main chunk in zend_gc. (danog, Arnaud)
+  . Fix compile issues with zend_alloc and some non-default options. (nielsdos)
+
+- Curl:
+  . Fix memory leak when setting a list via curl_setopt fails. (nielsdos)
+
+- Date:
+  . Fix leaks with multiple calls to DatePeriod iterator current(). (nielsdos)
+
+- DOM:
+  . Fixed bug GH-18744 (classList works not correctly if copy HTMLElement by
+    clone keyword). (nielsdos)
+
+- FPM:
+  . Fixed GH-18662 (fpm_get_status segfault). (txuna)
+
+- Hash:
+  . Fixed bug GH-14551 (PGO build fails with xxhash). (nielsdos)
+
+- Intl:
+  . Fix memory leak in intl_datetime_decompose() on failure. (nielsdos)
+  . Fix memory leak in locale lookup on failure. (nielsdos)
+
+- Opcache:
+  . Fixed bug GH-18743 (Incompatibility in Inline TLS Assembly on Alpine 3.22).
+    (nielsdos, Arnaud)
+
+- ODBC:
+  . Fix memory leak on php_odbc_fetch_hash() failure. (nielsdos)
+
+- OpenSSL:
+  . Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
+    (nielsdos)
+  . Fixed bug #74796 (Requests through http proxy set peer name).
+    (Jakub Zelenka)
+
+- PDO ODBC:
+  . Fix memory leak if WideCharToMultiByte() fails. (nielsdos)
+
+- PDO Sqlite:
+  . Fixed memory leak with Pdo_Sqlite::createCollation when the callback
+    has an incorrect return type. (David Carlier)
+
+- Phar:
+  . Add missing filter cleanups on phar failure. (nielsdos)
+  . Fixed bug GH-18642 (Signed integer overflow in ext/phar fseek). (nielsdos)
+
+- PHPDBG:
+  . Fix 'phpdbg --help' segfault on shutdown with USE_ZEND_ALLOC=0. (nielsdos)
+
+- PGSQL:
+  . Fix warning not being emitted when failure to cancel a query with
+    pg_cancel_query(). (Girgias)
+
+- Random:
+  . Fix reference type confusion and leak in user random engine.
+    (nielsdos, timwolla)
+
+- Readline:
+  . Fix memory leak when calloc() fails in php_readline_completion_cb().
+    (nielsdos)
+
+- SimpleXML:
+  . Fixed bug GH-18597 (Heap-buffer-overflow in zend_alloc.c when assigning
+    string with UTF-8 bytes). (nielsdos)
+
+- Soap:
+  . Fix memory leaks in php_http.c when call_user_function() fails. (nielsdos)
+
+- Tidy:
+  . Fix memory leak in tidy output handler on error. (nielsdos)
+  . Fix tidyOptIsReadonly deprecation, using tidyOptGetCategory. (David Carlier)
+
+06 Jun 2025, PHP 8.4.8
+
+- Core:
+  . Fixed GH-18480 (array_splice with large values for offset/length arguments).
+    (nielsdos/David Carlier)
+  . Partially fixed GH-18572 (nested object comparisons leading to stack overflow).
+    (David Carlier)
+  . Fixed OSS-Fuzz #417078295. (nielsdos)
+  . Fixed OSS-Fuzz #418106144. (nielsdos)
+
+- Curl:
+  . Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/
+    CURLOPT_PASSWORD set the Authorization header when set to NULL).
+    (David Carlier)
+
+- Date:
+  . Fixed bug GH-18076 (Since PHP 8, the date_sun_info() function returns
+    inaccurate sunrise and sunset times, but other calculated times are
+    correct) (JiriJozif).
+  . Fixed bug GH-18481 (date_sunrise with unexpected nan value for the offset).
+    (nielsdos/David Carlier)
+
+- DOM:
+  . Backport lexbor/lexbor#274. (nielsdos, alexpeattie)
+
+- Intl:
+  . Fix various reference issues. (nielsdos)
+
+- LDAP:
+  . Fixed bug GH-18529 (ldap no longer respects TLS_CACERT from ldaprc in
+    ldap_start_tls()). (Remi)
+
+- Opcache:
+  . Fixed bug GH-18417 (Windows SHM reattachment fails when increasing
+    memory_consumption or jit_buffer_size). (nielsdos)
+  . Fixed bug GH-18297 (Exception not handled when jit guard is triggered).
+    (Arnaud)
+  . Fixed bug GH-18408 (Snapshotted poly_func / poly_this may be spilled).
+    (Arnaud)
+  . Fixed bug GH-18567 (Preloading with internal class alias triggers assertion
+    failure). (nielsdos)
+  . Fixed bug GH-18534 (FPM exit code 70 with enabled opcache and hooked
+    properties in traits). (nielsdos)
+  . Fix leak of accel_globals->key. (nielsdos)
+
+- OpenSSL:
+  . Fix missing checks against php_set_blocking() in xp_ssl.c. (nielsdos)
+
+- SPL:
+  . Fixed bug GH-18421 (Integer overflow with large numbers in LimitIterator).
+    (nielsdos)
+
+- Standard:
+  . Fixed bug GH-17403 (Potential deadlock when putenv fails). (nielsdos)
+  . Fixed bug GH-18400 (http_build_query type error is inaccurate). (nielsdos)
+  . Fixed bug GH-18509 (Dynamic calls to assert() ignore zend.assertions).
+    (timwolla)
+
+- Windows:
+  . Fix leak+crash with sapi_windows_set_ctrl_handler(). (nielsdos)
+
+- Zip:
+  . Fixed bug GH-18431 (Registering ZIP progress callback twice doesn't work).
+    (nielsdos)
+  . Fixed bug GH-18438 (Handling of empty data and errors in
+    ZipArchive::addPattern). (nielsdos)
+
+24 Apr 2025, PHP 8.4.7
+
+- Core:
+  . Fixed bug GH-18038 (Lazy proxy calls magic methods twice). (Arnaud)
+  . Fixed bug GH-18209 (Use-after-free in extract() with EXTR_REFS). (ilutov)
+  . Fixed bug GH-18268 (Segfault in array_walk() on object with added property
+    hooks). (ilutov)
+  . Fixed bug GH-18304 (Changing the properties of a DateInterval through
+    dynamic properties triggers a SegFault). (nielsdos)
+  . Fix some leaks in php_scandir. (nielsdos)
+
+- DBA:
+  . FIxed bug GH-18247 dba_popen() memory leak on invalid path. (David Carlier)
+
+- Filter:
+  . Fixed bug GH-18309 (ipv6 filter integer overflow). (nielsdos)
+
+- GD:
+  . Fixed imagecrop() overflow with rect argument with x/width y/heigh usage
+    in gdImageCrop(). (David Carlier)
+  . Fixed GH-18243 imagettftext() overflow/underflow on font size value.
+    (David Carlier)
+
+- Intl:
+  . Fix reference support for intltz_get_offset(). (nielsdos)
+
+- LDAP:
+  . Fixed bug GH-17776 (LDAP_OPT_X_TLS_* options can't be overridden). (Remi)
+  . Fix NULL deref on high modification key. (nielsdos)
+
+- libxml:
+  . Fixed custom external entity loader returning an invalid resource leading
+    to a confusing TypeError message. (Girgias)
+
+- Opcache:
+  . Fixed bug GH-18294 (assertion failure zend_jit_ir.c). (nielsdos)
+  . Fixed bug GH-18289 (Fix segfault in JIT). (Florian Engelhardt)
+  . Fixed bug GH-18136 (tracing JIT floating point register clobbering on
+    Windows and ARM64). (nielsdos)
+
+- OpenSSL:
+  . Fix memory leak in openssl_sign() when passing invalid algorithm.
+    (nielsdos)
+  . Fix potential leaks when writing to BIO fails. (nielsdos)
+
+- PDO Firebird:
+  . Fixed bug GH-18276 (persistent connection - "zend_mm_heap corrupted"
+    with setAttribute()) (SakiTakamachi).
+  . Fixed bug GH-17383 (PDOException has wrong code and message since PHP 8.4)
+    (SakiTakamachi).
+
+- PDO Sqlite:
+  . Fix memory leak on error return of collation callback. (nielsdos)
+
+- PgSql:
+  . Fix uouv in pg_put_copy_end(). (nielsdos)
+
+- SPL:
+  . Fixed bug GH-18322 (SplObjectStorage debug handler mismanages memory).
+    (nielsdos)
+
+- Standard:
+  . Fixed bug GH-18145 (php8ts crashes in php_clear_stat_cache()).
+    (Jakub Zelenka)
+  . Fix resource leak in iptcembed() on error. (nielsdos)
+
+- Tests:
+  . Address deprecated PHP 8.4 session options to prevent test failures.
+    (willvar)
+
+- Zip:
+  . Fix uouv when handling empty options in ZipArchive::addGlob(). (nielsdos)
+  . Fix memory leak when handling a too long path in ZipArchive::addGlob().
+    (nielsdos)
+
+10 Apr 2025, PHP 8.4.6
+
+- BCMath:
+  . Fixed pointer subtraction for scale. (SakiTakamachi)
+
+- Core:
+  . Fixed property hook backing value access in multi-level inheritance.
+    (ilutov)
+  . Fixed accidentally inherited default value in overridden virtual properties.
+    (ilutov)
+  . Fixed bug GH-17376 (Broken JIT polymorphism for property hooks added to
+    child class). (ilutov)
+  . Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect
+    results for closures created from magic __call()). (timwolla)
+  . Fixed bug GH-17941 (Stack-use-after-return with lazy objects and hooks).
+    (nielsdos)
+  . Fixed bug GH-17988 (Incorrect handling of hooked props without get hook in
+    get_object_vars()). (ilutov)
+  . Fixed bug GH-17998 (Skipped lazy object initialization on primed
+    SIMPLE_WRITE cache). (ilutov)
+  . Fixed bug GH-17998 (Assignment to backing value in set hook of lazy proxy
+    calls hook again). (ilutov)
+  . Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction).
+    (Arnaud)
+  . Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown).
+    (Arnaud)
+  . Fixed OSS-Fuzz #403308724. (nielsdos)
+  . Fixed bug GH-13193 again (Significant performance degradation in 'foreach').
+    (nielsdos)
+
+- DBA:
+  . Fixed assertion violation when opening the same file with dba_open
+    multiple times. (chschneider)
+
+- DOM:
+  . Fixed bug GH-17991 (Assertion failure dom_attr_value_write). (nielsdos)
+  . Fix weird unpack behaviour in DOM. (nielsdos)
+  . Fixed bug GH-18090 (DOM: Svg attributes and tag names are being lowercased).
+    (nielsdos)
+  . Fix xinclude destruction of live attributes. (nielsdos)
+
+- Fuzzer:
+  . Fixed bug GH-18081 (Memory leaks in error paths of fuzzer SAPI).
+    (Lung-Alexandra)
+
+- GD:
+  . Fixed bug GH-17984 (calls with arguments as array with references).
+    (David Carlier)
+
+- LDAP:
+  . Fixed bug GH-18015 (Error messages for ldap_mod_replace are confusing).
+    (nielsdos)
+
+- Mbstring:
+  . Fixed bug GH-17989 (mb_output_handler crash with unset
+    http_output_conv_mimetypes). (nielsdos)
+
+- Opcache:
+  . Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal
+    JIT). (nielsdos)
+  . Fixed bug GH-17966 (Symfony JIT 1205 assertion failure). (nielsdos)
+  . Fixed bug GH-18037 (SEGV Zend/zend_execute.c). (nielsdos)
+  . Fixed bug GH-18050 (IN_ARRAY optimization in DFA pass is broken). (ilutov)
+  . Fixed bug GH-18113 (stack-buffer-overflow ext/opcache/jit/ir/ir_sccp.c).
+    (nielsdos)
+  . Fixed bug GH-18112 (NULL access with preloading and INI option). (nielsdos)
+  . Fixed bug GH-18107 (Opcache CFG jmp optimization with try-finally breaks
+    the exception table). (nielsdos)
+
+- PDO:
+  . Fix memory leak when destroying PDORow. (nielsdos)
+
+- PGSQL:
+  . Fixed bug GH-18148 (pg_copy_from() regression with explicit \n terminator
+    due to wrong offset check). (David Carlier)
+
+- Standard:
+  . Fix memory leaks in array_any() / array_all(). (nielsdos)
+
+- SOAP:
+  . Fixed bug #66049 (Typemap can break parsing in parse_packet_soap leading to
+    a segfault) . (Remi)
+
+- SPL:
+  . Fixed bug GH-18018 (RC1 data returned from offsetGet causes UAF in
+    ArrayObject). (nielsdos)
+
+- Treewide:
+  . Fixed bug GH-17736 (Assertion failure zend_reference_destroy()). (nielsdos)
+
+- Windows:
+  . Fixed bug GH-17836 (zend_vm_gen.php shouldn't break on Windows line
+    endings). (DanielEScherzer)
+
+27 Feb 2025, PHP 8.4.5
+
+- BCMath:
+  . Fixed bug GH-17398 (bcmul memory leak). (SakiTakamachi)
+
+- Core:
+  . Fixed bug GH-17623 (Broken stack overflow detection for variable
+    compilation). (ilutov)
+  . Fixed bug GH-17618 (UnhandledMatchError does not take
+    zend.exception_ignore_args=1 into account). (timwolla)
+  . Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
+  . Fixed bug OSS-Fuzz #391975641 (Crash when accessing property backing value
+    by reference). (ilutov)
+  . Fixed bug GH-17718 (Calling static methods on an interface that has
+    `__callStatic` is allowed). (timwolla)
+  . Fixed bug GH-17713 (ReflectionProperty::getRawValue() and related methods
+    may call hooks of overridden properties). (Arnaud)
+  . Fixed bug GH-17916 (Final abstract properties should error).
