This appear to be the same crash as we encounter.
Our environment is Alma Linux 8, PHP 8.3.21 and XDebug 3.4.3.

We managed to get a stack trace from the crash:

Program received signal SIGSEGV, Segmentation fault.
zval_addref_p (pz=0x7ff93c67ee08) at /opt/remi/php83/root/usr/include/php/Zend/zend_types.h:1373
1373    /opt/remi/php83/root/usr/include/php/Zend/zend_types.h: No such file or directory.
(gdb) bt
#0  zval_addref_p (pz=0x7ff93c67ee08) at /opt/remi/php83/root/usr/include/php/Zend/zend_types.h:1373
#1  zval_from_stack_add_frame_variables (opa=0x41c2f490, opa=0x41c2f490, symbols=<optimized out>, edata=0x7ff93c67edb8, frame=0x7ff93c55dbf0) at /usr/src/debug/php83-php-pecl-xdebug3-3.4.3-1.el8.remi.x86_64/src/src/develop/stack.c:438
#2  zval_from_stack_add_frame (output=output@entry=0x7ff951d20470 <xdebug_globals+1072>, fse=fse@entry=0x55ac7d705710, edata=0x7ff93c67edb8, add_local_vars=add_local_vars@entry=true, params_as_values=params_as_values@entry=true) at /usr/src/debug/php83-php-pecl-xdebug3-3.4.3-1.el8.remi.x86_64/src/src/develop/stack.c:468
#3  0x00007ff951afed1f in zval_from_stack (output=output@entry=0x7ff951d20470 <xdebug_globals+1072>, add_local_vars=add_local_vars@entry=true, params_as_values=params_as_values@entry=true) at /usr/src/debug/php83-php-pecl-xdebug3-3.4.3-1.el8.remi.x86_64/src/src/develop/stack.c:496
#4  0x00007ff951b010e0 in xdebug_develop_throw_exception_hook (exception=exception@entry=0x7ff93c0e7780, file=file@entry=0x7ff93c0e77d8, line=line@entry=0x7ff93c0e77e8, code=code@entry=0x7ff93c0e77c8, code_str=code_str@entry=0x0, message=message@entry=0x7ff93c0e77a8) at /usr/src/debug/php83-php-pecl-xdebug3-3.4.3-1.el8.remi.x86_64/src/src/develop/stack.c:1253
#5  0x00007ff951ad6ed7 in xdebug_throw_exception_hook (exception=0x7ff93c0e7780) at /usr/src/debug/php83-php-pecl-xdebug3-3.4.3-1.el8.remi.x86_64/src/src/base/base.c:1564
#6  xdebug_throw_exception_hook (exception=0x7ff93c0e7780) at /usr/src/debug/php83-php-pecl-xdebug3-3.4.3-1.el8.remi.x86_64/src/src/base/base.c:1516
#7  0x000055ac7b558add in zend_throw_exception_internal (exception=0x7ff93c0e7780) at /usr/src/debug/php83-php-8.3.21-1.el8.remi.x86_64/Zend/zend_exceptions.c:221
#8  0x000055ac7b558be8 in zend_throw_exception_zstr (exception_ce=exception_ce@entry=0x55ac7d091e80, message=message@entry=0x7ff93c0e7820, code=code@entry=0) at /usr/src/debug/php83-php-8.3.21-1.el8.remi.x86_64/Zend/zend_exceptions.c:844
#9  0x000055ac7b558c84 in zend_throw_exception (exception_ce=0x55ac7d091e80, message=<optimized out>, code=code@entry=0) at /usr/src/debug/php83-php-8.3.21-1.el8.remi.x86_64/Zend/zend_exceptions.c:853
#10 0x000055ac7b544830 in zend_type_error (format=format@entry=0x55ac7b8a0640 "%s%s%s(): Return value must be of type %s, %s returned") at /usr/src/debug/php83-php-8.3.21-1.el8.remi.x86_64/Zend/zend.c:1777
...

Stack traces are useful, but I would really like to see a reproducing case. I have never managed to reproduce it, which also means I can't find the bug, and fix it.

