I think you can create a PR on the fork @kugel- used to make the PR, not on the actual Geany repo[^1], and he can just merge it to his PR if ok. Otherwise it will wait for the next Scintilla release and "somebody" making a new PR for that, but since it is undefined behaviour it would be good to fix sooner.
Additionally it could be added as a separate PR on current Scintilla in Geany, but it might still need to be added to the upgrade PR so it doesn't get removed or cause merge conflicts.
[^1]: I've never done it, but github mentions adding more commits and the branch and fork name to use at the bottom of all PRs