Regression: get_defined_constants(true) spurious user bucket — SNMP_* (re-#22337, Zend/zend_builtin_functions.c)

[PurHur]

Category

Stdlib · php-src-strict · constant categorization (re-#22337 / #19113 / #18303)

Problem

With no user define(), Zend’s get_defined_constants(true) has no user bucket when ext/snmp is not loaded. VM still emits a user bucket (~24 names) whose keys are almost entirely SNMP_* constants. Those names are also defined() / extension_loaded('snmp') / class_exists('SNMP') true on VM while Zend (this host, no snmp) reports all false and has no snmp category bucket either.

#22337 closed the FTP/mysqli mis-bucket case; SNMP is the same class of leak.

Probed 2026-07-24 (host PHP 8.2.32 without snmp vs php bin/vm.php).

Repro	Zend 8.2+ (no snmp)	VM (2026-07-24)
isset(get_defined_constants(true)['user']) before any define()	false	true (user=24)
user keys starting with SNMP_	n/a	13
defined('SNMP_VERSION_1')	false	true
extension_loaded('snmp')	false	true
class_exists('SNMP', false)	false	true
isset(...['snmp'])	false	false (constants dumped into user instead)

php-src reference

• php/php-src Zend/zend_builtin_functions.c — zif_get_defined_constants categorized buckets
• php/php-src ext/snmp/snmp.c — SNMP_* registration only when ext/snmp loaded

PHP implementation target

• ext/standard constant-group / extension advertisement (same path as Regression: get_defined_constants(true) spurious user bucket — FTP/mysqli constants (re-#19113, ext/standard/basic_functions.c) #22337 fix for FTP/mysqli) — map SNMP_* into an snmp bucket only when snmp is honestly loaded; otherwise do not define or categorize them under user
• Pair with extension_loaded('snmp') / class_exists('SNMP') gates so introspection matches Zend
• Prefer PHP in ext/ / lib/; no new runtime/*.c logic

Repro

./script/docker-exec.sh -- bash -lc 'php test/repro/get_defined_constants_snmp_user_bucket.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/get_defined_constants_snmp_user_bucket.php'

Done when

• Before any define(), get_defined_constants(true) has no user bucket on the default/reference profile when snmp is not loaded (Zend match)
• SNMP_* are not defined() and extension_loaded('snmp') / class_exists('SNMP') are false in that configuration
• When snmp is intentionally enabled, constants appear under snmp (not user)
• Compliance .phpt guard under test/compliance/cases/
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

Self-contained repro (no tree file required)

./script/docker-exec.sh -- bash -lc "php -r '\$c=get_defined_constants(true); echo \"user=\".(array_key_exists(\"user\",\$c)?count(\$c[\"user\"]):0).\"\\n\"; echo \"SNMP_VERSION_1=\".(defined(\"SNMP_VERSION_1\")?\"def\":\"undef\").\"\\n\"; echo \"ext=\".(extension_loaded(\"snmp\")?\"yes\":\"no\").\"\\n\";'"
./script/docker-exec.sh -- bash -lc "php bin/vm.php -r '\$c=get_defined_constants(true); echo \"user=\".(array_key_exists(\"user\",\$c)?count(\$c[\"user\"]):0).\"\\n\"; echo \"SNMP_VERSION_1=\".(defined(\"SNMP_VERSION_1\")?\"def\":\"undef\").\"\\n\"; echo \"ext=\".(extension_loaded(\"snmp\")?\"yes\":\"no\").\"\\n\";'"