[dunglas]

Code running between two worker requests, in the worker loop or in a destructor, can set request state after the previous request reset it. Calling request functions there isn't supported, but nothing stopped it:

Called between requests	Result
header_register_callback()	sapi_activate() drops the callback without releasing it: it leaks with everything it captures until the worker stops
header(), setcookie(), a session cookie	the headers list leaks
header('HTTP/1.1 ...')	the status line leaks
header('Content-Type: ...')	the mimetype leaks
fopen('php://input')	the temporary body stream it creates leaks
output_add_rewrite_var()	the URL rewriter stays active, so the next client's rewrite vars are never applied
session_id(), session_start()	the next client gets that session instead of the one from their cookie

The session case is the one that matters: a destructor that touches the session between two requests hands it to the next client.

frankenphp_handle_request() now releases this state with the superglobals, before waiting for the next request. It skips the first call, where the worker script's boot request is still active.

The header callback leak was found while reading Rapira, which works around it.