Server crash in TABLE_LIST::get_tablenr() when executing a prepared statement through COM_STMT_EXECUTE

A crafted binary-protocol prepared-statement execution crashes mariadbd.

Steps to reproduce:
1. Start a disposable MariaDB test server.
2. Install dependency: pip install mysql-connector-python
3. Run the attached reproducer:
python3 reproduce.py -H <host> -P <port> -u <user> -p <password>

The reproducer first executes the embedded setup SQL to recreate database `mydb` and prepare the minimized schema/data required by the crash. It then prepares a statement with COM_STMT_PREPARE and sends crafted COM_STMT_EXECUTE packet(s).

Actual result:
mariadbd crashes.

Crash signature:
sql/table.h:2708(TABLE_LIST::get_tablenr())

Expected result:
The server should return an error or reject the malformed/edge-case prepared-statement execution without crashing.

Attachments:

• reproduce.py
• error.log