Use @param-out type for call_user_func_array by-reference args

When a by-reference parameter has a @param-out PHPDoc, use that type
instead of the @param type when updating scope after call_user_func_array.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -32,6 +32,7 @@
 use PHPStan\Node\Expr\PossiblyImpureCallExpr;
 use PHPStan\Node\Expr\TypeExpr;
 use PHPStan\Reflection\Callables\CallableParametersAcceptor;
+use PHPStan\Reflection\ExtendedParameterReflection;
 use PHPStan\Reflection\Callables\SimpleImpurePoint;
 use PHPStan\Reflection\Callables\SimpleThrowPoint;
 use PHPStan\Reflection\FunctionReflection;
@@ -238,7 +239,9 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 						continue;
 					}
 
-					$byRefType = $innerParameter->getType();
+					$byRefType = $innerParameter instanceof ExtendedParameterReflection && $innerParameter->getOutType() !== null
+						? $innerParameter->getOutType()
+						: $innerParameter->getType();
 					$scope = $nodeScopeResolver->processVirtualAssign(
 						$scope,
 						$storage,

tests/PHPStan/Analyser/nsrt/bug-6799.php

@@ -35,4 +35,20 @@ protected function listingAddWhereFilterAtable(array $filterValues, array &$wher
 			assertType('array<string>', $whereFilter);
 		}
 	}
+
+	/**
+	 * @param array<mixed> $items
+	 * @param-out list<int> $items
+	 */
+	protected function processWithParamOut(array &$items): void
+	{
+		$items = [1, 2, 3];
+	}
+
+	protected function testParamOut(): void
+	{
+		$items = [];
+		call_user_func_array([$this, 'processWithParamOut'], [&$items]);
+		assertType('list<int>', $items);
+	}
 }