- CVE-2025-1218: fix out-of-bounds reads in the mysqlnd wire-protocol packet readers - a malicious or compromised MySQL server could make the client read past the end of a truncated packet; the bounds are now checked before each read instead of after it - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 3 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11