diff --git a/NEWS b/NEWS
index 06c1c76dba02..77c2e799feb1 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,10 @@ PHP                                                                        NEWS
 - Hash:
   . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)
 
+- MBString:
+  . Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit
+    on 32bit platforms. (Marc Bennewitz)
+
 - Opcache:
   . Fixed tracing JIT returning a wrapped integer instead of a float on
     integer overflow after an integer was compared with a float or
@@ -52,6 +56,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
     PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 
+- Phar:
+  . Fixed Phar::buildFromIterator() accepting a negative getMTime() on 32bit
+    platforms. (Marc Bennewitz)
+
 - SAPI:
   . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
     (Martin Mirchev)
@@ -72,6 +80,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
     Location header). (bercedev)
 
+- Windows:
+  . Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative
+    codepage on 32bit platforms. (Marc Bennewitz)
+
 - Zip:
   . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
     configuration. (Weilin Du)
diff --git a/Zend/zend_range_check.h b/Zend/zend_range_check.h
index 8db867434399..ed61097419f2 100644
--- a/Zend/zend_range_check.h
+++ b/Zend/zend_range_check.h
@@ -46,7 +46,7 @@
 # define ZEND_LONG_INT_OVFL(zl) (0)
 # define ZEND_LONG_INT_UDFL(zl) (0)
 # define ZEND_LONG_EXCEEDS_INT(zlong) (0)
-# define ZEND_LONG_UINT_OVFL(zl) (0)
+# define ZEND_LONG_UINT_OVFL(zl) UNEXPECTED((zl) < 0)
 #endif
 
 /* size_t vs (unsigned) int checks. */
diff --git a/ext/mbstring/tests/retry_limit_negative.phpt b/ext/mbstring/tests/retry_limit_negative.phpt
new file mode 100644
index 000000000000..b498a7463d28
--- /dev/null
+++ b/ext/mbstring/tests/retry_limit_negative.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Oniguruma retry limit is not set from a negative mbstring.regex_retry_limit
+--EXTENSIONS--
+mbstring
+--SKIPIF--
+<?php
+if (!function_exists('mb_ereg')) die('skip mb_ereg not available');
+if (@version_compare(MB_ONIGURUMA_VERSION, '6.9.3') < 0) {
+    die('skip requires Oniguruma >= 6.9.3');
+}
+?>
+--INI--
+error_reporting=E_ALL & ~E_DEPRECATED
+mbstring.regex_retry_limit=-1
+--FILE--
+<?php
+/* A negative limit must leave the default of Oniguruma in place, rather than
+ * being converted to an unsigned int of UINT_MAX. This match needs more
+ * retries than the default allows for. */
+$regex = 'A(B|C+)+D|AC+X';
+$str = 'A' . str_repeat('C', 24) . 'X';
+var_dump(mb_ereg($regex, $str));
+?>
+--EXPECT--
+bool(false)
diff --git a/ext/phar/tests/buildFromIterator_user_overrides/getMTime_negative.phpt b/ext/phar/tests/buildFromIterator_user_overrides/getMTime_negative.phpt
new file mode 100644
index 000000000000..315705781647
--- /dev/null
+++ b/ext/phar/tests/buildFromIterator_user_overrides/getMTime_negative.phpt
@@ -0,0 +1,53 @@
+--TEST--
+buildFromIterator with user overrides - negative getMTime()
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+phar.require_hash=0
+--FILE--
+<?php
+
+class MySplFileInfo extends SplFileInfo {
+    public function getMTime(): int|false {
+        echo "[MTime]\n";
+        return -1;
+    }
+}
+
+class MyIterator extends RecursiveDirectoryIterator {
+    public function current(): SplFileInfo {
+        return new MySplFileInfo(parent::current()->getPathname());
+    }
+}
+
+$workdir = __DIR__.'/getMTime_negative';
+mkdir($workdir . '/content', recursive: true);
+file_put_contents($workdir . '/content/hello.txt', "Hello world.");
+
+try {
+    $phar = new \Phar($workdir . "/test.phar");
+    $phar->startBuffering();
+    $phar->buildFromIterator(
+        new RecursiveIteratorIterator(
+            new MyIterator($workdir . '/content', FilesystemIterator::SKIP_DOTS)
+        ),
+        $workdir
+    );
+    $phar->stopBuffering();
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+?>
+--CLEAN--
+<?php
+$workdir = __DIR__.'/getMTime_negative';
+@unlink($workdir . '/content/hello.txt');
+@unlink($workdir . '/test.phar');
+@rmdir($workdir . '/content');
+@rmdir($workdir);
+?>
+--EXPECTF--
+[MTime]
+BadMethodCallException: Entry content%chello.txt cannot be created: timestamp is limited to 32-bit
diff --git a/ext/standard/tests/strings/sapi_windows_cp_negative_codepage.phpt b/ext/standard/tests/strings/sapi_windows_cp_negative_codepage.phpt
new file mode 100644
index 000000000000..997685f34ef3
--- /dev/null
+++ b/ext/standard/tests/strings/sapi_windows_cp_negative_codepage.phpt
@@ -0,0 +1,37 @@
+--TEST--
+sapi_windows_cp_set() and sapi_windows_cp_conv() must reject a negative codepage
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Windows') die('skip for Windows only');
+?>
+--FILE--
+<?php
+try {
+    sapi_windows_cp_set(-1);
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_set(PHP_INT_MIN);
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_conv(-1, 65001, 'php');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_conv(65001, -1, 'php');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+ValueError: sapi_windows_cp_set(): Argument #1 ($codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_set(): Argument #1 ($codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_conv(): Argument #1 ($in_codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_conv(): Argument #2 ($out_codepage) must be between 0 and 4294967295