If you run Alpine, OpenWrt, Buildroot, Yocto, or any container image built on musl without PAM, go and check your OpenSSH version before you read the rest. Fixed in 10.6p2 (2026-11-05). It is in CISA KEV with a 2026-11-12 federal due date, and someone logged into a honeypot as root less than nine hours after the CVE went public.

For everyone else, the interesting part is why it works, because the mechanism is a genuinely instructive collision.

The collision

Two failure tokens, one byte:

1980, 3BSD: /etc/passwd marks an account that must never accept a password by putting * in the hash field. It is still the convention in /etc/shadow today. Nothing can hash to * .

2012, musl commit b3c4cc12 : crypt() stops returning NULL on failure and returns "*" instead, because callers that skip the null check were segfaulting. Twenty days later, sha256/sha512crypt adds a 256-byte input cap (a DoS guard — sha512crypt cost scales with input) and returns the same "*" when it refuses.

Both decisions are defensible.…