Library quirk enables SSH backdoor

A subtle return value from a common C library (musl's crypt() returning '*') combined with a historical change in OpenSSH can turn an account intentionally configured to disable passwords into a login vector when attackers submit oversize passwords. The result is a decades‑old, low‑noise authentication bypass affecting routers, IoT devices and embedded Linux distributions that use musl (Alpine, OpenWrt, Buildroot, Yocto). — It shows how upstream open‑source library behaviors and well‑intentioned mitigations can interact to create long‑running systemic vulnerabilities in widely deployed infrastructure, changing how we should audit, maintain, and legislate software supply‑chain security.