global-buffer-overflow when unpacked kwarg is a global singleton

[correctmost]

Crash report

What happened?

Python crashes when running this fuzzed code:

from functools import partial

f = partial(print, **{None: 1})
f()

ERROR: AddressSanitizer: global-buffer-overflow on address 0x55f32b3cb9b0
READ of size 8 at 0x55f32b3cb9b0 thread T0
    #0 0x55f329f85072 in PyUnicode_GET_LENGTH Include/cpython/unicodeobject.h:297
    #1 0x55f329f85072 in unicode_eq Objects/stringlib/eq.h:9
    #2 0x55f329f85072 in _PyUnicode_Equal Objects/unicodeobject.c:11413
    #3 0x55f32a37dfe4 in find_keyword Python/getargs.c:2272
    #4 0x55f32a395275 in _PyArg_UnpackKeywords Python/getargs.c:2636
    #5 0x55f32a16a2e8 in builtin_print Python/clinic/bltinmodule.c.h:1094
    #6 0x55f32a8df2e9 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #7 0x55f32a8df2e9 in partial_vectorcall Modules/_functoolsmodule.c:555
    #8 0x55f32996f9a2 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #9 0x55f32996f9a2 in PyObject_Vectorcall Objects/call.c:327
    #10 0x55f32a1a381e in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #11 0x55f32a1cc293 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #12 0x55f32a243aec in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #13 0x55f32a243aec in _PyEval_Vector Python/ceval.c:2172
    #14 0x55f32a243aec in PyEval_EvalCode Python/ceval.c:679
    #15 0x55f32a4cdce3 in run_mod Python/pythonrun.c:1509
    #16 0x55f32a4ced87 in _PyRun_File Python/pythonrun.c:1332
    #17 0x55f32a4d435e in _PyRun_SimpleFile Python/pythonrun.c:544
    #18 0x55f32a4d8e2c in _PyRun_AnyFile Python/pythonrun.c:92
    #19 0x55f32a5dfc21 in pymain_run_file_obj Modules/main.c:478
    #20 0x55f32a5dfc21 in pymain_run_file Modules/main.c:494
    #21 0x55f32a5dfc21 in pymain_run_python Modules/main.c:804
    #22 0x55f32a5dfc21 in Py_RunMain Modules/main.c:891
    #23 0x55f32a5e27d2 in pymain_main Modules/main.c:921
    #24 0x55f32a5e27d2 in Py_BytesMain Modules/main.c:945

0x55f32b3cb9b0 is located 48 bytes before global variable 'none_as_number' defined in 'Objects/object.c:2316:24' (0x55f32b3cb9e0) of size 288
0x55f32b3cb9b0 is located 0 bytes after global variable '_Py_NoneStruct' defined in 'Objects/object.c:2399:10' (0x55f32b3cb9a0) of size 16

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main:26d9b255801, Aug 30 2026, 16:33:09) [GCC 16.2.1 20260810]