Bug #35916 was not completely fixed

[nielsdos]

Description

The following bug is incompletely fixed: https://bugs.php.net/bug.php?id=35916

Change the reproducer code in bug35916.phpt from stream_bucket_append to stream_bucket_prepend and you have the same bug. Furthermore, even in the append case the check is most likely incorrect because the bucket can already be in the brigade at a position other than the tail.
Also, the hack introduced as a consequence of this bug in php_stream_bucket_attach is responsible for OSS-Fuzz bug https://issues.oss-fuzz.com/issues/385993744

PHP Version

5.something and higher

Operating System

No response