CVE-2026-92388

When an FTP wildcard `LIST` operation fails, libcurl omits the restoration

path meant for successful listings, leaving the write callback set to the

internal listing parser and the write callback data pointing directly to the

easy handle. Subsequent reuse of this handle triggers an immediate crash, and

cloning it via `curl_easy_duphandle()` copies this corrupted state into the

duplicate. If the original handle is subsequently freed, executing a transfer

on the cloned handle causes a heap use-after-free read against the dangling

handle reference; alternatively, reusing the original or cloned handle while

changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)

results in type confusion, forcing the internal parser to interpret incoming

server response bytes into memory at the application-supplied write data

pointer.