…aring

zai_config_ini_rinit was replacing each ZTS thread's per-thread zend_string
(originally created by PHP's zend_copy_ini_directives via zend_string_dup)
with zend_string_copy(source->value) — a refcount-shared pointer to the
process-wide master in zai_config_memoized_entries[i].ini_entries[n]->value.

PHP's refcount ops are not atomic. With many ZTS workers each running this
rinit on every request, concurrent ++/-- on the shared refcount produced
torn values, premature frees, and use-after-free reads / Zend MM heap
corruption (observed as "zend_mm_heap corrupted" inside zend_string_release
during this very function on FrankenPHP under heavy load).

Match PHP's own thread-setup pattern: zend_string_dup gives each thread an
independent persistent allocation with refcount 1 that is never raced. In
the orig_value == ini->value aliased case, repoint ini->value to its own
fresh dup before releasing orig_value to avoid a dangling pointer. Memory
cost is ~tens of bytes per ZAI entry per thread; rinit churn is balanced
release+dup, no growth.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>