Commit f991e962b1b for php

commit f991e962b1b8b49999410a38e5484a541e2e087f
Merge: c22ce973103 e50b8b05be8
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Thu Oct 1 17:24:44 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      TSRM: Fix Windows shared memory payload offset

diff --cc NEWS
index 1cc0c1891fe,edeca96eaeb..d1bd9c5bfab
--- a/NEWS
+++ b/NEWS
@@@ -18,17 -24,13 +18,19 @@@ PH
    . Fixed AVX being reported as supported when the OS has not enabled AVX
      state. (Ilia Alshanetsky)
    . Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
 -  . Fixed bug GH-23896 (Assertion failure in zend_call_function() after a
 -    throwing deprecation). (lazerg)
    . Fixed use-after-free when a dl()-loaded extension declares a frameless
      function and a later request calls it. (Ilia Alshanetsky)
+   . Fixed System V shared memory emulation for Windows attaching segments past
+     the end of their mapping. (Ilia Alshanetsky)

 +- CLI
 +  . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
 +    request activation). (matyhtf)
 +  . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
 +    request for a static file). (jakubskopal)
 +  . Fixed the built-in server truncating an error page and leaking its
 +    unsent part after a partial socket write. (Ilia Alshanetsky)
 +
  - DOM:
    . Fixed use-after-free when re-constructing a DOMXPath whose php:function
      registrations are freed while still reachable from the cycle collector.
diff --cc TSRM/tsrm_win32.c
index 4c8fc9d19aa,e49aac76121..54c22266e13
--- a/TSRM/tsrm_win32.c
+++ b/TSRM/tsrm_win32.c
@@@ -635,8 -635,9 +635,9 @@@ static key_t tsrm_choose_random_shm_key
  TSRM_API int shmget(key_t key, size_t size, int flags)
  {/*{{{*/
  	shm_pair *shm;
+ 	size_t mapping_size;
  	char shm_segment[sizeof(SEGMENT_PREFIX INT_MIN_AS_STRING)];
 -	HANDLE shm_handle = NULL, info_handle = NULL;
 +	HANDLE shm_handle = NULL;
  	BOOL created = FALSE;

  	if (key != IPC_PRIVATE) {