[php-src] Issue #23958: Variant analysis: 1 unfixed sibling safety gaps in php-src

Issue: https://github.com/php/php-src/issues/23958 Author: x4evexnol ## Summary While reviewing php-src for variant analysis, I identified **1 unfixed sibling gaps** — code patterns where an overflow guard, bounds check, or safe allocation wrapper exists at one site but is missing at structurally identical sibling sites. These findings are **code-confirmed** (static analysis verified against the latest HEAD) and pattern-matched against existing fixes in the same codebase. ## Findings ### 1. PHP — mbfl_name2encoding_ex() hash-path OOB read (sibling of strncasecmp strlen fix) - **Pattern**: A safe guard/allocator exists nearby in the same file/function but the vulnerable site uses an unchecked raw operation. ## Methodology These findings were identified through variant analysis of historical CVE fixes: when a project patches an integer overflow or bounds-check gap at one site, sibling sites with the identical pattern were checked for similar fixes. The cases above represent code paths where the fix was **not** retrofitted to structurally identical siblings. I'm happy to provide more detail on any specific case, including file paths, line numbers, and the exact safe-sibling pattern to follow.