Some hints to get you started on where to look for in a reproducible case:

Download https://github.com/php/php-src/blob/PHP-8.3/.gdbinit (replace with the right PHP version) and store it in a dir (example: /tmp).
In GDB, at the point where you typed bt, do the following:

source /tmp/.gdbinit
bt full
zbacktrace

That should add additional information in addition to the backtrace. zbacktrace shows the stack for PHP.

Before you do that, please also turn of Zend's memory manager before you run the script (on the command line):

export USE_ZEND_ALLOC=0

looks like a duplicate of https://bugs.xdebug.org/view.php?id=2349

Came across this issue because found the same "zval_from_stack_add_frame_variables" occurrence in my collected core dumps.
Similar platform "win11 + WSL, docker, xdebug 3.4.3" BUT php 8.1.
So I hope this isn't a hijack of this issue - happy to open a dedicated issue if so.

I was able to create a stable reproduction but only for php 8.1, the >8.1 php versions work.
However, the segfault occurs stable with php 8.1 and the following xdebug versions: 3.4.3, 3.4.1, 3.4.0, 3.3.2, 3.3.1, 3.3.0, xdebug-3.3.0alpha3
No segfaults with: xdebug-3.3.0alpha2, 3.2.2

I was able to boil the reproduction down to the following steps:
<code>docker run --rm -ti --ulimit core=-1 php:8.1-fpm bash</code>
in there:
<code shell>
DEBIAN_FRONTEND=noninteractive apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
libzip-dev
docker-php-ext-install zip
pecl install xdebug-3.4.3
docker-php-ext-enable xdebug
yes '' | pecl install redis-6.2.0
docker-php-ext-enable redis
export USE_ZEND_ALLOC=0
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === 'dac665fdc30fdd8ec78b38b9800061b4150413ff2e3b6f88543c636f7cd84f6db9189d43a81e5503cda447da73c7e5b6') { echo 'Installer verified'.PHP_EOL; } else { echo 'Installer corrupt'.PHP_EOL; unlink('composer-setup.php'); exit(1); }"
php composer-setup.php
php -r "unlink('composer-setup.php');"

cat <<EOT > test.php
<?php
include DIR . "/vendor/autoload.php";

\$dsn = 'redis://127.0.0.1';
\$redis = \Symfony\Component\Cache\Adapter\AbstractAdapter::createConnection(\$dsn, ['lazy' => true]);
\var_dump(\$redis->isConnected());
EOT
php composer.phar require symfony/cache:^5.4 -W
echo 'Now running testing code'
php -f test.php
</code>