+    (DanielEScherzer)
+  . Fixed bug GH-17866 (zend_mm_heap corrupted error after upgrading from
+    8.4.3 to 8.4.4). (nielsdos)
+  . Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown
+    causes Use-After-Free). (CVE-2024-11235) (ilutov)
+
+- DOM:
+  . Fixed bug GH-17609 (Typo in error message: Dom\NO_DEFAULT_NS instead of
+    Dom\HTML_NO_DEFAULT_NS). (nielsdos)
+  . Fixed bug GH-17802 (\Dom\HTMLDocument querySelector attribute name is case
+    sensitive in HTML). (nielsdos)
+  . Fixed bug GH-17847 (xinclude destroys live node). (nielsdos)
+  . Fix using Dom\Node with Dom\XPath callbacks. (nielsdos)
+
+- FFI:
+  . Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)
+
+- FPM:
+  . Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
+    (Jakub Zelenka)
+
+- GD:
+  . Fixed bug GH-17703 (imagescale with both width and height negative values
+    triggers only an Exception on width). (David Carlier)
+  . Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
+    (David Carlier)
+
+- LDAP:
+  . Fixed bug GH-17704 (ldap_search fails when $attributes contains a
+    non-packed array with numerical keys). (nielsdos, 7u83)
+
+- LibXML:
+  . Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
+  . Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header
+    when requesting a redirected resource). (CVE-2025-1219) (timwolla)
+
+- MBString:
+  . Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
+    (cmb)
+
+- Opcache:
+  . Fixed bug GH-17654 (Multiple classes using same trait causes function
+    JIT crash). (nielsdos)
+  . Fixed bug GH-17577 (JIT packed type guard crash). (nielsdos, Dmitry)
+  . Fixed bug GH-17747 (Exception on reading property in register-based
+    FETCH_OBJ_R breaks JIT). (Dmitry, nielsdos)
+  . Fixed bug GH-17715 (Null pointer deref in observer API when calling
+    cases() method on preloaded enum). (Bob)
+  . Fixed bug GH-17868 (Cannot allocate memory with tracing JIT on 8.4.4).
+    (nielsdos)
+
+- PDO_SQLite:
+  . Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
+    (cmb)
+  . Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)
+  . Fix memory leaks in pdo_sqlite callback registration. (nielsdos)
+
+- Phar:
+  . Fixed bug GH-17808: PharFileInfo refcount bug. (nielsdos)
+
+- PHPDBG:
+  . Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer). (nielsdos)
+  . Fix memory leak in phpdbg calling registered function. (nielsdos)
+
+- Reflection:
+  . Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
+    (DanielEScherzer)
+  . Fixed missing final and abstract flags when dumping properties.
+    (DanielEScherzer)
+
+- Standard:
+  . Fixed bug #72666 (stat cache clearing inconsistent between file:// paths
+    and plain paths). (Jakub Zelenka)
+
+- Streams:
+  . Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
+  . Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
+  . Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit
+    basic auth header). (CVE-2025-1736) (Jakub Zelenka)
+  . Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
+    to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
+  . Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers
+    without colon). (CVE-2025-1734) (Jakub Zelenka)
+  . Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not
+    handle folded headers). (CVE-2025-1217) (Jakub Zelenka)
+
+- Windows:
+  . Fixed phpize for Windows 11 (24H2). (bwoebi)
+  . Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
+    (cmb)
+
+- Zlib:
+  . Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
+    (nielsdos)
+  . Fix memory leak when encoding check fails. (nielsdos)
+  . Fix zlib support for large files. (nielsdos)
+
+13 Feb 2025, PHP 8.4.4
+
+- Core:
+  . Fixed bug GH-17234 (Numeric parent hook call fails with assertion).
+    (nielsdos)
+  . Fixed bug GH-16892 (ini_parse_quantity() fails to parse inputs starting
+    with 0x0b). (nielsdos)
+  . Fixed bug GH-16886 (ini_parse_quantity() fails to emit warning for 0x+0).
+    (nielsdos)
+  . Fixed bug GH-17222 (__PROPERTY__ magic constant does not work in all
+    constant expression contexts). (ilutov)
+  . Fixed bug GH-17214 (Relax final+private warning for trait methods with
+    inherited final). (ilutov)
+  . Fixed NULL arithmetic during system program execution on Windows. (cmb,
+    nielsdos)
+  . Fixed potential OOB when checking for trailing spaces on Windows. (cmb)
+  . Fixed bug GH-17408 (Assertion failure Zend/zend_exceptions.c).
+    (nielsdos, ilutov)
+  . Fix may_have_extra_named_args flag for ZEND_AST_UNPACK. (nielsdos)
+  . Fix NULL arithmetic in System V shared memory emulation for Windows. (cmb)
+  . Fixed bug GH-17597 (#[\Deprecated] does not work for __call() and
+    __callStatic()). (timwolla)
+
+- DOM:
+  . Fixed bug GH-17397 (Assertion failure ext/dom/php_dom.c). (nielsdos)
+  . Fixed bug GH-17486 (Incorrect error line numbers reported in
+    Dom\HTMLDocument::createFromString). (nielsdos)
+  . Fixed bug GH-17481 (UTF-8 corruption in \Dom\HTMLDocument). (nielsdos)
+  . Fixed bug GH-17500 (Segfault with requesting nodeName on nameless doctype).
+    (nielsdos)
+  . Fixed bug GH-17485 (upstream fix, Self-closing tag on void elements
+    shouldn't be a parse error/warning in \Dom\HTMLDocument). (lexborisov)
+  . Fixed bug GH-17572 (getElementsByTagName returns collections with
+    tagName-based indexing). (nielsdos)
+
+- Enchant:
+  . Fix crashes in enchant when passing null bytes. (nielsdos)
+
+- FTP:
+  . Fixed bug GH-16800 (ftp functions can abort with EINTR). (nielsdos)
+
+- GD:
+  . Fixed bug GH-17349 (Tiled truecolor filling looses single color
+    transparency). (cmb)
+  . Fixed bug GH-17373 (imagefttext() ignores clipping rect for palette
+    images). (cmb)
+  . Ported fix for libgd 223 (gdImageRotateGeneric() does not properly
+    interpolate). (cmb)
+  . Added support for reading GIFs without colormap to bundled libgd. (Andrew
+    Burley, cmb)
+
+- Gettext:
+  . Fixed bug GH-17400 (bindtextdomain SEGV on invalid domain).
+    (David Carlier)
+
+- Intl:
+  . Fixed bug GH-11874 (intl causing segfault in docker images). (nielsdos)
+
+- Opcache:
+  . Fixed bug GH-15981 (Segfault with frameless jumps and minimal JIT).
+    (nielsdos)
+  . Fixed bug GH-17307 (Internal closure causes JIT failure). (nielsdos)
+  . Fixed bug GH-17428 (Assertion failure ext/opcache/jit/zend_jit_ir.c:8940).
+    (nielsdos)
+  . Fixed bug GH-17564 (Potential UB when reading from / writing to struct
+    padding). (ilutov)
+
+- PCNTL:
+  . Fixed pcntl_setcpuaffinity exception type from ValueError to TypeError for
+    the cpu mask argument with entries type different than int/string.
+    (David Carlier)
+
+- PCRE:
+  . Fixed bug GH-17122 (memory leak in regex). (nielsdos)
+
+- PDO:
+  . Fixed a memory leak when the GC is used to free a PDOStatment. (Girgias)
+  . Fixed a crash in the PDO Firebird Statement destructor. (nielsdos)
+  . Fixed UAFs when changing default fetch class ctor args. (Girgias, nielsdos)
+
+- PgSql:
+  . Fixed build failure when the constant PGRES_TUPLES_CHUNK is not present
+    in the system. (chschneider)
+
+- Phar:
+  . Fixed bug GH-17518 (offset overflow phar extractTo()). (nielsdos)
+
+- PHPDBG:
+  . Fix crashes in function registration + test. (nielsdos, Girgias)
+
+- Session:
+  . Fix type confusion with session SID constant. (nielsdos)
+  . Fixed bug GH-17541 (ext/session NULL pointer dereferencement during
+    ID reset). (Girgias)
+
+- SimpleXML:
+  . Fixed bug GH-17409 (Assertion failure Zend/zend_hash.c:1730). (nielsdos)
+
+- SNMP:
+  . Fixed bug GH-17330 (SNMP::setSecurity segfault on closed session).
+    (David Carlier)
+
+- SPL:
+  . Fixed bug GH-15833 (Segmentation fault (access null pointer) in
+    ext/spl/spl_array.c). (nielsdos)
+  . Fixed bug GH-17516 (SplFileTempObject::getPathInfo() Undefined behavior
+    on invalid class). (David Carlier)
+
+- Standard:
+  . Fixed bug GH-17447 (Assertion failure when array popping a self addressing
+    variable). (nielsdos)
+
+- Windows:
+  . Fixed clang compiler detection. (cmb)
+
+- Zip:
+  . Fixed bug GH-17139 (Fix zip_entry_name() crash on invalid entry).
+    (nielsdos)
+
+16 Jan 2025, PHP 8.4.3
+
+- BcMath:
+  . Fixed bug GH-17049 (Correctly compare 0 and -0). (Saki Takamachi)
+  . Fixed bug GH-17061 (Now Number::round() does not remove trailing zeros).
+    (Saki Takamachi)
+  . Fixed bug GH-17064 (Correctly round rounding mode with zero edge case).
+    (Saki Takamachi)
+  . Fixed bug GH-17275 (Fixed the calculation logic of dividend scale).
+    (Saki Takamachi)
+
+- Core:
+  . Fixed bug OSS-Fuzz #382922236 (Duplicate dynamic properties in hooked object
+    iterator properties table). (ilutov)
+  . Fixed unstable get_iterator pointer for hooked classes in shm on Windows.
+    (ilutov)
+  . Fixed bug GH-17106 (ZEND_MATCH_ERROR misoptimization). (ilutov)
+  . Fixed bug GH-17162 (zend_array_try_init() with dtor can cause engine UAF).
+    (nielsdos)
+  . Fixed bug GH-17101 (AST->string does not reproduce constructor property
+    promotion correctly). (nielsdos)
+  . Fixed bug GH-17200 (Incorrect dynamic prop offset in hooked prop iterator).
+    (ilutov)
+  . Fixed bug GH-17216 (Trampoline crash on error). (nielsdos)
+
+- DBA:
+  . Skip test if inifile is disabled. (orlitzky)
+
+- DOM:
+  . Fixed bug GH-17145 (DOM memory leak). (nielsdos)
+  . Fixed bug GH-17201 (Dom\TokenList issues with interned string replace).
+    (nielsdos)
+  . Fixed bug GH-17224 (UAF in importNode). (nielsdos)
+
+- Embed:
+  . Make build command for program using embed portable. (dunglas)
+
+- FFI:
+  . Fixed bug #79075 (FFI header parser chokes on comments). (nielsdos)
+  . Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure. (nielsdos)
+  . Fixed bug GH-16013 and bug #80857 (Big endian issues). (Dmitry, nielsdos)
+
+- Fileinfo:
+  . Fixed bug GH-17039 (PHP 8.4: Incorrect MIME content type). (nielsdos)
+
+- FPM:
+  . Fixed bug GH-13437 (FPM: ERROR: scoreboard: failed to lock (already
+    locked)). (Jakub Zelenka)
+  . Fixed bug GH-17112 (Macro redefinitions). (cmb, nielsdos)
+  . Fixed bug GH-17208 (bug64539-status-json-encoding.phpt fail on 32-bits).
+    (nielsdos)
+
+- GD:
+  . Fixed bug GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c).
+    (nielsdos, cmb)
+  . Ported fix for libgd bug 276 (Sometimes pixels are missing when storing
+    images as BMPs). (cmb)
+
+- Gettext:
+  . Fixed bug GH-17202 (Segmentation fault ext/gettext/gettext.c
+    bindtextdomain()). (Michael Orlitzky)
+
+- Iconv:
+  . Fixed bug GH-17047 (UAF on iconv filter failure). (nielsdos)
+
+- LDAP:
+  . Fixed bug GH-17280 (ldap_search() fails when $attributes array has holes).
+    (nielsdos)
+
+- LibXML:
+  . Fixed bug GH-17223 (Memory leak in libxml encoding handling). (nielsdos)
+
+- MBString:
+  . Fixed bug GH-17112 (Macro redefinitions). (nielsdos, cmb)
+
+- Opcache:
+  . opcache_get_configuration() properly reports jit_prof_threshold. (cmb)
+  . Fixed bug GH-17140 (Assertion failure in JIT trace exit with
+    ZEND_FETCH_DIM_FUNC_ARG). (nielsdos, Dmitry)
+  . Fixed bug GH-17151 (Incorrect RC inference of op1 of FETCH_OBJ and
+    INIT_METHOD_CALL). (Dmitry, ilutov)
+  . Fixed bug GH-17246 (GC during SCCP causes segfault). (Dmitry)
+  . Fixed bug GH-17257 (UBSAN warning in ext/opcache/jit/zend_jit_vm_helpers.c).
