- CVE-2025-1218: the mysqlnd wire-protocol packet readers decoded fields out of a server response before checking the packet still held enough bytes, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer; check before reading and reject truncated length encodings. Carries upstream's 38 regression tests. - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 3 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11