This should trigger a segfault - e.g:
<code>
#0 0x00007082cdf7feaf in zval_from_stack_add_frame_variables (opa=0x5acd4bd37d40, symbols=<optimized out>, edata=0x7082cdcd8250, frame=0x5acd4bd429d0) at /tmp/pear/temp/xdebug/src/develop/stack.c:431
symbol_name = <optimized out>
symbol = <optimized out>
j = 0
variables = {value = {lval = 99837787401536, dval = 4.9326420911900951e-310, counted = 0x5acd4bda6d40, str = 0x5acd4bda6d40, arr = 0x5acd4bda6d40, obj = 0x5acd4bda6d40, res = 0x5acd4bda6d40, ref = 0x5acd4bda6d40, ast = 0x5acd4bda6d40, zv = 0x5acd4bda6d40, ptr = 0x5acd4bda6d40, ce = 0x5acd4bda6d40, func = 0x5acd4bda6d40, ww = {w1 = 1272606016,
w2 = 23245}}, u1 = {type_info = 775, v = {type = 7 '\a', type_flags = 3 '\003', u = {extra = 0}}}, u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, property_guard = 0, constant_flags = 0, extra = 0}}
j = <optimized out>
variables = <optimized out>
arr = <optimized out>
z = <optimized out>
symbol_name = <optimized out>
symbol = <optimized out>
#1 zval_from_stack_add_frame (output=0x7082cdfa3490 <xdebug_globals+1008>, fse=0x5acd4bd35400, edata=0x7082cdcd8250, add_local_vars=<optimized out>, params_as_values=<optimized out>) at /tmp/pear/temp/xdebug/src/develop/stack.c:468
frame = <optimized out>
0000002 0x00007082cdf7ff8f in zval_from_stack (output=output@entry=0x7082cdfa3490 <xdebug_globals+1008>, add_local_vars=add_local_vars@entry=true, params_as_values=params_as_values@entry=true) at /tmp/pear/temp/xdebug/src/develop/stack.c:496
fse = 0x5acd4bd35400
next_fse = 0x5acd4bd354f0
i = 2
0000003 0x00007082cdf82213 in xdebug_develop_throw_exception_hook (exception=exception@entry=0x5acd4bdc71d0, file=file@entry=0x5acd4bdc7228, line=line@entry=0x5acd4bdc7238, code=code@entry=0x5acd4bdc7218, code_str=code_str@entry=0x0, message=message@entry=0x5acd4bdc71f8) at /tmp/pear/temp/xdebug/src/develop/stack.c:1253
exception_ce = 0x5acd4bcf9640
exception_trace = <optimized out>
tmp_str = {l = 960, a = 1025, d = 0x5acd4bdb52e0 "\nRedisException: Connection refused in /var/www/html/vendor/symfony/cache/Traits/RedisTrait.php on line 278\n\nCall Stack:\n 0.0001 0 1. {main}() /var/www/html/test.php:0\n 0.0033 "...}
z_previous_exception = <optimized out>
z_last_exception_slot = <optimized out>
z_previous_trace = <optimized out>
previous_exception_obj = <optimized out>
dummy = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res = 0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 = {type_info = 0, v = {type = 0 '\000', type_flags = 0 '\000', u = {extra = 0}}}, u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0,
fe_pos = 0, fe_iter_idx = 0, property_guard = 0, constant_flags = 0, extra = 0}}
0000004 0x00007082cdf5a0d7 in xdebug_throw_exception_hook (exception=0x5acd4bdc71d0) at /tmp/pear/temp/xdebug/src/base/base.c:1564
code = 0x5acd4bdc7218
message = 0x5acd4bdc71f8
file = 0x5acd4bdc7228
line = 0x5acd4bdc7238
exception_ce = <optimized out>
code_str = 0x0
dummy = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res = 0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 = {type_info = 4022142976, v = {type = 0 '\000', type_flags = 8 '\b', u = {extra = 61373}}}, u2 = {next = 2491038928, cache_slot = 2491038928,
opline_num = 2491038928, lineno = 2491038928, num_args = 2491038928, fe_pos = 2491038928, fe_iter_idx = 2491038928, property_guard = 2491038928, constant_flags = 2491038928, extra = 2491038928}}
0000005 xdebug_throw_exception_hook (exception=0x5acd4bdc71d0) at /tmp/pear/temp/xdebug/src/base/base.c:1516
</code>

Interesting is that /var/www/html/vendor/symfony/cache/Traits/RedisTrait.php only fails if the option ['lazy' => true] is set - this option triggers a handling via a \Closure() which seems to make trouble during the connection error handling. Without that option the test script just fails with an error (as expected) - no segfault.

One can swap the xdebug version in above scenario via:
<code>
rm -rf /usr/local/lib/php/extensions/no-debug-non-zts-20210902/xdebug.so
pecl install --force xdebug-3.2.2
php -v
php -f test.php
</code>

A fix for this has now been merged. It would be great if you could check out the latest code on GitHub (The xdebug_3_4 branch). If not, this will make it into a release probably tomorrow.

@derick Thanks for the quick work and the feedback! So much appreciated.
I just tried to install from the latest source, which I think worked since I see the new code in src/develop/stack.c
Unfortunately I still get a segfault with my reproduction code - however I'm still not sure if this is the same error as encountered here or in 2349 but it seems to be related to exceptions too.
Reproduction (let's see if I manage to get the formatting to work this time):

docker run --rm -ti --name xdebug-debugging -w /app --ulimit core=-1  php:8.1-fpm bash