+    (nielsdos, Dmitry)
+
+- PCNTL:
+  . Fix memory leak in cleanup code of pcntl_exec() when a non stringable
+    value is encountered past the first entry. (Girgias)
+
+- PgSql:
+  . Fixed bug GH-17158 (pg_fetch_result Shows Incorrect ArgumentCountError
+    Message when Called With 1 Argument). (nielsdos)
+  . Fixed further ArgumentCountError for calls with flexible
+    number of arguments. (David Carlier)
+
+- Phar:
+  . Fixed bug GH-17137 (Segmentation fault ext/phar/phar.c). (nielsdos)
+
+- SimpleXML:
+  . Fixed bug GH-17040 (SimpleXML's unset can break DOM objects). (nielsdos)
+  . Fixed bug GH-17153 (SimpleXML crash when using autovivification on
+    document). (nielsdos)
+
+- Sockets:
+  . Fixed bug GH-16276 (socket_strerror overflow handling with INT_MIN).
+    (David Carlier / cmb)
+  . Fixed overflow on SO_LINGER values setting, strengthening values check
+    on SO_SNDTIMEO/SO_RCVTIMEO for socket_set_option().
+    (David Carlier)
+
+- SPL:
+  . Fixed bug GH-17198 (SplFixedArray assertion failure with get_object_vars).
+    (nielsdos)
+  . Fixed bug GH-17225 (NULL deref in spl_directory.c). (nielsdos)
+
+- Streams:
+  . Fixed bug GH-17037 (UAF in user filter when adding existing filter name due
+    to incorrect error handling). (nielsdos)
+  . Fixed bug GH-16810 (overflow on fopen HTTP wrapper timeout value).
+    (David Carlier)
+  . Fixed bug GH-17067 (glob:// wrapper doesn't cater to CWD for ZTS builds).
+    (cmb)
+
+- Windows:
+  . Hardened proc_open() against cmd.exe hijacking. (cmb)
+
+- XML:
+  . Fixed bug GH-1718 (unreachable program point in zend_hash). (nielsdos)
+
+19 Dec 2024, PHP 8.4.2
+
+- BcMath:
+  . Fixed bug GH-16978 (Avoid unnecessary padding with leading zeros).
+    (Saki Takamachi)
+
+- COM:
+  . Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).
+    (cmb)
+
+- Core:
+  . Fixed bug GH-16344 (setRawValueWithoutLazyInitialization() and
+    skipLazyInitialization() may change initialized proxy). (Arnaud)
+  . Fix is_zend_ptr() huge block comparison. (nielsdos)
+  . Fixed potential OOB read in zend_dirname() on Windows. (cmb)
+  . Fixed bug GH-15964 (printf() can strip sign of -INF). (divinity76, cmb)
+
+- Curl:
+  . Fix various memory leaks in curl mime handling. (nielsdos)
+
+- DBA:
+  . Fixed bug GH-16990 (dba_list() is now zero-indexed instead of using
+    resource ids) (kocsismate)
+
+- DOM:
+  . Fixed bug GH-16906 (Reloading document can cause UAF in iterator).
+    (nielsdos)
+
+- FPM:
+  . Fixed bug GH-16932 (wrong FPM status output). (Jakub Zelenka, James Lucas)
+
+- GMP:
+  . Fixed bug GH-16890 (array_sum() with GMP can loose precision (LLP64)).
+    (cmb)
+
+- Opcache:
+  . Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
+    (dktapps)
+  . Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64). (nielsdos)
+  . Fixed bug GH-16879 (JIT dead code skipping does not update call_level).
+    (nielsdos)
+
+- SAPI:
+  . Fixed bug GH-16998 (UBSAN warning in rfc1867). (nielsdos)
+
+- PHPDBG:
+  . Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).
+    (nielsdos)
+
+- Standard:
+  . Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF
+    properties). (nielsdos)
+  . Fixed bug GH-16957 (Assertion failure in array_shift with
+    self-referencing array). (nielsdos)
+
+- Streams:
+  . Fixed network connect poll interuption handling. (Jakub Zelenka)
+
+- Windows:
+  . Fixed bug GH-16849 (Error dialog causes process to hang). (cmb)
+  . Windows Server 2025 is now properly reported. (cmb)
+
+21 Nov 2024, PHP 8.4.1
+
+- BcMath:
+  . [RFC] Add bcfloor, bcceil and bcround to BCMath. (Saki Takamachi)
+  . Improve performance. (Saki Takamachi, nielsdos)
+  . Adjust bcround()'s $mode parameter to only accept the RoundingMode
+    enum. (timwolla, saki)
+  . Fixed LONG_MAX in BCMath ext. (Saki Takamachi)
+  . Fixed bcdiv() div by one. (Saki Takamachi)
+  . [RFC] Support object types in BCMath. (Saki Takamachi)
+  . bcpow() performance improvement. (Jorg Sowa)
+  . ext/bcmath: Check for scale overflow. (SakiTakamachi)
+  . [RFC] ext/bcmath: Added bcdivmod. (SakiTakamachi)
+  . Fix GH-15968 (Avoid converting objects to strings in operator calculations).
+    (SakiTakamachi)
+  . Fixed bug GH-16265 (Added early return case when result is 0)
+    (Saki Takamachi).
+  . Fixed bug GH-16262 (Fixed a bug where size_t underflows) (Saki Takamachi).
+  . Fixed GH-16236 (Fixed a bug in BcMath\Number::pow() and bcpow() when
+    raising negative powers of 0) (Saki Takamachi).
+
+- Core:
+  . Added zend_call_stack_get implementation for NetBSD, DragonFlyBSD,
+    Solaris and Haiku. (David Carlier)
+  . Enabled ifunc checks on FreeBSD from the 12.x releases. (Freaky)
+  . Changed the type of PHP_DEBUG and PHP_ZTS constants to bool. (haszi)
+  . Fixed bug GH-13142 (Undefined variable name is shortened when contains \0).
+    (nielsdos)
+  . Fixed bug GH-13178 (Iterator positions incorrect when converting packed
+    array to hashed). (ilutov)
+  . Fixed zend fiber build for solaris default mode (32 bits). (David Carlier)
+  . Fixed zend call stack size for macOs/arm64. (David Carlier)
+  . Added support for Zend Max Execution Timers on FreeBSD. (Kévin Dunglas)
+  . Ensure fiber stack is not backed by THP. (crrodriguez)
+  . Implement GH-13609 (Dump wrapped object in WeakReference class). (nielsdos)
+  . Added sparc64 arch assembly support for zend fiber. (Claudio Jeker)
+  . Fixed GH-13581 no space available for TLS on NetBSD. (Paul Ripke)
+  . Added fiber Sys-V loongarch64 support. (qiangxuhui)
+  . Adjusted closure names to include the parent function's name. (timwolla)
+  . Improve randomness of uploaded file names and files created by tempnam().
+    (Arnaud)
+  . Added gc and shutdown callbacks to zend_mm custom handlers.
+    (Florian Engelhardt)
+  . Fixed bug GH-14650 (Compute the size of pages before allocating memory).
+    (Julien Voisin)
+  . Fixed bug GH-11928 (The --enable-re2c-cgoto doesn't add the -g flag).
+    (Peter Kokot)
+  . Added the #[\Deprecated] attribute. (beberlei, timwolla)
+  . Fixed GH-11389 (Allow suspending fibers in destructors). (Arnaud, trowski)
+  . Fixed bug GH-14801 (Fix build for armv7). (andypost)
+  . Implemented property hooks RFC. (ilutov)
+  . Fix GH-14978 (The xmlreader extension phpize build). (Peter Kokot)
+  . Throw Error exception when encountering recursion during comparison, rather
+    than fatal error. (ilutov)
+  . Added missing cstddef include for C++ builds. (cmb)
+  . Updated build system scripts config.guess to 2024-07-27 and config.sub to
+    2024-05-27. (Peter Kokot)
+  . Fixed bug GH-15240 (Infinite recursion in trait hook). (ilutov)
+  . Fixed bug GH-15140 (Missing variance check for abstract set with asymmetric
+    type). (ilutov)
+  . Fixed bug GH-15181 (Disabled output handler is flushed again). (cmb)
+  . Passing E_USER_ERROR to trigger_error() is now deprecated. (Girgias)
+  . Fixed bug GH-15292 (Dynamic AVX detection is broken for MSVC). (nielsdos)
+  . Using "_" as a class name is now deprecated. (Girgias)
+  . Exiting a namespace now clears seen symbols. (ilutov)
+  . The exit (and die) language constructs now behave more like a function.
+    They can be passed liked callables, are affected by the strict_types
+    declare statement, and now perform the usual type coercions instead of
+    casting any non-integer value to a string.
+    As such, passing invalid types to exit/die may now result in a TypeError
+    being thrown. (Girgias)
+  . Fixed bug GH-15438 (Hooks on constructor promoted properties without
+    visibility are ignored). (ilutov)
+  . Fixed bug GH-15419 (Missing readonly+hook incompatibility check for readonly
+    classes). (ilutov)
+  . Fixed bug GH-15187 (Various hooked object iterator issues). (ilutov)
+  . Fixed bug GH-15456 (Crash in get_class_vars() on virtual properties).
+    (ilutov)
+  . Fixed bug GH-15501 (Windows HAVE_<header>_H macros defined to 1 or
+    undefined). (Peter Kokot)
+  . Implemented asymmetric visibility for properties. (ilutov)
+  . Fixed bug GH-15644 (Asymmetric visibility doesn't work with hooks). (ilutov)
+  . Implemented lazy objects RFC. (Arnaud)
+  . Fixed bug GH-15686 (Building shared iconv with external iconv library).
+    (Peter Kokot, zeriyoshi)
+  . Fixed missing error when adding asymmetric visibility to unilateral virtual
+    property. (ilutov)
+  . Fixed bug GH-15693 (Unnecessary include in main.c bloats binary).
+    (nielsdos)
+  . Fixed bug GH-15731 (AllowDynamicProperties validation should error on
+    enums). (DanielEScherzer)
+  . Fixed bug GH-16040 (Use-after-free of object released in hook). (ilutov)
+  . Fixed bug GH-16026 (Reuse of dtor fiber during shutdown). (Arnaud)
+  . Fixed bug GH-15999 (zend_std_write_property() assertion failure with lazy
+    objects). (Arnaud)
+  . Fixed bug GH-15960 (Foreach edge cases with lazy objects). (Arnaud)
+  . Fixed bug GH-16185 (Various hooked object iterator issues). (ilutov)
+  . Fixed bug OSS-Fuzz #371445205 (Heap-use-after-free in attr_free).
+    (nielsdos)
+  . Fixed missing error when adding asymmetric visibility to static properties.
+    (ilutov)
+  . Fixed bug OSS-Fuzz #71407 (Null-dereference WRITE in
+    zend_lazy_object_clone). (Arnaud)
+  . Fixed bug GH-16574 (Incorrect error "undefined method" messages).
+    (nielsdos)
+  . Fixed bug GH-16577 (EG(strtod_state).freelist leaks with opcache.preload).
+    (nielsdos)
+  . Fixed bug GH-16615 (Assertion failure in zend_std_read_property). (Arnaud)
+  . Fixed bug GH-16342 (Added ReflectionProperty::isLazy()). (Arnaud)
+  . Fixed bug GH-16725 (Incorrect access check for non-hooked props in hooked
+    object iterator). (ilutov)
+
+- Curl:
+  . Deprecated the CURLOPT_BINARYTRANSFER constant. (divinity76)
+  . Bumped required libcurl version to 7.61.0. (Ayesh)
+  . Added feature_list key to the curl_version() return value. (Ayesh)
+  . Added constants CURL_HTTP_VERSION_3 (libcurl 7.66) and CURL_HTTP_VERSION_3ONLY
+    (libcurl 7.88) as options for CURLOPT_HTTP_VERSION (Ayesh Karunaratne)
+  . Added CURLOPT_TCP_KEEPCNT to set the number of probes to send before
+    dropping the connection. (David Carlier)
+  . Added CURLOPT_PREREQFUNCTION Curl option to set a custom callback
+    after the connection is established, but before the request is
+    performed. (Ayesh Karunaratne)
+  . Added CURLOPT_SERVER_RESPONSE_TIMEOUT, which was formerly known as
+    CURLOPT_FTP_RESPONSE_TIMEOUT. (Ayesh Karunaratne)
+  . The CURLOPT_DNS_USE_GLOBAL_CACHE option is now silently ignored. (Ayesh Karunaratne)
+  . Added CURLOPT_DEBUGFUNCTION as a Curl option. (Ayesh Karunaratne)
+  . Fixed bug GH-16359 (crash with curl_setopt* CURLOPT_WRITEFUNCTION
+    without null callback). (David Carlier)
+  . Fixed bug GH-16723 (CURLMOPT_PUSHFUNCTION issues). (cmb)
+
+- Date:
+  . Added DateTime[Immutable]::createFromTimestamp. (Marc Bennewitz)
+  . Added DateTime[Immutable]::[get|set]Microsecond. (Marc Bennewitz)
+  . Constants SUNFUNCS_RET_TIMESTAMP, SUNFUNCS_RET_STRING, and SUNFUNCS_RET_DOUBLE
+    are now deprecated. (Jorg Sowa)
+  . Fixed bug GH-13773 (DatePeriod not taking into account microseconds for end
+    date). (Mark Bennewitz, Derick)
+
+- DBA:
+  . Passing null or false to dba_key_split() is deprecated. (Grigias)
+
+- Debugging:
+  . Fixed bug GH-15923 (GDB: Python Exception <class 'TypeError'>:
+    exceptions must derive from BaseException). (nielsdos)
+
+- DOM:
+  . Added DOMNode::compareDocumentPosition(). (nielsdos)
+  . Implement #53655 (Improve speed of DOMNode::C14N() on large XML documents).
