Post-mortem: nginx answered our QUIC deadlock report

A maintainer reproduced the handshake deadlock and a core developer explained why the code meant to prevent it never fires. Two commits, from 2020 and 2021, neither wrong on its own.

TL;DR

An nginx maintainer reproduced our QUIC handshake deadlock on 4 August; a core developer posted a fuller diagnosis on 5 August.
It names two commits. 7bd386871 (Oct 2020) added "speeding up handshake completion" - resend CRYPTO when duplicate CRYPTO arrives. It runs on every failed handshake and its output is discarded by congestion control one layer down.
5d4e864e0 (Feb 2021) replaced PTO retransmission of unacknowledged data with two PING frames. A PING carries no CRYPTO, so the second escape hatch stopped compensating for the first.
Neither commit is wrong on its own. The defect exists only in the overlap - which is why it survived review and sat for five and a half years.
It became reachable when post-quantum key exchange grew the ServerHello past one packet (X25519MLKEM768, 1088-byte key share).
Still open, no fix in the default branch, verified 26 August. Also: we had promised to track the thread and checked the status field instead of the conversation, missing the answer for three weeks.

Full write-up: Two Ways Out of a QUIC Deadlock, Both Closed Years Ago.