Abandoned patches fixing real bugs

Hi.

Lately I've started seeing a lot more abandoned patches: a new
contributor sends out a patch, it gets reviewed, issues are found that
need addressing, but a v2 never arrives.

In one situation, I received a patch for a single line change that was
fine, but the description largely hallucinated 5+ paragraphs of text,
suggesting undisclosed LLM usage. I asked for a v2 of the patch to fix
those issues. Then, independently, I received a bug report. While
investigating it, I realized that the same change I had seen before,
the one for which I requested a v2 that never arrived, is part of the
fix for that bug. Now I'm not sure how to approach fixing that bug. I
could:
1) Grab the original change and rewrite the commit message,
2) Add the original change with the hallucinated commit message,
3) Submit my patch that includes the same change.

Option 1 makes adding a Signed-off-by feel a little silly because I'm
almost certain the person who sent it didn't write it. And what if
they did write the code but wrote the commit message when they were
very drunk and a month later come back with, "Why did you commit this
change as me when I clearly didn't write the commit message?!". Option
2 has the same problem as 1 but also breaks history by including
hallucinated/incorrect commit descriptions. Option 3 just doesn't feel
right, even if developed independently.

None of those feel particularly good to me. I'm inclined to go with
option 1, adding a note like, "Maintainer rewrote commit message;
suspicion of LLM usage." However, I can't ensure strict attribution
because I don't know which LLM wrote the original change and I can't
prove it either way.

I'd be interested to know how others deal with abandoned patches whose
code needs to be merged, e.g. because of a security issue, so waiting
months for an update might not be an option.

z