[Go 1.20.0] CVE-2026-39830: ssh: fix deadlock on unexpected channel responses

[Atharva-Shinde]

git checkout sustaining-v0.33.0
git am /tmp/fork-maintainer/GO-2026-5017/v0.33.0-GO-2026-5017-0.patch
vi ssh/mux_test.go
git am /tmp/fork-maintainer/GO-2026-5017/v0.33.0-GO-2026-5017-1.patch
vi ssh/mux_test.go

v0.33.0-GO-2026-5017-0.patch
v0.33.0-GO-2026-5017-1.patch

Unit tests output

crypto git:(sustaining-v0.33.0) go test ./...
ok      golang.org/x/crypto/acme        11.138s
ok      golang.org/x/crypto/acme/autocert       0.728s
?       golang.org/x/crypto/acme/autocert/internal/acmetest     [no test files]
?       golang.org/x/crypto/acme/internal/acmeprobe     [no test files]
?       golang.org/x/crypto/cryptobyte/asn1     [no test files]
ok      golang.org/x/crypto/argon2      0.469s
?       golang.org/x/crypto/internal/testenv    [no test files]
?       golang.org/x/crypto/internal/wycheproof/internal/dsa    [no test files]
?       golang.org/x/crypto/openpgp/errors      [no test files]
ok      golang.org/x/crypto/bcrypt      6.160s
ok      golang.org/x/crypto/blake2b     4.044s
ok      golang.org/x/crypto/blake2s     2.467s
ok      golang.org/x/crypto/blowfish    1.275s
ok      golang.org/x/crypto/bn256       4.567s
ok      golang.org/x/crypto/cast5       2.753s
ok      golang.org/x/crypto/chacha20    0.854s
ok      golang.org/x/crypto/chacha20poly1305    3.312s
ok      golang.org/x/crypto/cryptobyte  3.667s
ok      golang.org/x/crypto/curve25519  1.690s
ok      golang.org/x/crypto/ed25519     2.849s
ok      golang.org/x/crypto/hkdf        5.191s
ok      golang.org/x/crypto/internal/alias      5.568s
ok      golang.org/x/crypto/internal/poly1305   5.491s
?       golang.org/x/crypto/poly1305    [no test files]
ok      golang.org/x/crypto/internal/wycheproof 7.271s
ok      golang.org/x/crypto/md4 5.446s
ok      golang.org/x/crypto/nacl/auth   5.767s
ok      golang.org/x/crypto/nacl/box    5.049s
ok      golang.org/x/crypto/nacl/secretbox      5.070s
ok      golang.org/x/crypto/nacl/sign   5.368s
ok      golang.org/x/crypto/ocsp        5.314s
ok      golang.org/x/crypto/openpgp     6.116s
ok      golang.org/x/crypto/openpgp/armor       5.357s
?       golang.org/x/crypto/ssh/terminal        [no test files]
ok      golang.org/x/crypto/openpgp/clearsign   12.934s
ok      golang.org/x/crypto/openpgp/elgamal     5.017s
ok      golang.org/x/crypto/openpgp/packet      4.935s
ok      golang.org/x/crypto/openpgp/s2k 5.985s
ok      golang.org/x/crypto/otr 5.255s
ok      golang.org/x/crypto/pbkdf2      5.051s
ok      golang.org/x/crypto/pkcs12      4.686s
ok      golang.org/x/crypto/pkcs12/internal/rc2 5.029s
ok      golang.org/x/crypto/ripemd160   5.030s
ok      golang.org/x/crypto/salsa20     5.180s
ok      golang.org/x/crypto/salsa20/salsa       5.431s
ok      golang.org/x/crypto/scrypt      5.424s
ok      golang.org/x/crypto/sha3        6.877s
--- FAIL: TestParseRSAModulusTooLarge (0.00s)
    keys_test.go:219: unexpected error message: got "ssh: no key found", want substring "rsa modulus too large"
seen &ssh.rsaPublicKey{N:20061140430650092691700129633418895153104099440152571948017228333944623487573521043236463535114811698275540013288855432311158126420471092062212564127370505763070250534466667545557854500626223850938086149993496716374117138731870544047779767066551724960262812037558993204799983435256152044565444388235895913343541217854379451044881161906995318571403079108766806750251846358097485205923957951642423646975888286438168592280219572188076697918703120158605105665730880552260696034697922765719453812717299592545244658127905527709856843276462192052069837242904720629896824162245468755516134327672099510173872004590681225925311, E:65537}
seen &ssh.dsaPublicKey{Parameters:dsa.Parameters{P:175721116665844170017669647669946518528413457312022711032734739623005755152443227429734217171261249553795678598220451924215157415901674587334166902511516864954496725567843523544375611356526453671701341914365481186446303719656617243678901998494782637847628119023876650244387440525171537115728772449014481872071, Q:832165918110642932865296677897233797470791928577, G:45710335010743906175172359887947291464946349254698214926126198012254417027163534549930512227720529453527812583090856824470895904385213843846478788439650923858707625528883721182368810782074418622955266070744886120496437975321603647691691785855608495718858707179099826464685770134027417598116971534482882955896}, Y:156527414827976273333470358776490302124383937379242530509323609715449789732336069914169957260987424440278372270165376235659769589602997045461900077747446091360682548418273726245607350047870147307811900550045251583664693054861184446136606830815561121439743970433898383744356459189167096821175929531468417688750}
FAIL
FAIL    golang.org/x/crypto/ssh 5.972s
ok      golang.org/x/crypto/ssh/agent   4.649s
ok      golang.org/x/crypto/ssh/internal/bcrypt_pbkdf   4.979s
ok      golang.org/x/crypto/ssh/knownhosts      4.490s
ok      golang.org/x/crypto/ssh/test    7.899s
ok      golang.org/x/crypto/tea 4.762s
ok      golang.org/x/crypto/twofish     5.000s
ok      golang.org/x/crypto/x509roots/nss       4.993s
ok      golang.org/x/crypto/xtea        5.036s
ok      golang.org/x/crypto/xts 5.046s
FAIL