DEBIAN_FRONTEND=noninteractive apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
  libzip-dev
docker-php-ext-install zip
cd /tmp
curl -L https://github.com/xdebug/xdebug/archive/refs/heads/xdebug_3_4.tar.gz > xdebug_3_4.tar.gz
tar -xvzf xdebug_3_4.tar.gz
rm -rf /usr/local/lib/php/extensions/no-debug-non-zts-20210902/xdebug.so
pecl install -f ./xdebug-xdebug_3_4/*
cd /app/
docker-php-ext-enable xdebug
pecl install redis-6.2.0
docker-php-ext-enable redis
export USE_ZEND_ALLOC=0
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === 'dac665fdc30fdd8ec78b38b9800061b4150413ff2e3b6f88543c636f7cd84f6db9189d43a81e5503cda447da73c7e5b6') { echo 'Installer verified'.PHP_EOL; } else { echo 'Installer corrupt'.PHP_EOL; unlink('composer-setup.php'); exit(1); }"
php composer-setup.php
php -r "unlink('composer-setup.php');"

cat <<EOT > test.php
<?php
  include __DIR__ . "/vendor/autoload.php";

  \$dsn = 'redis://127.0.0.1';
  \$redis = \Symfony\Component\Cache\Adapter\AbstractAdapter::createConnection(\$dsn, ['lazy' => true]);
  \var_dump(\$redis->isConnected());
EOT
php composer.phar require symfony/cache:^5.4 -W
php -f test.php
php -v

Results in:

Generating autoload files
7 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.
Segmentation fault (core dumped)
PHP 8.1.32 (cli) (built: May 21 2025 23:21:55) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.32, Copyright (c) Zend Technologies
    with Xdebug v3.4.4-dev, Copyright (c) 2002-2025, by Derick Rethans

