diff --git a/Zend/tests/gh12826.phpt b/Zend/tests/gh12826.phpt
new file mode 100644
index 0000000000000..adfc3a747c35f
--- /dev/null
+++ b/Zend/tests/gh12826.phpt
@@ -0,0 +1,30 @@
+--TEST--
+GH-12826 (Weird pointers issue in nested loops)
+--FILE--
+<?php
+$test = array(
+  'a' => 1,
+  'b' => 2,
+  'c' => 3,
+  'd' => 4,
+);
+
+unset($test['a']);
+unset($test['b']);
+
+foreach($test as $k => &$v) { // Mind the reference!
+    echo "Pass $k : ";
+
+    foreach($test as $kk => $vv) {
+        echo $test[$kk];
+        if ($kk == $k) $test[$kk] = 0;
+    }
+
+    echo "\n";
+}
+
+unset($v);
+?>
+--EXPECT--
+Pass c : 34
+Pass d : 04
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 03683e3a1ea4e..6668c4c17c669 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2407,7 +2407,7 @@ static zend_always_inline uint32_t zend_array_dup_elements(HashTable *source, Ha
 					idx++; p++;
 				}
 			} else {
-				target->nNumUsed = source->nNumOfElements;
+				target->nNumUsed = source->nNumUsed;
 				uint32_t iter_pos = zend_hash_iterators_lower_pos(target, idx);
 
 				while (p != end) {
diff --git a/ext/soap/php_sdl.c b/ext/soap/php_sdl.c
index 762374ed859d7..353b6328a0dee 100644
--- a/ext/soap/php_sdl.c
+++ b/ext/soap/php_sdl.c
@@ -2393,7 +2393,9 @@ static void add_sdl_to_cache(const char *fn, const char *uri, time_t t, sdlPtr s
 	/* Make sure that incomplete files (e.g. due to disk space issues, see bug #66150) are not utilised. */
 	if (valid_file) {
 		/* This is allowed to fail, this means that another process was raced to create the file. */
-		(void) VCWD_RENAME(ZSTR_VAL(temp_file_path), fn);
+		if (VCWD_RENAME(ZSTR_VAL(temp_file_path), fn) < 0) {
+			VCWD_UNLINK(ZSTR_VAL(temp_file_path));
+		}
 	}
 
 	smart_str_free(&buf);