* PHP-8.4:
  ext/gd: fix out-of-bounds write reading font header on short reads

* PHP-8.5:
  ext/gd: fix out-of-bounds write reading font header on short reads

The cleanup block guarded on `unk` but released `obj`. On a successful
GetActiveObject() this released the IDispatch proxy twice and leaked the
IUnknown; on a QueryInterface failure `obj` is still NULL while `unk` is
live, so the same line released NULL through a NULL vtable and crashed
instead of throwing. Release `unk` so each interface pointer is released
exactly once and the failure path no longer crashes.

Closes GH-22378

* PHP-8.4:
  ext/com_dotnet: release the held IUnknown in com_get_active_object()

* PHP-8.5:
  ext/com_dotnet: release the held IUnknown in com_get_active_object()

The four sodium pwhash functions queued a zend_argument_error for an
opslimit or memlimit below the documented minimum but fell through to the
KDF instead of returning. When libsodium rejects the value the precise
argument error is clobbered by a generic "internal error"; when it
accepts the value the full KDF runs before the queued error surfaces,
defeating the minimum-cost gate. Add the missing RETURN_THROWS() so each
lower-bound check returns like its sibling upper-bound branches.

Closes GH-22383

* PHP-8.4:
  Throw on below-minimum opslimit/memlimit in sodium pwhash

* PHP-8.5:
  Throw on below-minimum opslimit/memlimit in sodium pwhash

Fix #22360

close GH-22368

* PHP-8.4:
  Fix GH-22360: convert.base64-encode corruption on incremental flush.

* PHP-8.5:
  Fix GH-22360: convert.base64-encode corruption on incremental flush.

…n stored in property (#22376)

* zend_ast: Surround function by parens when exporting calls to function stored in property

The extra parentheses are needed to disambiguate method calls from calls to a
function stored in a property.

Fixes #22373.

* zend_ast: Avoid needless indirection through `zend_ast_export_ns_name()`

The bug80901 fix (09696ee) terminates an over-long response with
*data = 0, but when the line fills the whole FTP_BUFSIZE inbuf without a
CR/LF, data points at inbuf[FTP_BUFSIZE] and the terminator is written one
byte past the buffer, into the adjacent ftpbuf_t::extra field. Reserve the
final byte for the terminator so it always lands inside inbuf. A
buffer-filling response loses its last character (bug80901's SYST reply is
now 4095 visible chars, with the terminator taking the 4096th slot).

Closes GH-22377

* PHP-8.4:
  ext/ftp: fix off-by-one terminator write in ftp_readline()

* PHP-8.5:
  ext/ftp: fix off-by-one terminator write in ftp_readline()

Following #22350.