+    (nielsdos)
+  . Fix cloning attribute with namespace disappearing namespace. (nielsdos)
+  . Implement DOM HTML5 parsing and serialization RFC. (nielsdos)
+  . Fix DOMElement->prefix with empty string creates bogus prefix. (nielsdos)
+  . Handle OOM more consistently. (nielsdos)
+  . Implemented "Improve callbacks in ext/dom and ext/xsl" RFC. (nielsdos)
+  . Added DOMXPath::quote() static method. (divinity76)
+  . Implemented opt-in ext/dom spec compliance RFC. (nielsdos)
+  . Fixed bug #79701 (getElementById does not correctly work with duplicate
+    definitions). (nielsdos)
+  . Implemented "New ext-dom features in PHP 8.4" RFC. (nielsdos)
+  . Fixed GH-14698 (segfault on DOM node dereference). (David Carlier)
+  . Improve support for template elements. (nielsdos)
+  . Fix trampoline leak in xpath callables. (nielsdos)
+  . Throw instead of silently failing when creating a too long text node in
+    (DOM)ParentNode and (DOM)ChildNode. (nielsdos)
+  . Fixed bug GH-15192 (Segmentation fault in dom extension
+    (html5_serializer)). (nielsdos)
+  . Deprecated DOM_PHP_ERR constant. (nielsdos)
+  . Removed DOMImplementation::getFeature(). (nielsdos)
+  . Fixed bug GH-15331 (Element::$substitutedNodeValue test failed). (nielsdos)
+  . Fixed bug GH-15570 (Segmentation fault (access null pointer) in
+    ext/dom/html5_serializer.c). (nielsdos)
+  . Fixed bug GH-13988 (Storing DOMElement consume 4 times more memory in
+    PHP 8.1 than in PHP 8.0). (nielsdos)
+  . Fix XML serializer errata: xmlns="" serialization should be allowed.
+    (nielsdos)
+  . Fixed bug GH-15910 (Assertion failure in ext/dom/element.c). (nielsdos)
+  . Fix unsetting DOM properties. (nielsdos)
+  . Fixed bug GH-16190 (Using reflection to call Dom\Node::__construct
+    causes assertion failure). (nielsdos)
+  . Fix edge-case in DOM parsing decoding. (nielsdos)
+  . Fixed bug GH-16465 (Heap buffer overflow in DOMNode->getElementByTagName).
+    (nielsdos)
+  . Fixed bug GH-16594 (Assertion failure in DOM -> before). (nielsdos)
+
+- Fileinfo:
+  . Update to libmagic 5.45. (nielsdos)
+  . Fixed bug #65106 (PHP fails to compile ext/fileinfo). (Guillaume Outters)
+
+- FPM:
+  . Implement GH-12385 (flush headers without body when calling flush()).
+    (nielsdos)
+  . Added DragonFlyBSD system to the list which set FPM_BACKLOG_DEFAULT
+    to SOMAXCONN. (David Carlier)
+  . /dev/poll events.mechanism for Solaris/Illumos setting had been retired.
+    (David Carlier)
+  . Added memory peak to the scoreboard / status page. (Flávio Heleno)
+
+- FTP:
+  . Removed the deprecated inet_ntoa call support. (David Carlier)
+  . Fixed bug #63937 (Upload speed 10 times slower with PHP). (nielsdos)
+
+- GD:
+  . Fix parameter numbers and missing alpha check for imagecolorset().
+    (Giovanni Giacobbi)
+  . imagepng/imagejpeg/imagewep/imageavif now throw an exception on
+    invalid quality parameter. (David Carlier)
+  . Check overflow/underflow for imagescale/imagefilter. (David Carlier)
+  . Added gdImageClone to bundled libgd. (David Carlier)
+
+- Gettext:
+  . bind_textdomain_codeset, textdomain and d(*)gettext functions
+    now throw an exception on empty domain. (David Carlier)
+
+- GMP:
+  . The GMP class is now final and cannot be extended anymore. (Girgias)
+  . RFC: Change GMP bool cast behavior. (Saki Takamachi)
+
+- Hash:
+  . Changed return type of hash_update() to true. (nielsdos)
+  . Added HashContext::__debugInfo(). (timwolla)
+  . Deprecated passing incorrect data types for options to ext/hash functions.
+    (nielsdos)
+  . Added SSE2 and SHA-NI implementation of SHA-256. (timwolla, Colin Percival,
+    Graham Percival)
+  . Fix GH-15384 (Build fails on Alpine / Musl for amd64). (timwolla)
+  . Fixed bug GH-15742 (php_hash_sha.h incompatible with C++). (cmb)
+
+- IMAP:
+  . Moved to PECL. (Derick Rethans)
+
+- Intl:
+  . Added IntlDateFormatter::PATTERN constant. (David Carlier)
+  . Fixed Numberformatter::__construct when the locale is invalid, now
+    throws an exception. (David Carlier)
+  . Added NumberFormatter::ROUND_TOWARD_ZERO and ::ROUND_AWAY_FROM_ZERO as
+    aliases for ::ROUND_DOWN and ::ROUND_UP. (Jorg Sowa)
+  . Added NumberFormatter::ROUND_HALFODD. (Ayesh Karunaratne)
+  . Added PROPERTY_IDS_UNARY_OPERATOR, PROPERTY_ID_COMPAT_MATH_START and
+    PROPERTY_ID_COMPAT_MATH_CONTINUE constants. (David Carlier)
+  . Added IntlDateFormatter::getIanaID/intltz_get_iana_id method/function.
+    (David Carlier)
+  . Set to C++17 standard for icu 74 and onwards. (David Carlier)
+  . resourcebundle_get(), ResourceBundle::get(), and accessing offsets on a
+    ResourceBundle object now throw:
+    - TypeError for invalid offset types
+    - ValueError for an empty string
+    - ValueError if the integer index does not fit in a signed 32 bit integer
+  . ResourceBundle::get() now has a tentative return type of:
+    ResourceBundle|array|string|int|null
+  . Added the new Grapheme function grapheme_str_split. (youkidearitai)
+  . Added IntlDateFormatter::parseToCalendar. (David Carlier)
+  . Added SpoofChecker::setAllowedChars to set unicode chars ranges.
+    (David Carlier)
+
+- LDAP:
+  . Added LDAP_OPT_X_TLS_PROTOCOL_MAX/LDAP_OPT_X_TLS_PROTOCOL_TLS1_3
+    constants. (StephenWall)
+
+- LibXML:
+  . Added LIBXML_RECOVER constant. (nielsdos)
+  . libxml_set_streams_context() now throws immediately on an invalid context
+    instead of at the use-site. (nielsdos)
+  . Added LIBXML_NO_XXE constant. (nielsdos)
+
+- MBString:
+  . Added mb_trim, mb_ltrim and mb_rtrim. (Yuya Hamada)
+  . Added mb_ucfirst and mb_lcfirst. (Yuya Hamada)
+  . Updated Unicode data tables to Unicode 15.1. (Ayesh Karunaratne)
+  . Fixed bug GH-15824 (mb_detect_encoding(): Argument $encodings contains
+    invalid encoding "UTF8"). (Yuya Hamada)
+  . Updated Unicode data tables to Unicode 16.0. (Ayesh Karunaratne)
+
+- Mysqli:
+  . The mysqli_ping() function and mysqli::ping() method are now deprecated,
+    as the reconnect feature was removed in PHP 8.2. (Kamil Tekiela)
+  . The mysqli_kill() function and mysqli::kill() method are now deprecated.
+    If this functionality is needed a SQL "KILL" command can be used instead.
+    (Kamil Tekiela)
+  . The mysqli_refresh() function and mysqli::refresh() method are now deprecated.
+    If this functionality is needed a SQL "FLUSH" command can be used instead.
+    (Kamil Tekiela)
+  . Passing explicitly the $mode parameter to mysqli_store_result() has been
+    deprecated. As the MYSQLI_STORE_RESULT_COPY_DATA constant was only used in
+    conjunction with this function it has also been deprecated. (Girgias)
+
+- MySQLnd:
+  . Fixed bug GH-13440 (PDO quote bottleneck). (nielsdos)
+  . Fixed bug GH-10599 (Apache crash on Windows when using a self-referencing
+    anonymous function inside a class with an active mysqli connection).
+    (nielsdos)
+
+- Opcache:
+  . Added large shared segments support for FreeBSD. (David Carlier)
+  . If JIT is enabled, PHP will now exit with a fatal error on startup in case
+    of JIT startup initialization issues. (danog)
+  . Increased the maximum value of opcache.interned_strings_buffer to 32767 on
+    64bit archs. (Arnaud)
+  . Fixed bug GH-13834 (Applying non-zero offset 36 to null pointer in
+    zend_jit.c). (nielsdos)
+  . Fixed bug GH-14361 (Deep recursion in zend_cfg.c causes segfault).
+    (nielsdos)
+  . Fixed bug GH-14873 (PHP 8.4 min function fails on typed integer).
+    (nielsdos)
+  . Fixed bug GH-15490 (Building of callgraph modifies preloaded symbols).
+    (ilutov)
+  . Fixed bug GH-15178 (Assertion in tracing JIT on hooks). (ilutov)
+  . Fixed bug GH-15657 (Segmentation fault in dasm_x86.h). (nielsdos)
+  . Added opcache_jit_blacklist() function. (Bob)
+  . Fixed bug GH-16009 (Segmentation fault with frameless functions and
+    undefined CVs). (nielsdos)
+  . Fixed bug GH-16186 (Assertion failure in Zend/zend_operators.c). (Arnaud)
+  . Fixed bug GH-16572 (Incorrect result with reflection in low-trigger JIT).
+    (nielsdos)
+  . Fixed GH-16839 (Error on building Opcache JIT for Windows ARM64). (cmb)
+
+- OpenSSL:
+  . Fixed bug #80269 (OpenSSL sets Subject wrong with extraattribs parameter).
+    (Jakub Zelenka)
+  . Implement request #48520 (openssl_csr_new - allow multiple values in DN).
+    (Jakub Zelenka)
+  . Introduced new serial_hex parameter to openssl_csr_sign. (Jakub Zelenka,
+    Florian Sowade)
+  . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
+    (Vincent Jardin)
+  . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)
+  . Added compile-time option --with-openssl-legacy-provider to enable legacy
+    provider. (Adam Saponara)
+  . Added support for Curve25519 + Curve448 based keys. (Manuel Mausz)
+  . Fixed bug GH-13343 (openssl_x509_parse should not allow omitted seconds in
+    UTCTimes). (Jakub Zelenka)
+  . Bumped minimum required OpenSSL version to 1.1.0. (cmb)
+  . Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2. (Remi)
+
+- Output:
+  . Clear output handler status flags during handler initialization. (haszi)
+  . Fixed bug with url_rewriter.hosts not used by output_add_rewrite_var().
+    (haszi)
+
+- PCNTL:
+  . Added pcntl_setns for Linux. (David Carlier)
+  . Added pcntl_getcpuaffinity/pcntl_setcpuaffinity. (David Carlier)
+  . Updated pcntl_get_signal_handler signal id upper limit to be
+    more in line with platforms limits. (David Carlier)
+  . Added pcntl_getcpu for Linux/FreeBSD/Solaris/Illumos. (David Carlier)
+  . Added pcntl_getqos_class/pcntl_setqos_class for macOs. (David Carlier)
+  . Added SIGCKPT/SIGCKPTEXIT constants for DragonFlyBSD. (David Carlier)
+  . Added FreeBSD's SIGTRAP handling to pcntl_siginfo_to_zval. (David Carlier)
+  . Added POSIX pcntl_waitid. (Vladimir Vrzić)
+  . Fixed bug GH-16769: (pcntl_sigwaitinfo aborts on signal value
+    as reference). (David Carlier)
+
+- PCRE:
+  . Upgrade bundled pcre2lib to version 10.43. (nielsdos)
+  . Add "/r" modifier. (Ayesh)
+  . Upgrade bundled pcre2lib to version 10.44. (Ayesh)
+  . Fixed GH-16189 (underflow on offset argument). (David Carlier)
+  . Fix UAF issues with PCRE after request shutdown. (nielsdos)
+
+- PDO:
+  . Fixed setAttribute and getAttribute. (SakiTakamachi)
+  . Implemented PDO driver-specific subclasses RFC. (danack, kocsismate)
+  . Added support for PDO driver-specific SQL parsers. (Matteo Beccati)
+  . Fixed bug GH-14792 (Compilation failure on pdo_* extensions).
