diff -ur '--exclude=.*.un~' '--exclude=*.rej' '--exclude=*.orig' a/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff b/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff
--- a/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff	2024-03-21 15:01:05.670551713 -0700
+++ b/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff	2024-03-21 15:01:28.194712065 -0700
@@ -157,10 +157,49 @@
 +	 Allan Jude provided the code for the NoneMac and buffer normalization.
 +         This work was financed, in part, by Cisco System, Inc., the National
 +         Library of Medicine, and the National Science Foundation.
+diff --git a/auth2.c b/auth2.c
+--- a/auth2.c	2021-03-15 19:30:45.404060786 -0700
++++ b/auth2.c	2021-03-15 19:37:22.078476597 -0700
+@@ -229,16 +229,17 @@
+ 	double delay;
+ 
+ 	digest_alg = ssh_digest_maxbytes();
+-	len = ssh_digest_bytes(digest_alg);
+-	hash = xmalloc(len);
++	if (len = ssh_digest_bytes(digest_alg) > 0) {
++		hash = xmalloc(len);
+ 
+-	(void)snprintf(b, sizeof b, "%llu%s",
+-	    (unsigned long long)options.timing_secret, user);
+-	if (ssh_digest_memory(digest_alg, b, strlen(b), hash, len) != 0)
+-		fatal_f("ssh_digest_memory");
+-	/* 0-4.2 ms of delay */
+-	delay = (double)PEEK_U32(hash) / 1000 / 1000 / 1000 / 1000;
+-	freezero(hash, len);
++		(void)snprintf(b, sizeof b, "%llu%s",
++		    (unsigned long long)options.timing_secret, user);
++		if (ssh_digest_memory(digest_alg, b, strlen(b), hash, len) != 0)
++			fatal_f("ssh_digest_memory");
++		/* 0-4.2 ms of delay */
++		delay = (double)PEEK_U32(hash) / 1000 / 1000 / 1000 / 1000;
++		freezero(hash, len);
++	}
+ 	debug3_f("user specific delay %0.3lfms", delay/1000);
+ 	return MIN_FAIL_DELAY_SECONDS + delay;
+ }
 diff --git a/channels.c b/channels.c
 index b60d56c4..0e363c15 100644
 --- a/channels.c
 +++ b/channels.c
+@@ -90,7 +90,7 @@
+ # define CHAN_RBUF	(64*1024)
+ #endif
+ #ifndef CHAN_RBUF
+-# define CHAN_RBUF	(4*1024)
++# define CHAN_RBUF	CHAN_SES_PACKET_DEFAULT
+ #endif
+ /*	64к	32к	16к	8к	4к
+ orig:	3.635	3.657	1(*)	0.688	0.615
 @@ -220,6 +220,10 @@ static int rdynamic_connect_finish(struct ssh *, Channel *);
  /* Setup helper */
  static void channel_handler_init(struct ssh_channels *sc);
@@ -209,14 +248,14 @@
  static void
  channel_pre_open(struct ssh *ssh, Channel *c,
      fd_set *readset, fd_set *writeset)
-@@ -2120,22 +2147,32 @@ channel_check_window(struct ssh *ssh, Channel *c)
+@@ -2164,21 +2191,31 @@ channel_check_window(struct ssh *ssh, Channel *c)
  
  	if (c->type == SSH_CHANNEL_OPEN &&
  	    !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
 -	    ((c->local_window_max - c->local_window >
 -	    c->local_maxpacket*3) ||
-+            ((ssh_packet_is_interactive(ssh) &&
-+            c->local_window_max - c->local_window > c->local_maxpacket*3) ||
++	    ((ssh_packet_is_interactive(ssh) &&
++	    c->local_window_max - c->local_window > c->local_maxpacket*3) ||
  	    c->local_window < c->local_window_max/2) &&
  	    c->local_consumed > 0) {
 +		u_int addition = 0;
@@ -235,9 +274,8 @@
  		    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
 -		    (r = sshpkt_put_u32(ssh, c->local_consumed)) != 0 ||
 +		    (r = sshpkt_put_u32(ssh, c->local_consumed + addition)) != 0 ||
- 		    (r = sshpkt_send(ssh)) != 0) {
- 			fatal_fr(r, "channel %i", c->self);
- 		}
+ 		    (r = sshpkt_send(ssh)) != 0)
+ 			fatal_fr(r, "channel %d", c->self);
 -		debug2("channel %d: window %d sent adjust %d", c->self,
 -		    c->local_window, c->local_consumed);
 -		c->local_window += c->local_consumed;
@@ -302,15 +340,6 @@
  	int     extended_usage;
  	int	single_connection;
  
