Commit ca4561cda68 for php.net

commit ca4561cda685da615f9d1e1a6db0c8251bb20428
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sat Jun 20 21:05:06 2026 -0400

    ext/com_dotnet: release the held IUnknown in com_get_active_object()

    The cleanup block guarded on `unk` but released `obj`. On a successful
    GetActiveObject() this released the IDispatch proxy twice and leaked the
    IUnknown; on a QueryInterface failure `obj` is still NULL while `unk` is
    live, so the same line released NULL through a NULL vtable and crashed
    instead of throwing. Release `unk` so each interface pointer is released
    exactly once and the failure path no longer crashes.

    Closes GH-22378

diff --git a/ext/com_dotnet/com_com.c b/ext/com_dotnet/com_com.c
index fd2d1ee9a43..cfc343405e0 100644
--- a/ext/com_dotnet/com_com.c
+++ b/ext/com_dotnet/com_com.c
@@ -321,7 +321,7 @@ PHP_FUNCTION(com_get_active_object)
 		IDispatch_Release(obj);
 	}
 	if (unk) {
-		IUnknown_Release(obj);
+		IUnknown_Release(unk);
 	}
 	efree(module);
 }