+    (Peter Kokot)
+  . mysqlnd: support ER_CLIENT_INTERACTION_TIMEOUT. (Appla)
+  . The internal header php_pdo_int.h is no longer installed; it is not
+    supposed to be used by PDO drivers. (cmb)
+  . Fixed bug GH-16167 (Prevent mixing PDO sub-classes with different DSN).
+    (kocsismate)
+  . Fixed bug GH-16314 ("Pdo\Mysql object is uninitialized" when opening a
+    persistent connection). (kocsismate)
+
+- PDO_DBLIB:
+  . Fixed setAttribute and getAttribute. (SakiTakamachi)
+  . Added class Pdo\DbLib. (danack, kocsismate)
+
+- PDO_Firebird:
+  . Fixed setAttribute and getAttribute. (SakiTakamachi)
+  . Feature: Add transaction isolation level and mode settings to pdo_firebird.
+    (SakiTakamachi)
+  . Added class Pdo\Firebird. (danack, kocsismate)
+  . Added Pdo\Firebird::ATTR_API_VERSION. (SakiTakamachi)
+  . Added getApiVersion() and removed from getAttribute().
+    (SakiTakamachi)
+  . Supported Firebird 4.0 datatypes. (sim1984)
+  . Support proper formatting of time zone types. (sim1984)
+  . Fixed GH-15604 (Always make input parameters nullable). (sim1984)
+
+- PDO_MYSQL:
+  . Fixed setAttribute and getAttribute. (SakiTakamachi)
+  . Added class Pdo\Mysql. (danack, kocsismate)
+  . Added custom SQL parser. (Matteo Beccati)
+  . Fixed GH-15949 (PDO_MySQL not properly quoting PDO_PARAM_LOB binary
+    data). (mbeccati, lcobucci)
+
+- PDO_ODBC:
+  . Added class Pdo\Odbc. (danack, kocsismate)
+
+- PDO_PGSQL:
+  . Fixed GH-12423, DSN credentials being prioritized over the user/password
+    PDO constructor arguments. (SakiTakamachi)
+  . Fixed native float support with pdo_pgsql query results. (Yurunsoft)
+  . Added class Pdo\Pgsql. (danack, kocsismate)
+  . Retrieve the memory usage of the query result resource. (KentarouTakeda)
+  . Added Pdo\Pgsql::setNoticeCallBack method to receive DB notices.
+    (outtersg)
+  . Added custom SQL parser. (Matteo Beccati)
+  . Fixed GH-15986 (Double-free due to Pdo\Pgsql::setNoticeCallback()). (cmb,
+    nielsdos)
+  . Fixed GH-12940 (Using PQclosePrepared when available instead of
+    the DEALLOCATE command to free statements resources). (David Carlier)
+  . Remove PGSQL_ATTR_RESULT_MEMORY_SIZE constant as it is provided by
+    the new PDO Subclass as Pdo\Pgsql::ATTR_RESULT_MEMORY_SIZE. (Girgias)
+
+- PDO_SQLITE:
+  . Added class Pdo\Sqlite. (danack, kocsismate)
+  . Fixed bug #81227 (PDO::inTransaction reports false when in transaction).
+    (nielsdos)
+  . Added custom SQL parser. (Matteo Beccati)
+
+- PHPDBG:
+  . array out of bounds, stack overflow handled for segfault handler on windows.
+    (David Carlier)
+  . Fixed bug GH-16041 (Support stack limit in phpdbg). (Arnaud)
+
+- PGSQL:
+  . Added the possibility to have no conditions for pg_select. (OmarEmaraDev)
+  . Persistent connections support the PGSQL_CONNECT_FORCE_RENEW flag.
+    (David Carlier)
+  . Added pg_result_memory_size to get the query result memory usage.
+    (KentarouTakeda)
+  . Added pg_change_password to alter an user's password. (David Carlier)
+  . Added pg_put_copy_data/pg_put_copy_end to send COPY commands and signal
+    the end of the COPY. (David Carlier)
+  . Added pg_socket_poll to poll on the connection. (David Carlier)
+  . Added pg_jit to get infos on server JIT support. (David Carlier)
+  . Added pg_set_chunked_rows_size to fetch results per chunk. (David Carlier)
+  . pg_convert/pg_insert/pg_update/pg_delete ; regexes are now cached.
+    (David Carlier)
+
+- Phar:
+  . Fixed bug GH-12532 (PharData created from zip has incorrect timestamp).
+    (nielsdos)
+
+- POSIX:
+  . Added POSIX_SC_CHILD_MAX and POSIX_SC_CLK_TCK constants. (Jakub Zelenka)
+  . Updated posix_isatty to set the error number on file descriptors.
+    (David Carlier)
+
+- PSpell:
+  . Moved to PECL. (Derick Rethans)
+
+- Random:
+  . Fixed bug GH-15094 (php_random_default_engine() is not C++ conforming).
+    (cmb)
+  . lcg_value() is now deprecated. (timwolla)
+
+- Readline:
+  . Fixed readline_info, rl_line_buffer_length/rl_len globals on update.
+    (David Carlier)
+  . Fixed bug #51558 (Shared readline build fails). (Peter Kokot)
+  . Fixed UAF with readline_info(). (David Carlier)
+
+- Reflection:
+  . Implement GH-12908 (Show attribute name/class in ReflectionAttribute dump).
+    (nielsdos)
+  . Make ReflectionGenerator::getFunction() legal after generator termination.
+    (timwolla)
+  . Added ReflectionGenerator::isClosed(). (timwolla)
+  . Fixed bug GH-15718 (Segfault on ReflectionProperty::get{Hook,Hooks}() on
+    dynamic properties). (DanielEScherzer)
+  . Fixed bug GH-15694 (ReflectionProperty::isInitialized() is incorrect for
+    hooked properties). (ilutov)
+  . Add missing ReflectionProperty::hasHook[s]() methods. (ilutov)
+  . Add missing ReflectionProperty::isFinal() method. (ilutov)
+  . Fixed bug GH-16122 (The return value of ReflectionFunction::getNamespaceName()
+    and ReflectionFunction::inNamespace() for closures is incorrect). (timwolla)
+  . Fixed bug GH-16162 (No ReflectionProperty::IS_VIRTUAL) (DanielEScherzer)
+  . Fixed the name of the second parameter of
+    ReflectionClass::resetAsLazyGhost(). (Arnaud)
+
+- Session:
+  . INI settings session.sid_length and session.sid_bits_per_character are now
+    deprecated. (timwolla)
+  . Emit warnings for non-positive values of session.gc_divisor and negative values
+    of session.gc_probability. (Jorg Sowa)
+  . Fixed bug GH-16590 (UAF in session_encode()). (nielsdos)
+
+- SimpleXML:
+  . Fix signature of simplexml_import_dom(). (nielsdos)
+
+- SNMP:
+  . Removed the deprecated inet_ntoa call support. (David Carlier)
+
+- SOAP:
+  . Add support for clark notation for namespaces in class map. (lxShaDoWxl)
+  . Mitigate #51561 (SoapServer with a extented class and using sessions,
+    lost the setPersistence()). (nielsdos)
+  . Fixed bug #49278 (SoapClient::__getLastResponseHeaders returns NULL if
+    wsdl operation !has output). (nielsdos)
+  . Fixed bug #44383 (PHP DateTime not converted to xsd:datetime). (nielsdos)
+  . Fixed bug GH-11941 (soap with session persistence will silently fail when
+    "session" built as a shared object). (nielsdos)
+  . Passing an int to SoapServer::addFunction() is now deprecated.
+    If all PHP functions need to be provided flatten the array returned by
+    get_defined_functions(). (Girgias)
+  . The SOAP_FUNCTIONS_ALL constant is now deprecated. (Girgias)
+  . Fixed bug #61525 (SOAP functions require at least one space after HTTP
+    header colon). (nielsdos)
+  . Implement request #47317 (SoapServer::__getLastResponse()). (nielsdos)
+
+- Sockets:
+  . Removed the deprecated inet_ntoa call support. (David Carlier)
+  . Added the SO_EXECLUSIVEADDRUSE windows constant. (David Carlier)
+  . Added the SOCK_CONN_DGRAM/SOCK_DCCP netbsd constants. (David Carlier)
+  . Added multicast group support for ipv4 on FreeBSD. (jonathan@tangential.ca)
+  . Added the TCP_SYNCNT constant for Linux to set number of attempts to send
+    SYN packets from the client. (David Carlier)
+  . Added the SO_EXCLBIND constant for exclusive socket binding on illumos/solaris.
+    (David Carlier)
+  . Updated the socket_create_listen backlog argument default value to SOMAXCONN.
+    (David Carlier)
+  . Added the SO_NOSIGPIPE constant to control the generation of SIGPIPE for
+    macOs and FreeBSD. (David Carlier)
+  . Added SO_LINGER_SEC for macOs, true equivalent of SO_LINGER in other platforms.
+    (David Carlier)
+  . Add close-on-exec on socket created with socket_accept on unixes. (David Carlier)
+  . Added IP_PORTRANGE* constants for BSD systems to control ephemeral port
+    ranges. (David Carlier)
+  . Added SOCK_NONBLOCK/SOCK_CLOEXEC constants for socket_create and
+    socket_create_pair to apply O_NONBLOCK/O_CLOEXEC flags to the
+    newly created sockets. (David Carlier)
+  . Added SO_BINDTOIFINDEX to bind a socket to an interface index.
+    (David Carlier)
+
+- Sodium:
+  . Add support for AEGIS-128L and AEGIS-256. (jedisct1)
+  . Enable AES-GCM on aarch64 with the ARM crypto extensions. (jedisct1)
+
+- SPL:
+  . Implement SeekableIterator for SplObjectStorage. (nielsdos)
+  . The SplFixedArray::__wakeup() method has been deprecated as it implements
+    __serialize() and __unserialize() which need to be overwritten instead.
+    (TysonAndre)
+  . Passing a non-empty string for the $escape parameter of:
+    - SplFileObject::setCsvControl()
+    - SplFileObject::fputcsv()
+    - SplFileObject::fgetcsv()
+    is now deprecated. (Girgias)
+
+- Standard:
+  . Implement GH-12188 (Indication for the int size in phpinfo()). (timwolla)
+  . Partly fix GH-12143 (Incorrect round() result for 0.49999999999999994).
+    (timwolla)
+  . Fix GH-12252 (round(): Validate the rounding mode). (timwolla)
+  . Increase the default BCrypt cost to 12. (timwolla)
+  . Fixed bug GH-12592 (strcspn() odd behaviour with NUL bytes and empty mask).
+    (nielsdos)
+  . Removed the deprecated inet_ntoa call support. (David Carlier)
+  . Cast large floats that are within int range to int in number_format so
+    the precision is not lost. (Marc Bennewitz)
+  . Add support for 4 new rounding modes to the round() function. (Jorg Sowa)
+  . debug_zval_dump() now indicates whether an array is packed. (Max Semenik)
+  . Fix GH-12143 (Optimize round). (SakiTakamachi)
+  . Changed return type of long2ip to string from string|false. (Jorg Sowa)
+  . Fix GH-12143 (Extend the maximum precision round can handle by one digit).
+    (SakiTakamachi)
+  . Added the http_get_last_response_headers() and
+    http_clear_last_response_headers() that allows retrieving the same content
+    as the magic $http_response_header variable.
+  . Add php_base64_encode_ex() API. (Remi)
+  . Implemented "Raising zero to the power of negative number" RFC. (Jorg Sowa)
+  . Added array_find(), array_find_key(), array_all(), and array_any(). (josh)
+  . Change highlight_string() and print_r() return type to string|true. (Ayesh)
+  . Fix references in request_parse_body() options array. (nielsdos)
+  . Add RoundingMode enum. (timwolla, saki)
+  . Unserializing the uppercase 'S' tag is now deprecated. (timwolla)
+  . Enables crc32 auxiliary detection on OpenBSD. (David Carlier)
+  . Passing a non-empty string for the $escape parameter of:
+    - fputcsv()
+    - fgetcsv()
+    - str_getcsv()
+    is now deprecated. (Girgias)
+  . The str_getcsv() function now throws ValueErrors when the $separator and
+    $enclosure arguments are not one byte long, or if the $escape is not one
+    byte long or the empty string. This aligns the behaviour to be identical
+    to that of fputcsv() and fgetcsv(). (Girgias)
+  . php_uname() now throws ValueErrors on invalid inputs. (Girgias)
+  . The "allowed_classes" option for unserialize() now throws TypeErrors and
+    ValueErrors	if it is not an	array of class names. (Girgias)
+  . Implemented GH-15685 (improve proc_open error reporting on Windows). (cmb)
+  . Add support for backed enums in http_build_query(). (ilutov)
+  . Fixed bug GH-15982 (Assertion failure with array_find when references are
+    involved). (nielsdos)
+  . Fixed parameter names of fpow() to be identical to pow(). (Girgias)
+
+- Streams:
+  . Implemented GH-15155 (Stream context is lost when custom stream wrapper is
+    being filtered). (Quentin Dreyer)
+
+- Tidy:
+  . Failures in the constructor now throw exceptions rather than emitting
+    warnings and having a broken object. (nielsdos)
+  . Add tidyNode::getNextSibling() and tidyNode::getPreviousSibling().
