Internal pointer past the end resets to the first element on copy-on-write separation

Description

end() followed by next() leaves the internal pointer past the end, so key() returns NULL. A copy-on-write separation then moves it back to the first element instead of leaving it past the end. An in-range pointer survives the same separation unchanged, and the untouched copy keeps NULL, so the past-the-end case is the only one that moves.

The following code:

<?php
$a = ['a' => 1, 'b' => 2, 'c' => 3];
end($a);
next($a);
var_dump(key($a), current($a));

$b = $a;
$a['d'] = 4;
var_dump(key($a), current($a));

Resulted in this output:

NULL
bool(false)
string(1) "a"
int(1)

But I expected this output instead:

NULL
bool(false)
NULL
bool(false)

zend_array_dup() clamps the copied pointer with (source->nInternalPointer < source->nNumUsed) ? source->nInternalPointer : 0 at Zend/zend_hash.c:2511 for the mixed case and :2495 for the packed case. The immutable branch at :2479 copies it verbatim, so the three arms of that function disagree.

PHP Version

PHP 8.4.25, also PHP-8.4 and master at d26d5f2

Operating System

Linux