There's a very detailed trace of how the bug was developed over decades at sshhole.com and the relevant discussion in https://news.ycombinator.com/item?id=50378228

TBH that sounds like a straight up bug in that it deviates dangerously from the spec.