diff --git a/Documentation/RelNotes/2.56.0.adoc b/Documentation/RelNotes/2.56.0.adoc
index 65f0d965633959..3cf754a0bdfa49 100644
--- a/Documentation/RelNotes/2.56.0.adoc
+++ b/Documentation/RelNotes/2.56.0.adoc
@@ -126,6 +126,11 @@ UI, Workflows & Features
    clones, reclaiming space.  Guards prevent running during other
    operations or if referenced by the index.
 
+ * The documentation for 'git format-rev' has been updated to use the
+   [synopsis] block definition on code blocks to properly highlight
+   placeholders, and a quoting inconsistency in the running text has
+   been fixed.
+
 
 Performance, Internal Implementation, Development Support etc.
 --------------------------------------------------------------
@@ -343,14 +348,12 @@ Performance, Internal Implementation, Development Support etc.
    positive warning from the 'CHECK_ASSERTION_SIDE_EFFECTS' build with
    GCC 15 in the Bloom filter code has also been silenced to facilitate
    the image upgrade.
-   (merge 1a1579c42d jk/ci-static-analysis-image-bump later to maint).
 
  * The alias tests in 't/t0014-alias.sh' have been updated to dynamically
    query the list of deprecated commands using 'git
    --list-cmds=deprecated' to avoid test failures when running with
    'WITH_BREAKING_CHANGES' in a build directory that contains stale
    executables of formerly deprecated commands.
-   (merge bc57ecb915 jk/t0014-dynamic-deprecated-cmds later to maint).
 
  * The code path that deals with relative paths in the diff-lib has
    been cleaned up.
@@ -389,7 +392,6 @@ Performance, Internal Implementation, Development Support etc.
  * The 'ssh-agent' tests in 't7528' have been fixed to work when the
    user's login shell is csh-like, by explicitly passing '-s' to
    'ssh-agent' to force Bourne shell syntax.
-   (merge d5dd17756d kl/t7528-ssh-agent-for-csh-users later to maint).
 
  * A compatibility wrapper for writev(3p) has been reintroduced,
    including fixes for CMake build and 'MAX_IO_SIZE' limits on NonStop.
@@ -434,6 +436,10 @@ Performance, Internal Implementation, Development Support etc.
    related callback signatures across several subsystems, simplifying the
    API now that trace output no longer uses it.
 
+ * A heap-use-after-free bug in the object name parsing code when
+   reporting failures with a relative path to a sparse directory has
+   been corrected.
+
 
 Fixes since v2.55
 -----------------
diff --git a/Documentation/git-format-rev.adoc b/Documentation/git-format-rev.adoc
index 505a52feccd466..c2268c92b56bac 100644
--- a/Documentation/git-format-rev.adoc
+++ b/Documentation/git-format-rev.adoc
@@ -93,12 +93,13 @@ acts as a _terminator_, not a _separator_. In other words, the final
 line or record is also terminated by the terminator character.
 
 The mode `--stdin-mode=text` replaces each object name with the
-formatted commit, i.e. the format `%s` would transform some commit
-object name to `<subject>` without any termination. Like this:
+formatted commit, i.e. the format `"%s"` would transform some commit
+object name to `"<subject>"` without any termination. Like this:
 
-----
+[synopsis]
+--
 Did we not fix this in "<subject>"?
-----
+--
 
 It is safe to interactively read and write from this command since each
 record is immediately flushed.
diff --git a/object-name.c b/object-name.c
index 83efba0ba668e5..026ff8c6dd7b4b 100644
--- a/object-name.c
+++ b/object-name.c
@@ -1803,13 +1803,15 @@ static enum get_oid_result get_oid_with_context_1(struct repository *repo,
 			    memcmp(ce->name, cp, namelen))
 				break;
 			if (ce_stage(ce) == stage) {
+				int ret = reject_tree_in_index(repo, only_to_die, ce,
+							       stage, prefix, cp);
+
+				if (!ret) {
+					oidcpy(oid, &ce->oid);
+					oc->mode = ce->ce_mode;
+				}
 				free(new_path);
-				if (reject_tree_in_index(repo, only_to_die, ce,
-							 stage, prefix, cp))
-					return -1;
-				oidcpy(oid, &ce->oid);
-				oc->mode = ce->ce_mode;
-				return 0;
+				return ret;
 			}
 			pos++;
 		}
diff --git a/t/t1092-sparse-checkout-compatibility.sh b/t/t1092-sparse-checkout-compatibility.sh
index 446c1776cb478b..05b54062b3bc85 100755
--- a/t/t1092-sparse-checkout-compatibility.sh
+++ b/t/t1092-sparse-checkout-compatibility.sh
@@ -1405,6 +1405,17 @@ do
 	"
 done
 
+test_expect_success 'relative path to a sparse directory' '
+	init_repos &&
+
+	# A ":<stage>:<path>" argument whose path is relative is resolved
+	# into a heap-allocated buffer, and a sparse directory found at that
+	# path is reported through it.  Cover that combination, so that the
+	# reporting does not read the buffer after it has been released.
+	test_sparse_match test_must_fail git show :0:./folder1/ &&
+	test_sparse_match test_must_fail git rev-parse :0:./folder1/
+'
+
 test_expect_success 'submodule handling' '
 	init_repos &&