The system on which I ran reportbug(1) is an older Debian release that the one in which I found and reported the bug, so this element of the resulting bugtracking entry is is wrong, sorry:
Found in version openssh/1:8.4p1-5+deb11u3 As I explained, I’m reporting this for 9.6p1. It looks like bug #1 was introduced in 9.6p1-1 by 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5, and bug #2 in 9.3p1-1 by 9641753e0fd146204d57b2a4165f552a81afade4. -- Richard