diff --git a/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc b/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc
index 6cc482af60..9ae9432118 100644
--- a/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc
+++ b/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc
@@ -61,3 +61,5 @@ $fn = fn(array &$one) => 1;
 $fn = fn(array & $one) => 1;
 
 $fn = static fn(DateTime $a, DateTime $b): int => -($a->getTimestamp() <=> $b->getTimestamp());
+
+function issue3267(string|int ...$values) {}
diff --git a/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc.fixed b/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc.fixed
index c90fb9a753..504ae43e5f 100644
--- a/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc.fixed
+++ b/src/Standards/PSR12/Tests/Operators/OperatorSpacingUnitTest.inc.fixed
@@ -61,3 +61,5 @@ $fn = fn(array &$one) => 1;
 $fn = fn(array & $one) => 1;
 
 $fn = static fn(DateTime $a, DateTime $b): int => -($a->getTimestamp() <=> $b->getTimestamp());
+
+function issue3267(string|int ...$values) {}
diff --git a/src/Tokenizers/PHP.php b/src/Tokenizers/PHP.php
index 383e974526..06263166e9 100644
--- a/src/Tokenizers/PHP.php
+++ b/src/Tokenizers/PHP.php
@@ -2540,7 +2540,6 @@ protected function processAdditional()
                         || $this->tokens[$x]['code'] === T_ELLIPSIS)
                     ) {
                         // Skip past reference and variadic indicators for parameter types.
-                        ++$x;
                         continue;
                     }
 
diff --git a/tests/Core/File/GetMethodParametersTest.inc b/tests/Core/File/GetMethodParametersTest.inc
index 0b7a71fc6d..b78301d309 100644
--- a/tests/Core/File/GetMethodParametersTest.inc
+++ b/tests/Core/File/GetMethodParametersTest.inc
@@ -45,6 +45,9 @@ function namespaceOperatorTypeHint(?namespace\Name $var1) {}
 /* testPHP8UnionTypesSimple */
 function unionTypeSimple(int|float $number, self|parent &...$obj) {}
 
+/* testPHP8UnionTypesWithSpreadOperatorAndReference */
+function globalFunctionWithSpreadAndReference(float|null &$paramA, string|int ...$paramB) {}
+
 /* testPHP8UnionTypesSimpleWithBitwiseOrInDefault */
 $fn = fn(int|float $var = CONSTANT_A | CONSTANT_B) => $var;
 
diff --git a/tests/Core/File/GetMethodParametersTest.php b/tests/Core/File/GetMethodParametersTest.php
index 9c88fcb684..253b806215 100644
--- a/tests/Core/File/GetMethodParametersTest.php
+++ b/tests/Core/File/GetMethodParametersTest.php
@@ -370,6 +370,36 @@ public function testPHP8UnionTypesSimple()
     }//end testPHP8UnionTypesSimple()
 
 
+    /**
+     * Verify recognition of PHP8 union type declaration when the variable has either a spread operator or a reference.
+     *
+     * @return void
+     */
+    public function testPHP8UnionTypesWithSpreadOperatorAndReference()
+    {
+        $expected    = [];
+        $expected[0] = [
+            'name'              => '$paramA',
+            'content'           => 'float|null &$paramA',
+            'pass_by_reference' => true,
+            'variable_length'   => false,
+            'type_hint'         => 'float|null',
+            'nullable_type'     => false,
+        ];
+        $expected[1] = [
+            'name'              => '$paramB',
+            'content'           => 'string|int ...$paramB',
+            'pass_by_reference' => false,
+            'variable_length'   => true,
+            'type_hint'         => 'string|int',
+            'nullable_type'     => false,
+        ];
+
+        $this->getMethodParametersTestHelper('/* '.__FUNCTION__.' */', $expected);
+
+    }//end testPHP8UnionTypesWithSpreadOperatorAndReference()
+
+
     /**
      * Verify recognition of PHP8 union type declaration with a bitwise or in the default value.
      *
diff --git a/tests/Core/Tokenizer/BitwiseOrTest.inc b/tests/Core/Tokenizer/BitwiseOrTest.inc
index 921ef7f5ae..ec1801d569 100644
--- a/tests/Core/Tokenizer/BitwiseOrTest.inc
+++ b/tests/Core/Tokenizer/BitwiseOrTest.inc
@@ -48,6 +48,13 @@ class TypeUnion
 /* testTypeUnionClosureParamIllegalNullable */
 $closureWithParamType = function (?string|null $string) {};
 
+function globalFunctionWithSpreadAndReference(
+    /* testTypeUnionWithReference */
+    float|null &$paramA,
+    /* testTypeUnionWithSpreadOperator */
+    string|int ...$paramB
+) {}
+
 /* testBitwiseOrClosureParamDefault */
 $closureWithReturnType = function ($string = NONSENSE | FAKE)/* testTypeUnionClosureReturn */ : \Package\MyA|PackageB {};
 
diff --git a/tests/Core/Tokenizer/BitwiseOrTest.php b/tests/Core/Tokenizer/BitwiseOrTest.php
index 88d8e587a0..f6288d817e 100644
--- a/tests/Core/Tokenizer/BitwiseOrTest.php
+++ b/tests/Core/Tokenizer/BitwiseOrTest.php
@@ -110,6 +110,8 @@ public function dataTypeUnion()
             ['/* testTypeUnionAbstractMethodReturnType1 */'],
             ['/* testTypeUnionAbstractMethodReturnType2 */'],
             ['/* testTypeUnionClosureParamIllegalNullable */'],
+            ['/* testTypeUnionWithReference */'],
+            ['/* testTypeUnionWithSpreadOperator */'],
             ['/* testTypeUnionClosureReturn */'],
             ['/* testTypeUnionArrowParam */'],
             ['/* testTypeUnionArrowReturnType */'],