@damienmiller
Do you have any information about the musl vulnerability? Is it one already fixed upstream (is it that regex thing)?
Do you know if Dropbear SSH is also affected (used commonly on embedded systems with musl)?