From 8b8afe9412629281efe7c96ed3ac672e01c992f1 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Sun, 8 Feb 2026 14:34:48 +0000
Subject: [PATCH 1/2] Fix GH-21161: socket_set_option() crash with array 'addr'
 entry as null.

in the ipv6 address creation helper we need to use, for the error
message, the converted data rather than assuming the original
is a proper zend_string().
---
 ext/sockets/conversions.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/sockets/conversions.c b/ext/sockets/conversions.c
index 60ed970e8967..a419a20c873c 100644
--- a/ext/sockets/conversions.c
+++ b/ext/sockets/conversions.c
@@ -611,7 +611,7 @@ static void from_zval_write_sin6_addr(const zval *zaddr_str, char *addr6, ser_co
 	} else {
 		/* error already emitted, but let's emit another more relevant */
 		do_from_zval_err(ctx, "could not resolve address '%s' to get an AF_INET6 "
-				"address", Z_STRVAL_P(zaddr_str));
+				"address", ZSTR_VAL(addr_str));
 	}
 
 	zend_tmp_string_release(tmp_addr_str);

From 6d640a7d9ba9906aaf14566f5c8c7511960f2322 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Mon, 9 Feb 2026 13:25:55 +0000
Subject: [PATCH 2/2] add test

---
 ext/sockets/tests/gh21161.phpt | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 ext/sockets/tests/gh21161.phpt

diff --git a/ext/sockets/tests/gh21161.phpt b/ext/sockets/tests/gh21161.phpt
new file mode 100644
index 000000000000..8a3958a583d9
--- /dev/null
+++ b/ext/sockets/tests/gh21161.phpt
@@ -0,0 +1,19 @@
+--TEST--
+GH-21161 (IPV6_PKTINFO socket option crash with null addr array entry)
+--EXTENSIONS--
+sockets
+--SKIPIF--
+<?php
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip.. Not valid for Windows');
+}
+?>
+--FILE--
+<?php
+$sock = socket_create(AF_INET6, SOCK_DGRAM, 0);
+socket_set_option($sock, IPPROTO_IPV6, IPV6_PKTINFO, ['addr' => null, 'ifindex' => 0]);
+?>
+--EXPECTF--
+Warning: socket_set_option(): Host lookup failed [%i]: %s on line %d
+
+Warning: socket_set_option(): error converting user data (path: in6_pktinfo > addr): could not resolve address '' to get an AF_INET6 address in %s on line %d