diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 84751a02e7c0..65d2bcf9e267 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2498,9 +2498,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(const HashTable *source)
 		target->nNextFreeElement = source->nNextFreeElement;
 		target->nTableSize = source->nTableSize;
 		HT_SET_DATA_ADDR(target, emalloc(HT_PACKED_SIZE_EX(target->nTableSize, HT_MIN_MASK)));
-		target->nInternalPointer =
-			(source->nInternalPointer < source->nNumUsed) ?
-				source->nInternalPointer : 0;
+		target->nInternalPointer = source->nInternalPointer;
 
 		HT_HASH_RESET_PACKED(target);
 
@@ -2514,9 +2512,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(const HashTable *source)
 		HT_FLAGS(target) = HT_FLAGS(source) & (HASH_FLAG_MASK & ~HASH_FLAG_HAS_EMPTY_IND);
 		target->nTableMask = source->nTableMask;
 		target->nNextFreeElement = source->nNextFreeElement;
-		target->nInternalPointer =
-			(source->nInternalPointer < source->nNumUsed) ?
-				source->nInternalPointer : 0;
+		target->nInternalPointer = source->nInternalPointer;
 
 		target->nTableSize = source->nTableSize;
 		HT_SET_DATA_ADDR(target, emalloc(HT_SIZE(target)));
diff --git a/ext/standard/tests/array/internal_pointer_cow.phpt b/ext/standard/tests/array/internal_pointer_cow.phpt
new file mode 100644
index 000000000000..a39717dec23e
--- /dev/null
+++ b/ext/standard/tests/array/internal_pointer_cow.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Array internal pointer past the end survives copy-on-write
+--FILE--
+<?php
+$array = ['a' => 1, 'b' => 2, 'c' => 3];
+end($array);
+next($array);
+
+$copy = $array;
+$array['d'] = 4;
+
+var_dump(key($array));
+var_dump(current($array));
+
+$packed = [1, 2, 3];
+end($packed);
+next($packed);
+$copy = $packed;
+$packed[] = 4;
+
+var_dump(key($packed));
+var_dump(current($packed));
+?>
+--EXPECT--
+NULL
+bool(false)
+NULL
+bool(false)