Fix builder forward references resolved within typed arrays

release-notes/VERSION

@@ -57,6 +57,8 @@ No changes since 3.2
  (fix by @pjfanning, w/ Claude code)
 #6223: Avoid quadratic Object Id rebinding for Builder- and delegate-based values
  (fix by @cowtowncoder, w/ Claude code)
+#6225: `ArrayStoreException` when a Builder-based typed array resolves a forward
+  Object Id reference within the same array
 
 3.2.2 (14-Aug-2026)
 

src/main/java/tools/jackson/databind/deser/jdk/ObjectArrayDeserializer.java

@@ -562,16 +562,17 @@ void resolveForwardReference(int index, Object value) {
          * @since 3.2
          */
         void replaceResolvedItem(ArrayReferring forRef, Object oldItem, Object newItem) {
-            if (_array == null) {
-                return;
-            }
             // Only the slot of `forRef` itself: if the same id was forward-referenced
             // more than once, each reference gets a call of its own. Scanning all
             // slots instead would make rebinding N references take O(N^2) time.
             final int index = forRef._index;
             final Object slot = _accumulator.get(index);
             if (slot == forRef || slot == oldItem) {
-                _array[index] = newItem;
+                // Since 3.2.3, [databind#6225]: rebinding may happen before
+                // buildArray(), so update the accumulator even without an array.
+                if (_array != null) {
+                    _array[index] = newItem;
+                }
                 _accumulator.set(index, newItem);
             }
         }

src/test/java/tools/jackson/databind/objectid/ObjectIdWithBuilder5909Test.java

@@ -420,6 +420,36 @@ public void forwardReferenceInTypedArrayWithBuilder() throws Exception
                 "forward ref must be rebound from Builder to built object in typed array");
     }
 
+    // [databind#6225]: rebind a Builder before the typed array is materialized.
+    @Test
+    public void forwardReferenceResolvedWithinTypedArrayWithBuilder() throws Exception
+    {
+        EntityArray entity = MAPPER.readValue("""
+                {"id":0,"refs":[1,{"id":1}]}
+                """, EntityArray.class);
+
+        assertEquals(2, entity.refs.length);
+        assertEquals(1, entity.refs[0].id);
+        assertSame(entity.refs[1], entity.refs[0]);
+    }
+
+    // [databind#6225]: repeated forward references share the final built value.
+    @Test
+    public void multipleForwardReferencesResolvedWithinTypedArrayWithBuilder() throws Exception
+    {
+        EntityArray entity = MAPPER.readValue("""
+                {"id":0,"refs":[1,2,1,{"id":2},null,{"id":1}]}
+                """, EntityArray.class);
+
+        assertEquals(6, entity.refs.length);
+        assertEquals(1, entity.refs[0].id);
+        assertEquals(2, entity.refs[1].id);
+        assertSame(entity.refs[5], entity.refs[0]);
+        assertSame(entity.refs[3], entity.refs[1]);
+        assertSame(entity.refs[5], entity.refs[2]);
+        assertNull(entity.refs[4]);
+    }
+
     // ---- Delegating-creator variant ([databind#1706] + collection forward
     // refs): the bound id'd instance is a transient delegate (Mutable*) which
     // is replaced via updateObjectId after createUsingDelegate. Forward refs