- CVE-2025-1218: fix a set of out-of-bounds reads in the mysqlnd wire protocol parser, where a malicious or compromised MySQL server could make the client read past the end of a truncated packet (greeting, auth response, auth switch, OK, EOF, result-set header, result-set field metadata, row packets, COM_CHANGE_USER response, caching_sha2 result, and the prepared-statement time/date/datetime fetchers) - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 3 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11