Bug#1136816: openssh-client: TCP connect hang in OpenSSH 10.0p2, nc works

--00000000000059a8e50651ee32ab
Content-Type: text/plain; charset="UTF-8"

Package: openssh-client
Version: 1:10.0p2-7
Severity: normal

OpenSSH 10.0p2 in Debian Trixie hangs indefinitely on TCP connect()
to any remote host. nc(1) and curl(1) to the same IP:port work
instantly, confirming this is not a network or firewall issue.

Steps to reproduce:
1. ssh -V  ->  OpenSSH_10.0p2 Debian-7+deb13u2, OpenSSL 3.5.5
2. ssh -vT [email protected]
3. Hangs at: "Connecting to ssh.github.com [140.82.121.35] port 443."
4. Must Ctrl-C after ~30-60s. No error message, just timeout.

Expected result: SSH handshake begins immediately (as with nc/curl).
Actual result: connect() syscall never returns; connection stalls.

Evidence:
- nc -vz github.com 22      ->  open (instant)
- nc -vz ssh.github.com 443 ->  open (instant)
- curl -I https://github.com ->  HTTP/2 200 (instant)
- strace -e trace=network ssh -vT [email protected] shows:
  socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
  connect(3, {sa_family=AF_INET, sin_port=htons(443),
          sin_addr=inet_addr("140.82.121.35")}, 16)  <-- hangs here

Environment:
- Fresh Debian 13 (Trixie) install, kernel 6.12.88+deb13-amd64
- No local firewall: iptables/nftables empty, no proxy env vars
- No AppArmor denials in dmesg

Workaround:
Adding "ProxyCommand nc -q 0 %h %p" to ~/.ssh/config completely
bypasses the bug, confirming the issue is specifically in OpenSSH's
direct socket creation/connect path, not in the network layer.

--00000000000059a8e50651ee32ab
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Package: openssh-client<br>Version: 1:10.0p2-7<br>Severity=
: normal<br><br>OpenSSH 10.0p2 in Debian Trixie hangs indefinitely on TCP c=
onnect()<br>to any remote host. nc(1) and curl(1) to the same IP:port work<=
br>instantly, confirming this is not a network or firewall issue.<br><br>St=
eps to reproduce:<br>1. ssh -V =C2=A0-&gt; =C2=A0OpenSSH_10.0p2 Debian-7+de=
b13u2, OpenSSL 3.5.5<br>2. ssh -vT <a href=3D"mailto:[email protected]">git@gi=
thub.com</a><br>3. Hangs at: &quot;Connecting to <a href=3D"http://ssh.gith=
ub.com">ssh.github.com</a> [140.82.121.35] port 443.&quot;<br>4. Must Ctrl-=
C after ~30-60s. No error message, just timeout.<br><br>Expected result: SS=
H handshake begins immediately (as with nc/curl).<br>Actual result: connect=
() syscall never returns; connection stalls.<br><br>Evidence:<br>- nc -vz <=
a href=3D"http://github.com">github.com</a> 22 =C2=A0 =C2=A0 =C2=A0-&gt; =
=C2=A0open (instant)<br>- nc -vz <a href=3D"http://ssh.github.com">ssh.gith=
ub.com</a> 443 -&gt; =C2=A0open (instant)<br>- curl -I <a href=3D"https://g=
ithub.com">https://github.com</a> -&gt; =C2=A0HTTP/2 200 (instant)<br>- str=
ace -e trace=3Dnetwork ssh -vT <a href=3D"mailto:[email protected]">git@github=
.com</a> shows:<br>=C2=A0 socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) =3D 3<b=
r>=C2=A0 connect(3, {sa_family=3DAF_INET, sin_port=3Dhtons(443), <br>=C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sin_addr=3Dinet_addr(&quot;140.82.121.35&quot;=
)}, 16) =C2=A0&lt;-- hangs here<br><br>Environment:<br>- Fresh Debian 13 (T=
rixie) install, kernel 6.12.88+deb13-amd64<br>- No local firewall: iptables=
/nftables empty, no proxy env vars<br>- No AppArmor denials in dmesg<br><br=
>Workaround:<br>Adding &quot;ProxyCommand nc -q 0 %h %p&quot; to ~/.ssh/con=
fig completely<br>bypasses the bug, confirming the issue is specifically in=
 OpenSSH&#39;s<br>direct socket creation/connect path, not in the network l=
ayer.</div>

--00000000000059a8e50651ee32ab--