segfault(shutdown): two FBIRD_CONNECT_FORCE_NEW links to same DB corrupt IAttachment at close

[satwareAG-ironMike]

Symptom

With two live physical connections to the same database created via FBIRD_CONNECT_FORCE_NEW, PHP request shutdown SIGSEGVs while closing the links:

#0 Firebird::IAttachment::getInfo<CheckStatusWrapper> (this=0x556adeae2bb9, ...)   <- garbage pointer
#1 fb::Connection::pingAttachment  src/cpp/fb_connection.hpp:451
#3 fb::Connection::detachNoThrow   src/cpp/fb_connection.hpp:491
#4 fbc_disconnect                  firebird_utils.cpp:607
#5 _php_fbird_close_link           fbird_connection.c:216
... zend_shutdown_executor_values -> php_request_shutdown

Connection* this=0x556f88569910 vs IAttachment*=0x556adeae2bb9 - the attachment pointer inside one wrapper points into a foreign/freed heap region.

Minimal repro (tests/ddl_default_tx_commit_001.phpt on branch fix/issue-572-578-ddl-execute-commit, pre-fix build reproduces identically - verified via stash control):

$c1 = fbird_connect($test_base);
$c2 = fbird_connect($test_base, '', '', '', 0, 3, '', FBIRD_CONNECT_FORCE_NEW);
// ... any work ...
// script ends WITHOUT explicit fbird_close() -> shutdown closes both links -> SIGSEGV

Explicitly fbird_close()-ing the second link before script end avoids it.

Notes

• Pre-existing on main (5b66543); discovered by the DDL visibility race recurs on v13.2.7 / Firebird 3.0.14 (#570 fix incomplete?) #572/flaky(test): testSetIsolationLevelSerializable 'lock conflict on no wait transaction' (RDB$RELATION_FIELDS) - research-first #578 TDD test (control experiment with my fix stashed reproduced it identically)
• Different from Connection issues prevent stable test pipeline #260 (detach on a dropped database): here both attachments are alive; corruption appears during the second link's close
• Suspect area: _php_fbird_close_link/fbc_disconnect interplay when two wrappers exist - possibly the FORCE_NEW path shares/mis-handles the fb::Connection allocation or a stale cached pointer in one of the two fbird_db_link structs

Acceptance criteria

1. phpt with two FORCE_NEW connections surviving request shutdown without segfault
2. gdb/ASAN clean on that repro

[satwareAG-ironMike]

Reconciliation vs b05776a (#576 Connection-owns-resource-ref rework): not fixed - different layer. #576 fixed query-dtor child-loop writes + Connection wrapper refcounts; #580 is the IAttachment-level corruption when two FORCE_NEW links to the same DB close at request shutdown.

Fresh evidence 2026-08-23 (php85-fb3-dev, main @ aa4d65c + #588 branch): full-suite runs still show intermittent Termsig=11 on shutdown-adjacent tests (fbird_deprecate_create, fbird_service_db_mgr, issue566_release_metadata_locks; 2-4 per run, A/B: also present on clean main, so pre-existing). tests/ddl_default_tx_commit_001.phpt still carries the jane: explicit-close workaround citing this issue.

Next step when picked up: ASan run of a two-FORCE_NEW-links PHPT under php83-asan (the #576 toolchain) to capture the corrupting site.

[satwareAG-ironMike]

Root-cause attribution + regression guards (PR #611)

Cannot reproduce on any reachable commit - attribution found

The original repro branch predates the #595 arginfo arity fix. Its 8th positional FBIRD_CONNECT_FORCE_NEW argument was silently mapped onto sync (the #595 comment documents this exact hazard). So the "two FORCE_NEW links" premise was wrong: the crash exercised two wrappers over ONE DSN-cached entry - the #579 shape.

RED evidence (16cc483 = pre-#594, php83-asan, shared-entry shape, no explicit close)

ERROR: AddressSanitizer: heap-use-after-free, READ of size 2
  #0 _php_fbird_cursor_closed   php_fbird_includes.h:538
  #1 php_fbird_free_query_rsrc  fbird_query_prepare.c:199
  #2 zend_resource_dtor -> zend_close_rsrc_list -> php_request_shutdown

This is precisely the pattern 8d850c8 ("fix(#594): detach query back-refs before transaction struct efree" - "Query dtors later skip their transaction bookkeeping ... instead of reading freed memory") fixed. At main (e1260d0): ASAN-clean across four shapes (simple, +DDL+trans, /tmp env, shared-entry). Two-physical-link FORCE_NEW shapes: clean at every tested commit including 16cc483.

Regression guards (PR #611)

• issue580_force_new_shutdown.phpt - cache link + FORCE_NEW link through shutdown.
• issue580_shared_entry_shutdown.phpt - the shape that reproduces RED at 16cc483; GREEN at main.

Closing as fixed by the #594/#591/#601 lifecycle rework (8d850c8 et al). The design question in #579 (closing one wrapper disconnecting siblings) remains a separate semantic decision for maintainers - the UAF is gone, the semantics arguably still deserve the #579 discussion.