Core-Dump has the following backtrace:
#0 0x000078c0ac7dde99 in zval_from_stack_add_frame_variables (opa=0x628d1f768d70, symbols=<optimized out>, edata=0x78c0ac536250, frame=0x628d1f776690) at /tmp/pear/temp/xdebug/src/develop/stack.c:431
symbol_name = <optimized out>
symbol = {value = {lval = 1, dval = 4.9406564584124654e-324, counted = 0x1, str = 0x1, arr = 0x1, obj = 0x1, res = 0x1, ref = 0x1, ast = 0x1, zv = 0x1, ptr = 0x1, ce = 0x1, func = 0x1, ww = {w1 = 1, w2 = 0}}, u1 = {type_info = 1, v = {type = 1 '\001', type_flags = 0 '\000', u = {extra = 0}}}, u2 = {next = 0, cache_slot = 0, opline_num = 0,
lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, property_guard = 0, constant_flags = 0, extra = 0}}
j = 0
variables = {value = {lval = 108358258236704, dval = 5.3536092837949735e-310, counted = 0x628d1f7d9d20, str = 0x628d1f7d9d20, arr = 0x628d1f7d9d20, obj = 0x628d1f7d9d20, res = 0x628d1f7d9d20, ref = 0x628d1f7d9d20, ast = 0x628d1f7d9d20, zv = 0x628d1f7d9d20, ptr = 0x628d1f7d9d20, ce = 0x628d1f7d9d20, func = 0x628d1f7d9d20, ww = {w1 = 528325920,
w2 = 25229}}, u1 = {type_info = 775, v = {type = 7 '\a', type_flags = 3 '\003', u = {extra = 0}}}, u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, property_guard = 0, constant_flags = 0, extra = 0}}
#1 zval_from_stack_add_frame (output=0x78c0ac801490 <xdebug_globals+1008>, fse=0x628d1f7664c0, edata=0x78c0ac536250, add_local_vars=<optimized out>, params_as_values=<optimized out>) at /tmp/pear/temp/xdebug/src/develop/stack.c:467
frame = <optimized out>
0000002 0x000078c0ac7ddf6f in zval_from_stack (output=output@entry=0x78c0ac801490 <xdebug_globals+1008>, add_local_vars=add_local_vars@entry=true, params_as_values=params_as_values@entry=true) at /tmp/pear/temp/xdebug/src/develop/stack.c:495
fse = 0x628d1f7664c0
next_fse = 0x628d1f7665b0
i = 2
0000003 0x000078c0ac7e01f3 in xdebug_develop_throw_exception_hook (exception=exception@entry=0x628d1f7f7fc0, file=file@entry=0x628d1f7f8018, line=line@entry=0x628d1f7f8028, code=code@entry=0x628d1f7f8008, code_str=code_str@entry=0x0, message=message@entry=0x628d1f7f7fe8) at /tmp/pear/temp/xdebug/src/develop/stack.c:1252
exception_ce = 0x628d1f72a680
exception_trace = <optimized out>
tmp_str = {l = 897, a = 1025, d = 0x628d1f7e60f0 "\nRedisException: Connection refused in /app/vendor/symfony/cache/Traits/RedisTrait.php on line 278\n\nCall Stack:\n 0.0001 0 1. {main}() /app/test.php:0\n 0.0029 0 2. Symfony\C"...}
z_previous_exception = <optimized out>
z_last_exception_slot = <optimized out>
z_previous_trace = <optimized out>
previous_exception_obj = <optimized out>
dummy = {value = {lval = 2314885530818453536, dval = 6.0134700169990685e-154, counted = 0x2020202020202020, str = 0x2020202020202020, arr = 0x2020202020202020, obj = 0x2020202020202020, res = 0x2020202020202020, ref = 0x2020202020202020, ast = 0x2020202020202020, zv = 0x2020202020202020, ptr = 0x2020202020202020, ce = 0x2020202020202020,
func = 0x2020202020202020, ww = {w1 = 538976288, w2 = 538976288}}, u1 = {type_info = 538976288, v = {type = 32 ' ', type_flags = 32 ' ', u = {extra = 8224}}}, u2 = {next = 538976288, cache_slot = 538976288, opline_num = 538976288, lineno = 538976288, num_args = 538976288, fe_pos = 538976288, fe_iter_idx = 538976288,
property_guard = 538976288, constant_flags = 538976288, extra = 538976288}}
0000004 0x000078c0ac7b80d7 in xdebug_throw_exception_hook (exception=0x628d1f7f7fc0) at /tmp/pear/temp/xdebug/src/base/base.c:1564
code = 0x628d1f7f8008
message = 0x628d1f7f7fe8
file = 0x628d1f7f8018
line = 0x628d1f7f8028
exception_ce = <optimized out>
code_str = 0x0
dummy = {value = {lval = 4702111234474983745, dval = 2261634.5098039214, counted = 0x4141414141414141, str = 0x4141414141414141, arr = 0x4141414141414141, obj = 0x4141414141414141, res = 0x4141414141414141, ref = 0x4141414141414141, ast = 0x4141414141414141, zv = 0x4141414141414141, ptr = 0x4141414141414141, ce = 0x4141414141414141,
func = 0x4141414141414141, ww = {w1 = 1094795585, w2 = 1094795585}}, u1 = {type_info = 669657856, v = {type = 0 '\000', type_flags = 43 '+', u = {extra = 10218}}}, u2 = {next = 2200358512, cache_slot = 2200358512, opline_num = 2200358512, lineno = 2200358512, num_args = 2200358512, fe_pos = 2200358512, fe_iter_idx = 2200358512,
property_guard = 2200358512, constant_flags = 2200358512, extra = 2200358512}}
0000005 xdebug_throw_exception_hook (exception=0x628d1f7f7fc0) at /tmp/pear/temp/xdebug/src/base/base.c:1516
code = <optimized out>
message = <optimized out>
file = <optimized out>
line = <optimized out>
exception_ce = <optimized out>
code_str = 0x0
dummy = <optimized out>
0000006 0x0000628cf4e3c048 in zend_throw_exception_internal ()

I've narrowed this down to:

<?php
class RedisProxy {
    function __construct(public Closure $c)
    {
    }

    function __call($method, $args)
    {
        $this->c->__invoke($args);
    }
}

$c = function(array $args)
{
    throw new Exception();
};

$rp = new RedisProxy($c);
$rp->isConnected();

And it indeed still produces a crash.

https://github.com/xdebug/xdebug/pull/1022

I have just merged the fix for this — would you be so kind to try again @das-peter ? Unfortunately, I found another bug (only on PHP 8.0/8.1) here, for which I've created 0002354. I need to fix that too before making a release.

@derick Thank you so much for your responsiveness!
I've just tested with the same reproduction step as I posted above and the segfault is gone. The appropriate exception is thrown and shown.

Thanks for checking, I'll make a release now.