-@@ -221,7 +222,7 @@ struct Channel {
- #define CHAN_LOCAL			0x10
- 
- /* Read buffer size */
--#define CHAN_RBUF	(16*1024)
-+#define CHAN_RBUF	CHAN_SES_PACKET_DEFAULT
- 
- /* Maximum channel input buffer size */
- #define CHAN_INPUT_MAX	(16*1024*1024)
 @@ -352,4 +353,7 @@ void	 chan_rcvd_ieof(struct ssh *, Channel *);
  void	 chan_write_failed(struct ssh *, Channel *);
  void	 chan_obuf_empty(struct ssh *, Channel *);
@@ -337,44 +366,46 @@
 index 70f492f8..5503af1d 100644
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -1578,9 +1578,11 @@ client_request_x11(struct ssh *ssh, const char *request_type, int rchan)
+@@ -1578,10 +1578,11 @@ client_request_x11(struct ssh *ssh, const char *request_type, int rchan)
  	sock = x11_connect_display(ssh);
  	if (sock < 0)
  		return NULL;
 -	c = channel_new(ssh, "x11-connection",
 -	    SSH_CHANNEL_X11_OPEN, sock, sock, -1,
--	    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
-+        c = channel_new(ssh, "x11-connection",
-+			SSH_CHANNEL_X11_OPEN, sock, sock, -1,
-+			/* again is this really necessary for X11? */
-+			options.hpn_disabled ? CHAN_TCP_WINDOW_DEFAULT : options.hpn_buffer_size,
-+			CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
+-	    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11",
+-	    CHANNEL_NONBLOCK_SET);
++	c = channel_new(ssh, "x11-connection",
++	    SSH_CHANNEL_X11_OPEN, sock, sock, -1,
++	    /* again is this really necessary for X11? */
++	    options.hpn_disabled ? CHAN_TCP_WINDOW_DEFAULT : options.hpn_buffer_size,
++	    CHAN_X11_PACKET_DEFAULT, 0, "x11", CHANNEL_NONBLOCK_SET);
  	c->force_drain = 1;
  	return c;
  }
-@@ -1608,9 +1610,10 @@ client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
+@@ -1608,9 +1609,10 @@ client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
  		debug2_fr(r, "ssh_agent_bind_hostkey");
  
  	c = channel_new(ssh, "agent-connection",
 -	    SSH_CHANNEL_OPEN, sock, sock, -1,
 -	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
--	    "authentication agent connection", 1);
+-	    "authentication agent connection", CHANNEL_NONBLOCK_SET);
 +			SSH_CHANNEL_OPEN, sock, sock, -1,
 +			options.hpn_disabled ? CHAN_X11_WINDOW_DEFAULT : options.hpn_buffer_size,
 +			CHAN_TCP_PACKET_DEFAULT, 0,
-+			"authentication agent connection", 1);
++			"authentication agent connection", CHANNEL_NONBLOCK_SET);
  	c->force_drain = 1;
  	return c;
  }
-@@ -1635,10 +1638,13 @@ client_request_tun_fwd(struct ssh *ssh, int tun_mode,
+@@ -1635,11 +1637,13 @@ client_request_tun_fwd(struct ssh *ssh, int tun_mode,
  	}
  	debug("Tunnel forwarding using interface %s", ifname);
  
 -	c = channel_new(ssh, "tun-connection", SSH_CHANNEL_OPENING, fd, fd, -1,
--	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
+-	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun",
+-	    CHANNEL_NONBLOCK_SET);
 +        c = channel_new(ssh, "tun-connection", SSH_CHANNEL_OPENING, fd, fd, -1,
 +	    options.hpn_disabled ? CHAN_TCP_WINDOW_DEFAULT : options.hpn_buffer_size,
-+	    CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
++	    CHAN_TCP_PACKET_DEFAULT, 0, "tun", CHANNEL_NONBLOCK_SET);
  	c->datagram = 1;
  
