Fix out-of-bounds read in foreach_ptr_array() (#3536)