+    (nielsdos)
+
+- Windows:
+  . Update the icon of the Windows executables, e.g. php.exe. (Ayesh,
+    Nurudin Imširović)
+  . Fixed bug GH-16199 (GREP_HEADER() is broken). (Peter Kokot)
+
+- XML:
+  . Added XML_OPTION_PARSE_HUGE parser option. (nielsdos)
+  . Fixed bug #81481 (xml_get_current_byte_index limited to 32-bit numbers on
+    64-bit builds). (nielsdos)
+  . The xml_set_object() function has been deprecated. (Girgias)
+  . Passing non-callable strings to the xml_set_*_handler() functions is now
+    deprecated. (Girgias)
+
+- XMLReader:
+  . Declares class constant types. (Ayesh)
+  . Add XMLReader::fromStream(), XMLReader::fromUri(), XMLReader::fromString(). (nielsdos)
+  . Fixed bug GH-15123 (var_dump doesn't actually work on XMLReader).
+    (nielsdos)
+
+- XMLWriter:
+  . Add XMLWriter::toStream(), XMLWriter::toUri(), XMLWriter::toMemory(). (nielsdos)
+
+- XSL:
+  . Implement request #64137 (XSLTProcessor::setParameter() should allow both
+    quotes to be used). (nielsdos)
+  . Implemented "Improve callbacks in ext/dom and ext/xsl" RFC. (nielsdos)
+  . Added XSLTProcessor::$maxTemplateDepth and XSLTProcessor::$maxTemplateVars.
+    (nielsdos)
+  . Fix trampoline leak in xpath callables. (nielsdos)
+
+- Zip:
+  . Added ZipArchive::ER_TRUNCATED_ZIP added in libzip 1.11. (Remi)
diff '--color=auto' -Naur a/run-tests.php b/run-tests.php
--- a/run-tests.php	2025-09-23 14:14:32.000000000 +0000
+++ b/run-tests.php	2025-10-25 03:24:13.178632343 +0000
@@ -648,6 +648,12 @@
         $environment['SKIP_ONLINE_TESTS'] = $online ? '0' : '1';
     }
 
+    if (!defined('STDIN') || !stream_isatty(STDIN)
+     || !defined('STDOUT') || !stream_isatty(STDOUT)
+     || !defined('STDERR') || !stream_isatty(STDERR)) {
+        $environment['SKIP_IO_CAPTURE_TESTS'] = '1';
+    }
+
     if ($selected_tests && count($test_files) === 0) {
         echo "No tests found.\n";
         return;
diff '--color=auto' -Naur a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
--- a/sapi/cli/php_cli_server.c	2025-09-23 14:14:32.000000000 +0000
+++ b/sapi/cli/php_cli_server.c	2025-10-25 03:24:13.179232776 +0000
@@ -2711,14 +2711,16 @@
 		struct sockaddr *sa = pemalloc(server->socklen, 1);
 		client_sock = accept(server->server_sock, sa, &socklen);
 		if (!ZEND_VALID_SOCKET(client_sock)) {
-			int err = php_socket_errno();
-			if (err != SOCK_EAGAIN && php_cli_server_log_level >= PHP_CLI_SERVER_LOG_ERROR) {
+			pefree(sa, 1);
+			if (php_socket_errno() == SOCK_EAGAIN) {
+				return SUCCESS;
+			}
+			if (php_cli_server_log_level >= PHP_CLI_SERVER_LOG_ERROR) {
 				char *errstr = php_socket_strerror(php_socket_errno(), NULL, 0);
 				php_cli_server_logf(PHP_CLI_SERVER_LOG_ERROR,
 					"Failed to accept a client (reason: %s)", errstr);
 				efree(errstr);
 			}
-			pefree(sa, 1);
 			return FAILURE;
 		}
 		if (SUCCESS != php_set_sock_blocking(client_sock, 0)) {
diff '--color=auto' -Naur a/sapi/cli/tests/php_cli_server_ipv4_error_message.phpt b/sapi/cli/tests/php_cli_server_ipv4_error_message.phpt
--- a/sapi/cli/tests/php_cli_server_ipv4_error_message.phpt	2025-09-23 14:14:32.000000000 +0000
+++ b/sapi/cli/tests/php_cli_server_ipv4_error_message.phpt	2025-10-25 03:24:13.179445646 +0000
@@ -2,6 +2,9 @@
 IPv4 address error message formatting
 --SKIPIF--
 <?php
+if (getenv("SKIP_ONLINE_TESTS")) {
+    die("skip online test");
+}
 if (substr(PHP_OS, 0, 3) == 'WIN') {
     die("skip not for Windows");
 }
diff '--color=auto' -Naur a/sapi/cli/tests/php_cli_server_pdeathsig.phpt b/sapi/cli/tests/php_cli_server_pdeathsig.phpt
--- a/sapi/cli/tests/php_cli_server_pdeathsig.phpt	2025-09-23 14:14:32.000000000 +0000
+++ b/sapi/cli/tests/php_cli_server_pdeathsig.phpt	2025-10-25 03:24:13.179508884 +0000
@@ -9,6 +9,7 @@
     die('skip PDEATHSIG is only supported on Linux and FreeBSD');
 }
 if (@file_exists('/.dockerenv')) die("skip Broken in Docker");
+if (!shell_exec("which pgrep")) die("skip Missing pgrep command");
 ?>
 --FILE--
 <?php
diff '--color=auto' -Naur a/sapi/litespeed/lsapilib.c b/sapi/litespeed/lsapilib.c
--- a/sapi/litespeed/lsapilib.c	2025-09-23 14:14:32.000000000 +0000
+++ b/sapi/litespeed/lsapilib.c	2025-10-25 03:24:13.179725027 +0000
@@ -635,8 +635,8 @@
 {
     char        achPeer[128];
     socklen_t   len = 128;
-    if ((getpeername(fd, (struct sockaddr *)achPeer, &len) != 0 )
-        && (errno == ENOTCONN || errno == ENOTSOCK))
+    if (( getpeername( fd, (struct sockaddr *)achPeer, &len ) != 0 )&&
+        ( errno == ENOTCONN ))
         return 0;
     else
         return 1;
diff '--color=auto' -Naur a/tests/security/error_log_special_values.phpt b/tests/security/error_log_special_values.phpt
--- a/tests/security/error_log_special_values.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/tests/security/error_log_special_values.phpt	2025-10-25 03:24:13.180031219 +0000
@@ -0,0 +1,13 @@
+--TEST--
+Setting error_log to special values with open_basedir enabled
+--INI--
+open_basedir=foo
+error_log=
+--FILE--
+<?php
+var_dump(ini_set("error_log", "syslog"));
+var_dump(ini_set("error_log", ""));
+?>
+--EXPECT--
+string(0) ""
+string(6) "syslog"
diff '--color=auto' -Naur a/Zend/Optimizer/sccp.c b/Zend/Optimizer/sccp.c
--- a/Zend/Optimizer/sccp.c	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/Optimizer/sccp.c	2025-10-25 03:24:13.147853795 +0000
@@ -838,9 +838,7 @@
 		zval_ptr_dtor(result);
 		zend_clear_exception();
 		retval = FAILURE;
-	}
-
-	if (EG(capture_warnings_during_sccp) > 1) {
+	} else if (EG(capture_warnings_during_sccp) > 1) {
 		zval_ptr_dtor(result);
 		retval = FAILURE;
 	}
diff '--color=auto' -Naur a/Zend/Optimizer/zend_func_info.h b/Zend/Optimizer/zend_func_info.h
--- a/Zend/Optimizer/zend_func_info.h	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/Optimizer/zend_func_info.h	2025-10-25 03:24:13.148121492 +0000
@@ -39,7 +39,7 @@
 #define ZEND_FUNC_JIT_ON_PROF_REQUEST      (1<<14) /* used by JIT */
 #define ZEND_FUNC_JIT_ON_HOT_COUNTERS      (1<<15) /* used by JIT */
 #define ZEND_FUNC_JIT_ON_HOT_TRACE         (1<<16) /* used by JIT */
-
+#define ZEND_FUNC_JITED                    (1<<17) /* used by JIT */
 
 typedef struct _zend_func_info zend_func_info;
 typedef struct _zend_call_info zend_call_info;
diff '--color=auto' -Naur a/Zend/tests/closures/gh19653_1.phpt b/Zend/tests/closures/gh19653_1.phpt
--- a/Zend/tests/closures/gh19653_1.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/Zend/tests/closures/gh19653_1.phpt	2025-10-25 03:24:13.148223809 +0000
@@ -0,0 +1,27 @@
+--TEST--
+GH-19653 (Closure named argument unpacking between temporary closures can cause a crash)
+--CREDITS--
+ivan-u7n
+--FILE--
+<?php
+
+function func1(string $a1 = 'a1', string $a2 = 'a2', string $a3 = 'a3') {
+	echo __FUNCTION__ . "() a1=$a1 a2=$a2 a3=$a3\n";
+}
+
+function usage1(?Closure $func1 = null) {
+	echo __FUNCTION__ . "() ";
+	($func1 ?? func1(...))(a3: 'm3+');
+}
+usage1();
+
+$func1 = function (string ...$args) {
+	echo "[function] ";
+	func1(...$args, a2: 'm2+');
+};
+usage1(func1: $func1);
+
+?>
+--EXPECT--
+usage1() func1() a1=a1 a2=a2 a3=m3+
+usage1() [function] func1() a1=a1 a2=m2+ a3=m3+
diff '--color=auto' -Naur a/Zend/tests/closures/gh19653_2.phpt b/Zend/tests/closures/gh19653_2.phpt
--- a/Zend/tests/closures/gh19653_2.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/Zend/tests/closures/gh19653_2.phpt	2025-10-25 03:24:13.148293464 +0000
@@ -0,0 +1,23 @@
+--TEST--
+GH-19653 (Closure named argument unpacking between temporary closures can cause a crash) - eval variation
+--CREDITS--
+arnaud-lb
+--FILE--
+<?php
+
+function usage1(Closure $c) {
+    $c(a: 1);
+}
+
+usage1(eval('return function($a) { var_dump($a); };'));
+usage1(eval('return function($b) { var_dump($b); };'));
+
+?>
+--EXPECTF--
+int(1)
+
+Fatal error: Uncaught Error: Unknown named parameter $a in %s:%d
+Stack trace:
+#0 %s(%d): usage1(Object(Closure))
+#1 {main}
+  thrown in %s on line %d
diff '--color=auto' -Naur a/Zend/tests/gh19839.phpt b/Zend/tests/gh19839.phpt
--- a/Zend/tests/gh19839.phpt	1970-01-01 00:00:00.000000000 +0000
+++ b/Zend/tests/gh19839.phpt	2025-10-25 03:24:13.148390708 +0000
@@ -0,0 +1,18 @@
+--TEST--
+GH-19839: Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array
+--FILE--
+<?php
+
+const X = 'x';
+
+$x = null;
+unset(${X});
+
+$a = $GLOBALS;
+sort($a);
+serialize($a);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
diff '--color=auto' -Naur a/Zend/zend_API.c b/Zend/zend_API.c
--- a/Zend/zend_API.c	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/zend_API.c	2025-10-25 03:24:13.148865066 +0000
@@ -1761,6 +1761,14 @@
 				property_info &&
 				(property_info->flags & ZEND_ACC_STATIC) == 0) {
 				zval *slot = OBJ_PROP(object, property_info->offset);
+				if (UNEXPECTED((property_info->flags & ZEND_ACC_READONLY) && !Z_ISUNDEF_P(slot))) {
+					if (Z_PROP_FLAG_P(slot) & IS_PROP_REINITABLE) {
+						Z_PROP_FLAG_P(slot) &= ~IS_PROP_REINITABLE;
+					} else {
+						zend_readonly_property_modification_error(property_info);
+						return;
+					}
+				}
 				zval_ptr_dtor(slot);
 				ZVAL_COPY_VALUE(slot, prop);
 				zval_add_ref(slot);
diff '--color=auto' -Naur a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
--- a/Zend/zend_execute_API.c	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/zend_execute_API.c	2025-10-25 03:24:13.149894913 +0000
@@ -1570,7 +1570,9 @@
 		return;
 	}
 #elif defined(ZEND_MAX_EXECUTION_TIMERS)
-	zend_max_execution_timer_settime(seconds);
+	if (seconds > 0) {
+		zend_max_execution_timer_settime(seconds);
+	}
 
 	if (reset_signals) {
 		sigset_t sigset;
@@ -1657,7 +1659,9 @@
 		tq_timer = NULL;
 	}
 #elif defined(ZEND_MAX_EXECUTION_TIMERS)
-	zend_max_execution_timer_settime(0);
+	if (EG(timeout_seconds)) {
+		zend_max_execution_timer_settime(0);
+	}
 #elif defined(HAVE_SETITIMER)
 	if (EG(timeout_seconds)) {
 		struct itimerval no_timeout;
diff '--color=auto' -Naur a/Zend/zend_execute.c b/Zend/zend_execute.c
--- a/Zend/zend_execute.c	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/zend_execute.c	2025-10-25 03:24:13.149458728 +0000
@@ -5250,7 +5250,12 @@
 
 static zend_always_inline uint32_t zend_get_arg_offset_by_name(
 		zend_function *fbc, zend_string *arg_name, void **cache_slot) {
-	if (EXPECTED(*cache_slot == fbc)) {
+	/* Due to closures, the `fbc` address isn't unique if the memory address is reused.
