Interesting, can you give some more info?
The best path forward I found was using https://github.com/9bie/php2shell-bypass-aslr-exp and figuring out how to shrink the B1 leak down to >1.21MiB
again, i'm not sure if they actually succeeded (because the server is down and i don't really trust their local tests), but they seem to have done that.