If I interpret the patch correctly the issue seems to be that you could just ask for a channel and do a request_exec before authenticating. The regression test is:<p><pre><code> {send, hello},
{send, ssh_msg_kexinit},
{match, #ssh_msg_kexinit{_='_'}, receive_msg},
{send, SshMsgChannelOpen},
{send, SshMsgChannelRequest},
{match, disconnect(), receive_msg}
</code></pre>
<a href="https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f">https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a...</a><p>edit: Ah, found by the people at RUB, they do a lot of research in verifying protocol implementations iirc.