I believe this is what's causing the change:


@@ -2406,7 +2407,7 @@ PHP_FUNCTION(substr)
                }
        }

-       if (f >= (zend_long)str->len) {
+       if (f > (zend_long)str->len) {
                RETURN_FALSE;
        }


...which was introduced in 257054e81d4dad73bf9d09cd206d3a6727ad1777 to fix #62922

Hrm.

This change is intentional. The behavior is of course BS, but this is because strpos() in general returns BS. E.g. substr("Hello", 4, 20) has always returned "o" rather than throwing an error. The change only allowed 5 as a valid start offset here (which it is).

I support this change.
However, this change may bite people. It should be clearly noted in UPGRADING.
A company that I know of was bitten by strtotime() return value change by PHP 5.1 and lost few million dollars, for example.