+	 * The argument info will be however and uniquely positions the arguments.
+	 * We do support NULL arg_info, so we have to distinguish that from an uninitialized cache slot. */
+	void *unique_id = (void *) ((uintptr_t) fbc->common.arg_info | 1);
+
+	if (EXPECTED(*cache_slot == unique_id)) {
 		return *(uintptr_t *)(cache_slot + 1);
 	}
 
@@ -5259,10 +5264,12 @@
 	if (EXPECTED(fbc->type == ZEND_USER_FUNCTION)
 			|| EXPECTED(fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO)) {
 		for (uint32_t i = 0; i < num_args; i++) {
-			zend_arg_info *arg_info = &fbc->op_array.arg_info[i];
+			zend_arg_info *arg_info = &fbc->common.arg_info[i];
 			if (zend_string_equals(arg_name, arg_info->name)) {
-				*cache_slot = fbc;
-				*(uintptr_t *)(cache_slot + 1) = i;
+				if (fbc->type == ZEND_USER_FUNCTION && (!fbc->op_array.refcount || !(fbc->op_array.fn_flags & ZEND_ACC_CLOSURE))) {
+					*cache_slot = unique_id;
+					*(uintptr_t *)(cache_slot + 1) = i;
+				}
 				return i;
 			}
 		}
@@ -5271,7 +5278,7 @@
 			zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
 			size_t len = strlen(arg_info->name);
 			if (zend_string_equals_cstr(arg_name, arg_info->name, len)) {
-				*cache_slot = fbc;
+				*cache_slot = unique_id;
 				*(uintptr_t *)(cache_slot + 1) = i;
 				return i;
 			}
@@ -5279,8 +5286,13 @@
 	}
 
 	if (fbc->common.fn_flags & ZEND_ACC_VARIADIC) {
-		*cache_slot = fbc;
-		*(uintptr_t *)(cache_slot + 1) = fbc->common.num_args;
+		if ((fbc->type == ZEND_USER_FUNCTION
+		  && (!fbc->op_array.refcount || !(fbc->op_array.fn_flags & ZEND_ACC_CLOSURE)))
+		 || (fbc->type == ZEND_INTERNAL_FUNCTION
+		  && !(fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO))) {
+			*cache_slot = unique_id;
+			*(uintptr_t *)(cache_slot + 1) = fbc->common.num_args;
+		}
 		return fbc->common.num_args;
 	}
 
diff '--color=auto' -Naur a/Zend/zend.h b/Zend/zend.h
--- a/Zend/zend.h	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/zend.h	2025-10-25 03:26:04.482894039 +0000
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "4.4.13"
+#define ZEND_VERSION "4.4.14"
 
 #define ZEND_ENGINE_3
 
diff '--color=auto' -Naur a/Zend/zend_hash.c b/Zend/zend_hash.c
--- a/Zend/zend_hash.c	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/zend_hash.c	2025-10-25 03:24:13.150332580 +0000
@@ -2465,6 +2465,7 @@
 		target->nTableSize = HT_MIN_SIZE;
 		HT_SET_DATA_ADDR(target, &uninitialized_bucket);
 	} else if (GC_FLAGS(source) & IS_ARRAY_IMMUTABLE) {
+		ZEND_ASSERT(!(HT_FLAGS(source) & HASH_FLAG_HAS_EMPTY_IND));
 		HT_FLAGS(target) = HT_FLAGS(source) & HASH_FLAG_MASK;
 		target->nTableMask = source->nTableMask;
 		target->nNumUsed = source->nNumUsed;
@@ -2481,6 +2482,7 @@
 			memcpy(HT_GET_DATA_ADDR(target), HT_GET_DATA_ADDR(source), HT_USED_SIZE(source));
 		}
 	} else if (HT_IS_PACKED(source)) {
+		ZEND_ASSERT(!(HT_FLAGS(source) & HASH_FLAG_HAS_EMPTY_IND));
 		HT_FLAGS(target) = HT_FLAGS(source) & HASH_FLAG_MASK;
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = source->nNumUsed;
@@ -2500,7 +2502,8 @@
 			zend_array_dup_packed_elements(source, target, 1);
 		}
 	} else {
-		HT_FLAGS(target) = HT_FLAGS(source) & HASH_FLAG_MASK;
+		/* Indirects are removed during duplication, remove HASH_FLAG_HAS_EMPTY_IND accordingly. */
+		HT_FLAGS(target) = HT_FLAGS(source) & (HASH_FLAG_MASK & ~HASH_FLAG_HAS_EMPTY_IND);
 		target->nTableMask = source->nTableMask;
 		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer =
diff '--color=auto' -Naur a/Zend/zend.h.orig b/Zend/zend.h.orig
--- a/Zend/zend.h.orig	1970-01-01 00:00:00.000000000 +0000
+++ b/Zend/zend.h.orig	2025-09-23 14:14:32.000000000 +0000
@@ -0,0 +1,456 @@
+/*
+   +----------------------------------------------------------------------+
+   | Zend Engine                                                          |
+   +----------------------------------------------------------------------+
+   | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
+   +----------------------------------------------------------------------+
+   | This source file is subject to version 2.00 of the Zend license,     |
+   | that is bundled with this package in the file LICENSE, and is        |
+   | available through the world-wide-web at the following url:           |
+   | http://www.zend.com/license/2_00.txt.                                |
+   | If you did not receive a copy of the Zend license and are unable to  |
+   | obtain it through the world-wide-web, please send a note to          |
+   | license@zend.com so we can mail you a copy immediately.              |
+   +----------------------------------------------------------------------+
+   | Authors: Andi Gutmans <andi@php.net>                                 |
+   |          Zeev Suraski <zeev@php.net>                                 |
+   +----------------------------------------------------------------------+
+*/
+
+#ifndef ZEND_H
+#define ZEND_H
+
+#define ZEND_VERSION "4.4.13"
+
+#define ZEND_ENGINE_3
+
+#include "zend_types.h"
+#include "zend_map_ptr.h"
+#include "zend_errors.h"
+#include "zend_alloc.h"
+#include "zend_llist.h"
+#include "zend_string.h"
+#include "zend_hash.h"
+#include "zend_ast.h"
+#include "zend_gc.h"
+#include "zend_variables.h"
+#include "zend_iterators.h"
+#include "zend_stream.h"
+#include "zend_smart_str_public.h"
+#include "zend_smart_string_public.h"
+#include "zend_signal.h"
+#include "zend_max_execution_timer.h"
+
+#define zend_sprintf sprintf
+
+#define HANDLE_BLOCK_INTERRUPTIONS()		ZEND_SIGNAL_BLOCK_INTERRUPTIONS()
+#define HANDLE_UNBLOCK_INTERRUPTIONS()		ZEND_SIGNAL_UNBLOCK_INTERRUPTIONS()
+
+#define INTERNAL_FUNCTION_PARAMETERS zend_execute_data *execute_data, zval *return_value
+#define INTERNAL_FUNCTION_PARAM_PASSTHRU execute_data, return_value
+
+#define USED_RET() \
+	(!EX(prev_execute_data) || \
+	 !ZEND_USER_CODE(EX(prev_execute_data)->func->common.type) || \
+	 (EX(prev_execute_data)->opline->result_type != IS_UNUSED))
+
+#ifdef ZEND_ENABLE_STATIC_TSRMLS_CACHE
+#define ZEND_TSRMG TSRMG_STATIC
+#define ZEND_TSRMG_FAST TSRMG_FAST_STATIC
+#define ZEND_TSRMLS_CACHE_EXTERN() TSRMLS_CACHE_EXTERN()
+#define ZEND_TSRMLS_CACHE_DEFINE() TSRMLS_CACHE_DEFINE()
+#define ZEND_TSRMLS_CACHE_UPDATE() TSRMLS_CACHE_UPDATE()
+#define ZEND_TSRMLS_CACHE TSRMLS_CACHE
+#else
+#define ZEND_TSRMG TSRMG
+#define ZEND_TSRMG_FAST TSRMG_FAST
+#define ZEND_TSRMLS_CACHE_EXTERN()
+#define ZEND_TSRMLS_CACHE_DEFINE()
+#define ZEND_TSRMLS_CACHE_UPDATE()
+#define ZEND_TSRMLS_CACHE
+#endif
+
+#ifndef ZEND_COMPILE_DL_EXT
+TSRMLS_MAIN_CACHE_EXTERN()
+#else
+ZEND_TSRMLS_CACHE_EXTERN()
+#endif
+
+struct _zend_serialize_data;
+struct _zend_unserialize_data;
+
+typedef struct _zend_serialize_data zend_serialize_data;
+typedef struct _zend_unserialize_data zend_unserialize_data;
+
+typedef struct _zend_class_name {
+	zend_string *name;
+	zend_string *lc_name;
+} zend_class_name;
+
+typedef struct _zend_trait_method_reference {
+	zend_string *method_name;
+	zend_string *class_name;
+} zend_trait_method_reference;
+
+typedef struct _zend_trait_precedence {
+	zend_trait_method_reference trait_method;
+	uint32_t num_excludes;
+	zend_string *exclude_class_names[1];
+} zend_trait_precedence;
+
+typedef struct _zend_trait_alias {
+	zend_trait_method_reference trait_method;
+
+	/**
+	* name for method to be added
+	*/
+	zend_string *alias;
+
+	/**
+	* modifiers to be set on trait method
+	*/
+	uint32_t modifiers;
+} zend_trait_alias;
+
+typedef struct _zend_class_mutable_data {
+	zval      *default_properties_table;
+	HashTable *constants_table;
+	uint32_t   ce_flags;
+	HashTable *backed_enum_table;
+} zend_class_mutable_data;
+
+typedef struct _zend_class_dependency {
+	zend_string      *name;
+	zend_class_entry *ce;
+} zend_class_dependency;
+
+typedef struct _zend_inheritance_cache_entry zend_inheritance_cache_entry;
+
+typedef struct _zend_error_info {
+	int type;
+	uint32_t lineno;
+	zend_string *filename;
+	zend_string *message;
+} zend_error_info;
+
+struct _zend_inheritance_cache_entry {
+	zend_inheritance_cache_entry *next;
+	zend_class_entry             *ce;
+	zend_class_entry             *parent;
+	zend_class_dependency        *dependencies;
+	uint32_t                      dependencies_count;
+	uint32_t                      num_warnings;
+	zend_error_info             **warnings;
+	zend_class_entry             *traits_and_interfaces[1];
+};
+
+struct _zend_class_entry {
+	char type;
+	zend_string *name;
+	/* class_entry or string depending on ZEND_ACC_LINKED */
+	union {
+		zend_class_entry *parent;
+		zend_string *parent_name;
+	};
+	int refcount;
+	uint32_t ce_flags;
+
+	int default_properties_count;
+	int default_static_members_count;
+	zval *default_properties_table;
+	zval *default_static_members_table;
+	ZEND_MAP_PTR_DEF(zval *, static_members_table);
+	HashTable function_table;
+	HashTable properties_info;
+	HashTable constants_table;
+
+	ZEND_MAP_PTR_DEF(zend_class_mutable_data*, mutable_data);
+	zend_inheritance_cache_entry *inheritance_cache;
+
+	struct _zend_property_info **properties_info_table;
+
+	zend_function *constructor;
+	zend_function *destructor;
+	zend_function *clone;
+	zend_function *__get;
+	zend_function *__set;
+	zend_function *__unset;
+	zend_function *__isset;
+	zend_function *__call;
+	zend_function *__callstatic;
+	zend_function *__tostring;
+	zend_function *__debugInfo;
+	zend_function *__serialize;
+	zend_function *__unserialize;
+
+	const zend_object_handlers *default_object_handlers;
+
+	/* allocated only if class implements Iterator or IteratorAggregate interface */
+	zend_class_iterator_funcs *iterator_funcs_ptr;
+	/* allocated only if class implements ArrayAccess interface */
+	zend_class_arrayaccess_funcs *arrayaccess_funcs_ptr;
+
+	/* handlers */
+	union {
+		zend_object* (*create_object)(zend_class_entry *class_type);
+		int (*interface_gets_implemented)(zend_class_entry *iface, zend_class_entry *class_type); /* a class implements this interface */
+	};
+	zend_object_iterator *(*get_iterator)(zend_class_entry *ce, zval *object, int by_ref);
+	zend_function *(*get_static_method)(zend_class_entry *ce, zend_string* method);
+
+	/* serializer callbacks */
+	int (*serialize)(zval *object, unsigned char **buffer, size_t *buf_len, zend_serialize_data *data);
+	int (*unserialize)(zval *object, zend_class_entry *ce, const unsigned char *buf, size_t buf_len, zend_unserialize_data *data);
+
+	uint32_t num_interfaces;
+	uint32_t num_traits;
+	uint32_t num_hooked_props;
+	uint32_t num_hooked_prop_variance_checks;
+
+	/* class_entry or string(s) depending on ZEND_ACC_LINKED */
+	union {
+		zend_class_entry **interfaces;
+		zend_class_name *interface_names;
+	};
+
+	zend_class_name *trait_names;
+	zend_trait_alias **trait_aliases;
+	zend_trait_precedence **trait_precedences;
+	HashTable *attributes;
+
+	uint32_t enum_backing_type;
+	HashTable *backed_enum_table;
+
+	zend_string *doc_comment;
+
+	union {
+		struct {
+			zend_string *filename;
+			uint32_t line_start;
+			uint32_t line_end;
+		} user;
+		struct {
+			const struct _zend_function_entry *builtin_functions;
+			struct _zend_module_entry *module;
+		} internal;
+	} info;
+};
+
+typedef union {
+	zend_max_align_t align;
+	uint64_t opaque[5];
+} zend_random_bytes_insecure_state;
+
+typedef struct _zend_utility_functions {
+	void (*error_function)(int type, zend_string *error_filename, const uint32_t error_lineno, zend_string *message);
+	size_t (*printf_function)(const char *format, ...) ZEND_ATTRIBUTE_PTR_FORMAT(printf, 1, 2);
+	size_t (*write_function)(const char *str, size_t str_length);
+	FILE *(*fopen_function)(zend_string *filename, zend_string **opened_path);
+	void (*message_handler)(zend_long message, const void *data);
+	zval *(*get_configuration_directive)(zend_string *name);
+	void (*ticks_function)(int ticks);
+	void (*on_timeout)(int seconds);
+	zend_result (*stream_open_function)(zend_file_handle *handle);
+	void (*printf_to_smart_string_function)(smart_string *buf, const char *format, va_list ap);
+	void (*printf_to_smart_str_function)(smart_str *buf, const char *format, va_list ap);
+	char *(*getenv_function)(const char *name, size_t name_len);
+	zend_string *(*resolve_path_function)(zend_string *filename);
+	zend_result (*random_bytes_function)(void *bytes, size_t size, char *errstr, size_t errstr_size);
+	void (*random_bytes_insecure_function)(zend_random_bytes_insecure_state *state, void *bytes, size_t size);
+} zend_utility_functions;
+
+typedef struct _zend_utility_values {
+	bool html_errors;
+} zend_utility_values;
+
+typedef size_t (*zend_write_func_t)(const char *str, size_t str_length);
+
+#define zend_bailout()		_zend_bailout(__FILE__, __LINE__)
+
+#define zend_try												\
+	{															\
+		JMP_BUF *__orig_bailout = EG(bailout);					\
+		JMP_BUF __bailout;										\
+																\
+		EG(bailout) = &__bailout;								\
+		if (SETJMP(__bailout)==0) {
+#define zend_catch												\
+		} else {												\
+			EG(bailout) = __orig_bailout;
+#define zend_end_try()											\
+		}														\
+		EG(bailout) = __orig_bailout;							\
+	}
+#define zend_first_try		EG(bailout)=NULL;	zend_try
+
+BEGIN_EXTERN_C()
+void zend_startup(zend_utility_functions *utility_functions);
+void zend_shutdown(void);
+void zend_register_standard_ini_entries(void);
+zend_result zend_post_startup(void);
+void zend_set_utility_values(zend_utility_values *utility_values);
+void zend_unload_modules(void);
+
+ZEND_API ZEND_COLD ZEND_NORETURN void _zend_bailout(const char *filename, uint32_t lineno);
+ZEND_API size_t zend_get_page_size(void);
+
+ZEND_API size_t zend_vspprintf(char **pbuf, size_t max_len, const char *format, va_list ap);
+ZEND_API size_t zend_spprintf(char **message, size_t max_len, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 3, 4);
+ZEND_API zend_string *zend_vstrpprintf(size_t max_len, const char *format, va_list ap);
+ZEND_API zend_string *zend_strpprintf(size_t max_len, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
+
+/* Same as zend_spprintf and zend_strpprintf, without checking of format validity.
