OOB read on loose index scan of MIN/MAX with IS [NOT] NULL

CREATE TABLE t1 (a INT, b CHAR(30), KEY k(a, b));

INSERT INTO t1 VALUES (1,'x'),(1,'y'),(2,'z'),(2,NULL),(3,'w'),(3,NULL);

INSERT INTO t1 SELECT a + 10, b FROM t1;

INSERT INTO t1 SELECT a + 20, b FROM t1;

SELECT a, MIN(b) FROM t1 WHERE b IS NOT NULL GROUP BY a;

SELECT a, MAX(b) FROM t1 WHERE b IS NULL GROUP BY a;

DROP TABLE t1;

==32726==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5603f8372c94 at pc 0x7f1372b1c273 bp 0x7313597e91f0 sp 0x7313597e8998

READ of size 32 at 0x5603f8372c94 thread T11

    #0 0x7f1372b1c272 in memcpy (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libasan.so.8+0x11c272) (BuildId: 4d40b61f6ba63104954a6dfe32d38873168318ad)

    #1 0x5603f460353d in memdup_root mysys/my_alloc.c:659

    #2 0x5603ef2cef74 in Query_arena::memdup(void const*, unsigned long) sql/sql_class.h:1267

    #3 0x5603ef2d889e in QUICK_RANGE::QUICK_RANGE(THD*, unsigned char const*, unsigned int, unsigned int, unsigned char const*, unsigned int, unsigned int, unsigned int) sql/opt_range.h:977

    #4 0x5603ef28aa22 in QUICK_GROUP_MIN_MAX_SELECT::add_range(SEL_ARG*) sql/opt_range.cc:15517

    #5 0x5603ef2814f2 in TRP_GROUP_MIN_MAX::make_quick(PARAM*, bool, st_mem_root*) sql/opt_range.cc:15223

    #6 0x5603ef1a2963 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool, Item_func::Bitmap) sql/opt_range.cc:3090

    #7 0x5603eff01f72 in get_quick_record_count sql/sql_select.cc:5347

    #8 0x5603eff13adc in make_join_statistics sql/sql_select.cc:6114

    #9 0x5603efebd07a in JOIN::optimize_inner() sql/sql_select.cc:2679

    #10 0x5603efea9c00 in JOIN::optimize() sql/sql_select.cc:1967

    #11 0x5603eff007e0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) sql/sql_select.cc:5271

    #12 0x5603efe79be2 in handle_select(THD*, LEX*, select_result*, unsigned long long) sql/sql_select.cc:601

    #13 0x5603efc562d4 in execute_sqlcom_select sql/sql_parse.cc:6459

    #14 0x5603efc1ef09 in mysql_execute_command(THD*, bool) sql/sql_parse.cc:4038

    #15 0x5603efc76bf5 in mysql_parse(THD*, char*, unsigned int, Parser_state*) sql/sql_parse.cc:8217

    #16 0x5603efbeceb8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) sql/sql_parse.cc:1924

    #17 0x5603efbe104c in do_command(THD*, bool) sql/sql_parse.cc:1434

    #18 0x5603f08638db in do_handle_one_connection(CONNECT*, bool) sql/sql_connect.cc:1501

    #19 0x5603f0862966 in handle_one_connection sql/sql_connect.cc:1413

    #20 0x5603f2c34f67 in pfs_spawn_thread storage/perfschema/pfs.cc:2201

    #21 0x7f1372a5be35  (/usr/lib/gcc/x86_64-pc-linux-gnu/15/libasan.so.8+0x5be35) (BuildId: 4d40b61f6ba63104954a6dfe32d38873168318ad)

    #22 0x7f1371cde4d4 in start_thread /var/tmp/portage/sys-libs/glibc-2.43-r2/work/glibc-2.43/nptl/pthread_create.c:454

    #23 0x7f1371d47b77 in __clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78