[lazerg]

The PHP-8.6 into master merge (9705fda) dropped the buf->out/buf->limit sync from the failure path of mb_convert_buf_ensure(), along with its test. So when a second buffer growth fails, buf->out still points into the old, freed buffer, and mb_convert_buf_result() writes through it and computes a bogus length. With the tracked allocator this trips the end >= p assertion in zend_memnstr() from mb_substr_count(). This puts the three lines back and restores oom_buf_growth.phpt from PHP-8.6, so the mbstring libmbfl code matches PHP-8.6 again.

Fixes GH-24489