From 949bf4158ca400b75e5416c40ede92fc71c56147 Mon Sep 17 00:00:00 2001
From: Khaled Alam <khaledalam.net@gmail.com>
Date: Wed, 22 Jul 2026 23:51:13 +0300
Subject: [PATCH] Fix GH-22854: assertion failure reading errno/error on failed
 mysqli connection.

---
 NEWS                          |  4 ++++
 ext/mysqli/mysqli_prop.c      |  6 ++++++
 ext/mysqli/tests/gh22854.phpt | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 ext/mysqli/tests/gh22854.phpt

diff --git a/NEWS b/NEWS
index 3c5101c096cb..0ff8fb4de0e0 100644
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,10 @@ PHP                                                                        NEWS
   . Fixed grammatical issues in Normalizer invalid form and IntlCalendar time
     zone offset error messages. (Weilin Du)
 
+- MySQLi:
+  . Fixed bug GH-22854 (Assertion failure when reading the errno/error
+    property of a mysqli object whose connection failed). (Khaled Alam)
+
 - ODBC:
   . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
     driver-reported display size). (iliaal)
diff --git a/ext/mysqli/mysqli_prop.c b/ext/mysqli/mysqli_prop.c
index b54f6fd6ae44..39446c62ddaf 100644
--- a/ext/mysqli/mysqli_prop.c
+++ b/ext/mysqli/mysqli_prop.c
@@ -41,6 +41,12 @@ if (!obj->ptr || !(MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr) { \
 } else { \
 	CHECK_STATUS(statusval, quiet);\
 	p = (MYSQL *)((MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr)->mysql;\
+	if (!p) { \
+		if (!quiet) { \
+			zend_throw_error(NULL, "%s object is not fully initialized", ZSTR_VAL(obj->zo.ce->name)); \
+		} \
+		return FAILURE; \
+	} \
 }
 
 #define MYSQLI_GET_RESULT(statusval) \
diff --git a/ext/mysqli/tests/gh22854.phpt b/ext/mysqli/tests/gh22854.phpt
new file mode 100644
index 000000000000..b39f7f7327e0
--- /dev/null
+++ b/ext/mysqli/tests/gh22854.phpt
@@ -0,0 +1,33 @@
+--TEST--
+GH-22854 (Assertion failure at link_errno_read in ext/mysqli/mysqli_prop.c)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+mysqli_report(MYSQLI_REPORT_OFF);
+
+/* An initialized-but-not-connected object: after a failed connect(),
+ * the internal MYSQL* handle is NULL while the resource status stays
+ * INITIALIZED. Reading the errno/error properties used to dereference the
+ * NULL handle and abort on ZEND_ASSERT(p). */
+$mysqli = new mysqli();
+@$mysqli->connect('localhost', 'user', 'pass', 'db', 0, '/mysqli/gh22854/does/not/exist.sock');
+
+try {
+    var_dump($mysqli->errno);
+} catch (\Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    var_dump($mysqli->error);
+} catch (\Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+echo "done\n";
+?>
+--EXPECT--
+mysqli object is not fully initialized
+mysqli object is not fully initialized
+done