Opening a directory with SFTP and manually disconnecting SSH session segfaults

[NattyNarwhal]

Can reproduce on IBM i and macOS. Probably a reference counting issue?

<?php
$connection = ssh2_connect($ssh_host, $ssh_port);
ssh2_auth_agent($connection, $ssh_auth_user);
$sftp = ssh2_sftp($connection);
$dirHandle = opendir("ssh2.sftp://{$sftp}/");
ssh2_disconnect($connection);

(lldb) run
Process 61750 launched: '/opt/local/bin/php83' (arm64)
Process 61750 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
    frame #0: 0x0000000101c15e38 libssh2.1.dylib`libssh2_sftp_close_handle + 124
libssh2.1.dylib`libssh2_sftp_close_handle:
->  0x101c15e38 <+124>: ldr    x8, [x27, #0x8]
    0x101c15e3c <+128>: mov    x0, x25
    0x101c15e40 <+132>: mov    x1, x27
    0x101c15e44 <+136>: blr    x8
Target 0: (php83) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
  * frame #0: 0x0000000101c15e38 libssh2.1.dylib`libssh2_sftp_close_handle + 124
    frame #1: 0x00000001016a9b78 ssh2.so`php_ssh2_sftp_dirstream_close + 24
    frame #2: 0x00000001001b2b9c php83`_php_stream_free + 428
    frame #3: 0x00000001001b4b94 php83`stream_resource_regular_dtor + 20
    frame #4: 0x0000000100217bfc php83`zend_resource_dtor + 80
    frame #5: 0x0000000100217fac php83`zend_close_rsrc_list + 84
    frame #6: 0x00000001001f0e40 php83`zend_shutdown_executor_values + 104
    frame #7: 0x00000001001f13e4 php83`shutdown_executor + 116
    frame #8: 0x000000010020098c php83`zend_deactivate + 88
    frame #9: 0x000000010019f8d0 php83`php_request_shutdown + 340
    frame #10: 0x00000001002eb844 php83`do_cli + 6648
    frame #11: 0x00000001002e9d38 php83`main + 720
    frame #12: 0x000000019d913154 dyld`start + 2476

[NattyNarwhal]

I'm pretty sure this is because when ssh2_disconnect is called manually, it removes the session from the list, calling the dtor, and frees the session. This happens before the sftp session close is called. I'm assuming the SFTP dirstream session should be holding a reference to force the correct order of closing, or it should skip closing like in 9fb1cf8.