patch kex

packages/bare-os-openssh/vendor/bare-ssh2/lib/protocol/kex.js

@@ -1697,6 +1697,12 @@ function onKEXPayload(state, payload) {
       }
       state.firstPacket = false
       return handleKexInit(this, payload)
+    case MESSAGE.EXT_INFO:
+      // OpenSSH 9.6+ may send RFC 8308 EXT_INFO during initial KEX (before
+      // KEX_ECDH_INIT). Strict KEX mode otherwise treats type 7 as < 20 and
+      // fails the handshake; handle it like post-NEWKEYS transport.
+      if (!MESSAGE_HANDLERS) MESSAGE_HANDLERS = require('./handlers.js')
+      return MESSAGE_HANDLERS[MESSAGE.EXT_INFO](this, payload)
     default:
       // Ensure packet is either an algorithm negotiation or KEX
       // algorithm-specific packet