+ * For use with custom printf specifiers such as %H. */
+ZEND_API size_t zend_spprintf_unchecked(char **message, size_t max_len, const char *format, ...);
+ZEND_API zend_string *zend_strpprintf_unchecked(size_t max_len, const char *format, ...);
+
+ZEND_API const char *get_zend_version(void);
+ZEND_API bool zend_make_printable_zval(zval *expr, zval *expr_copy);
+ZEND_API size_t zend_print_zval(zval *expr, int indent);
+ZEND_API void zend_print_zval_r(zval *expr, int indent);
+ZEND_API zend_string *zend_print_zval_r_to_str(zval *expr, int indent);
+ZEND_API void zend_print_flat_zval_r(zval *expr);
+void zend_print_flat_zval_r_to_buf(smart_str *str, zval *expr);
+
+static zend_always_inline size_t zend_print_variable(zval *var) {
+	return zend_print_zval(var, 0);
+}
+
+ZEND_API ZEND_COLD void zend_output_debug_string(bool trigger_break, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
+
+ZEND_API void zend_activate(void);
+ZEND_API void zend_deactivate(void);
+ZEND_API void zend_call_destructors(void);
+ZEND_API void zend_activate_modules(void);
+ZEND_API void zend_deactivate_modules(void);
+ZEND_API void zend_post_deactivate_modules(void);
+
+ZEND_API void free_estring(char **str_p);
+
+END_EXTERN_C()
+
+/* output support */
+#define ZEND_WRITE(str, str_len)		zend_write((str), (str_len))
+#define ZEND_WRITE_EX(str, str_len)		write_func((str), (str_len))
+#define ZEND_PUTS(str)					zend_write((str), strlen((str)))
+#define ZEND_PUTS_EX(str)				write_func((str), strlen((str)))
+#define ZEND_PUTC(c)					zend_write(&(c), 1)
+
+BEGIN_EXTERN_C()
+extern ZEND_API size_t (*zend_printf)(const char *format, ...) ZEND_ATTRIBUTE_PTR_FORMAT(printf, 1, 2);
+extern ZEND_API zend_write_func_t zend_write;
+extern ZEND_API FILE *(*zend_fopen)(zend_string *filename, zend_string **opened_path);
+extern ZEND_API void (*zend_ticks_function)(int ticks);
+
+/* Called by the VM in certain places like at the loop header, user function
+ * entry, and after internal function calls, if EG(vm_interrupt) has been set.
+ *
+ * If this is used to switch the EG(current_execute_data), such as implementing
+ * a coroutine scheduler, then it needs to check the top frame to see if it's
+ * an internal function. If an internal function is on top, then the frame
+ * shouldn't be switched away.
+ *
+ * Prior to PHP 8.0, this check was not necessary. In PHP 8.0,
+ * zend_call_function started calling zend_interrupt_function, and in 8.4 the
+ * DO_*CALL* opcodes started calling the zend_interrupt_function while the
+ * internal frame is still on top.
+ */
+extern ZEND_API void (*zend_interrupt_function)(zend_execute_data *execute_data);
+
+extern ZEND_API void (*zend_error_cb)(int type, zend_string *error_filename, const uint32_t error_lineno, zend_string *message);
+extern ZEND_API void (*zend_on_timeout)(int seconds);
+extern ZEND_API zend_result (*zend_stream_open_function)(zend_file_handle *handle);
+extern void (*zend_printf_to_smart_string)(smart_string *buf, const char *format, va_list ap);
+extern void (*zend_printf_to_smart_str)(smart_str *buf, const char *format, va_list ap);
+extern ZEND_API char *(*zend_getenv)(const char *name, size_t name_len);
+extern ZEND_API zend_string *(*zend_resolve_path)(zend_string *filename);
+/* Generate 'size' random bytes into 'bytes' with the OS CSPRNG. */
+extern ZEND_ATTRIBUTE_NONNULL ZEND_API zend_result (*zend_random_bytes)(
+		void *bytes, size_t size, char *errstr, size_t errstr_size);
+/* Generate 'size' random bytes into 'bytes' with a general purpose PRNG (not
+ * crypto safe). 'state' must be zeroed before the first call and can be reused.
+ */
+extern ZEND_ATTRIBUTE_NONNULL ZEND_API void (*zend_random_bytes_insecure)(
+		zend_random_bytes_insecure_state *state, void *bytes, size_t size);
+
+/* These two callbacks are especially for opcache */
+extern ZEND_API zend_result (*zend_post_startup_cb)(void);
+extern ZEND_API void (*zend_post_shutdown_cb)(void);
+
+extern ZEND_API void (*zend_accel_schedule_restart_hook)(int reason);
+
+ZEND_API ZEND_COLD void zend_error(int type, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_noreturn(int type, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_noreturn_unchecked(int type, const char *format, ...);
+/* For custom format specifiers like H */
+ZEND_API ZEND_COLD void zend_error_unchecked(int type, const char *format, ...);
+/* If filename is NULL the default filename is used. */
+ZEND_API ZEND_COLD void zend_error_at(int type, zend_string *filename, uint32_t lineno, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 4, 5);
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_error_at_noreturn(int type, zend_string *filename, uint32_t lineno, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 4, 5);
+ZEND_API ZEND_COLD void zend_error_zstr(int type, zend_string *message);
+ZEND_API ZEND_COLD void zend_error_zstr_at(int type, zend_string *filename, uint32_t lineno, zend_string *message);
+
+ZEND_API ZEND_COLD void zend_throw_error(zend_class_entry *exception_ce, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
+ZEND_API ZEND_COLD void zend_type_error(const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 1, 2);
+ZEND_API ZEND_COLD void zend_argument_count_error(const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 1, 2);
+ZEND_API ZEND_COLD void zend_value_error(const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 1, 2);
+/* type should be one of the BP_VAR_* constants, only special messages happen for isset/empty and unset */
+ZEND_API ZEND_COLD void zend_illegal_container_offset(const zend_string *container, const zval *offset, int type);
+
+ZEND_COLD void zenderror(const char *error);
+
+/* For internal C errors */
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_strerror_noreturn(int type, int errn, const char *message);
+
+/* The following #define is used for code duality in PHP for Engine 1 & 2 */
+#define ZEND_STANDARD_CLASS_DEF_PTR zend_standard_class_def
+extern ZEND_API zend_class_entry *zend_standard_class_def;
+extern ZEND_API zend_utility_values zend_uv;
+
+/* If DTrace is available and enabled */
+extern ZEND_API bool zend_dtrace_enabled;
+END_EXTERN_C()
+
+#define ZEND_UV(name) (zend_uv.name)
+
+BEGIN_EXTERN_C()
+ZEND_API void zend_message_dispatcher(zend_long message, const void *data);
+
+ZEND_API zval *zend_get_configuration_directive(zend_string *name);
+END_EXTERN_C()
+
+/* Messages for applications of Zend */
+#define ZMSG_FAILED_INCLUDE_FOPEN		1L
+#define ZMSG_FAILED_REQUIRE_FOPEN		2L
+#define ZMSG_FAILED_HIGHLIGHT_FOPEN		3L
+#define ZMSG_MEMORY_LEAK_DETECTED		4L
+#define ZMSG_MEMORY_LEAK_REPEATED		5L
+#define ZMSG_LOG_SCRIPT_NAME			6L
+#define ZMSG_MEMORY_LEAKS_GRAND_TOTAL	7L
+
+typedef enum {
+	EH_NORMAL = 0,
+	EH_THROW
+} zend_error_handling_t;
+
+typedef struct {
+	zend_error_handling_t  handling;
+	zend_class_entry       *exception;
+} zend_error_handling;
+
+BEGIN_EXTERN_C()
+ZEND_API void zend_save_error_handling(zend_error_handling *current);
+ZEND_API void zend_replace_error_handling(zend_error_handling_t error_handling, zend_class_entry *exception_class, zend_error_handling *current);
+ZEND_API void zend_restore_error_handling(zend_error_handling *saved);
+ZEND_API void zend_begin_record_errors(void);
+ZEND_API void zend_emit_recorded_errors(void);
+ZEND_API void zend_free_recorded_errors(void);
+END_EXTERN_C()
+
+#define DEBUG_BACKTRACE_PROVIDE_OBJECT (1<<0)
+#define DEBUG_BACKTRACE_IGNORE_ARGS    (1<<1)
+
+#include "zend_object_handlers.h"
+#include "zend_operators.h"
+
+#endif /* ZEND_H */
diff '--color=auto' -Naur a/Zend/zend_string.c b/Zend/zend_string.c
--- a/Zend/zend_string.c	2025-09-23 14:14:32.000000000 +0000
+++ b/Zend/zend_string.c	2025-10-25 03:24:13.150745703 +0000
@@ -505,8 +505,10 @@
 	return res;
 }
 
-/* strlcpy and strlcat are not intercepted by msan, so we need to do it ourselves. */
-#if __has_feature(memory_sanitizer)
+/* strlcpy and strlcat are not always intercepted by msan, so we need to do it
+ * ourselves. Apply a simple heuristic to determine the platforms that need it.
+ * See https://github.com/php/php-src/issues/20002. */
+#if __has_feature(memory_sanitizer) && !defined(__FreeBSD__) && !defined(__NetBSD__) && !defined(__APPLE__)
 static size_t (*libc_strlcpy)(char *__restrict, const char *__restrict, size_t);
 size_t strlcpy(char *__restrict dest, const char *__restrict src, size_t n)
 {
