Transfer closed for httpd parent and subrequest double bailout

Description

This can be recreated by setting memory_limit to 128MB and hitting virtual.php script that calls subrequest.php script

The following code:

<?php
// subrequest.php

$mep = str_repeat('test', 256 * 1000000);

echo count($mem);

<?php
// virtual.php

virtual('/subrequest.php');

echo "test";

$mep = str_repeat('test', 256 * 1000000);

echo "virtual!\n";

Resulted in this curl result:

* transfer closed with outstanding read data remaining
* Closing connection 0
curl: (18) transfer closed with outstanding read data remaining

The error logs showed following:

[Sat Jan 18 14:07:36.162766 2025] [php:error] [pid 86048:tid 86048] [client 127.0.0.1:48464] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted at /home/jakub/prog/php/81/Zend/zend_string.h:163 (tried to allocate 1024000032 bytes) in /home/jakub/prog/php/tests/apache2handler/basic/subrequest.php on line 3
[Sat Jan 18 14:07:36.162842 2025] [php:error] [pid 86048:tid 86048] [client 127.0.0.1:48464] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted at /home/jakub/prog/php/81/Zend/zend_string.h:163 (tried to allocate 1024000032 bytes) in /home/jakub/prog/php/tests/apache2handler/basic/virtual.php on line 7
/home/jakub/prog/php/81/Zend/zend_alloc.c(393) : Bailed out without a bailout address!

But I expected normal output with 2 errors for allowed memory size

I tested this with 8.1 but it will be the same for supported version I'm sure - will double check later.

PHP Version

PHP 8.1+

Operating System

Ubuntu 20.04

Reproduce the failure with virtual.php calling subrequest.php under a 128MB memory limit, then inspect the reported paths in Zend/zend_string.h and Zend/zend_alloc.c. Compare the Apache transfer and error output with the expected two memory-limit errors, without a bailout-address failure or truncated response.