 +
@@ -386,21 +417,38 @@
 index 69befa96..90b5f338 100644
 --- a/compat.c
 +++ b/compat.c
+@@ -41,6 +41,6 @@ compat_banner(struct ssh *ssh, const char *version)
+ /* datafellows bug compatibility */
+ static u_int
+-compat_datafellows(const char *version)
++compat_datafellows(const struct ssh *ssh, const char *version)
+ {
+ 	int i;
+ 	static struct {
 @@ -149,6 +149,14 @@ compat_banner(struct ssh *ssh, const char *version)
- 			debug_f("match: %s pat %s compat 0x%08x",
+ 		if (match_pattern_list(version, check[i].pat, 0) == 1) {
+ 			debug("match: %s pat %s compat 0x%08x",
  			    version, check[i].pat, check[i].bugs);
- 			ssh->compat = check[i].bugs;
 +			/* Check to see if the remote side is OpenSSH and not HPN */
 +			/* TODO: need to use new method to test for this */
 +			if (strstr(version, "OpenSSH") != NULL) {
 +				if (strstr(version, "hpn") == NULL) {
-+					ssh->compat |= SSH_BUG_LARGEWINDOW;
++					check[i].bugs |= SSH_BUG_LARGEWINDOW;
 +					debug("Remote is NON-HPN aware");
 +				}
 +			}
- 			return;
+ 			return check[i].bugs;
  		}
  	}
+@@ -256,7 +256,7 @@
+ 		flags->extra = 0;
+ 		return;
+ 	}
+-	flags->datafellows = compat_datafellows(remote_version);
++	flags->datafellows = compat_datafellows(ssh, remote_version);
+ 	flags->extra = xkey_compatibility(remote_version);
+ }
+ 
 diff --git a/compat.h b/compat.h
 index c197fafc..ea2e17a7 100644
 --- a/compat.h
@@ -413,19 +461,6 @@
  
  struct ssh;
  
-diff --git a/defines.h b/defines.h
-index d6a1d014..911c5120 100644
---- a/defines.h
-+++ b/defines.h
-@@ -848,7 +848,7 @@ struct winsize {
- #endif
- 
- #ifndef SSH_IOBUFSZ
--# define SSH_IOBUFSZ 8192
-+# define SSH_IOBUFSZ 32*1024
- #endif
- 
- /*
 diff --git a/digest-openssl.c b/digest-openssl.c
 index e073a807..fc0257e3 100644
 --- a/digest-openssl.c
@@ -459,7 +494,7 @@
 @@ -890,6 +890,10 @@ kex_choose_conf(struct ssh *ssh)
  	int nenc, nmac, ncomp;
  	u_int mode, ctos, need, dh_need, authlen;
- 	int r, first_kex_follows;
+ 	int r, first_kex_follows = 0;
 +	int auth_flag = 0;
 +
 +	auth_flag = packet_authentication_state(ssh);
@@ -503,7 +538,21 @@
 index 4bd8b4ec..22b81f2d 100644
 --- a/packet.c
 +++ b/packet.c
-@@ -245,7 +245,7 @@ ssh_alloc_session_state(void)
+@@ -99,6 +99,13 @@
+ #define DBG(x)
+ #endif
+ 
++#if defined(HAVE_CYGWIN) && !defined(SSH_IOBUFSZ)
++# define SSH_IOBUFSZ    (64*1024)
++#endif
++#ifndef SSH_IOBUFSZ
++# define SSH_IOBUFSZ    (32*1024)
++#endif
++
+ #define PACKET_MAX_SIZE (256 * 1024)
+ 
+ static inline void
+@@ -245,7 +252,7 @@ ssh_alloc_session_state(void)
  	TAILQ_INIT(&ssh->public_keys);
  	state->connection_in = -1;
  	state->connection_out = -1;
@@ -512,7 +561,7 @@
  	state->packet_timeout_ms = -1;
  	state->p_send.packets = state->p_read.packets = 0;
  	state->initialized = 1;
-@@ -942,10 +942,19 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+@@ -942,10 +949,19 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
  	 * so enforce a 1GB limit for small blocksizes.
  	 * See RFC4344 section 3.2.
  	 */
@@ -536,7 +585,7 @@
  	if (state->rekey_limit)
  		*max_blocks = MINIMUM(*max_blocks,
  		    state->rekey_limit / enc->block_size);
-@@ -954,6 +963,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+@@ -954,6 +970,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
  	return 0;
  }
  
@@ -553,14 +602,14 @@
  #define MAX_PACKETS	(1U<<31)
  static int
  ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
-@@ -1317,8 +1336,8 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+@@ -1317,8 +1343,8 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ {
  	struct session_state *state = ssh->state;
- 	int len, r, ms_remain = 0;
- 	struct pollfd pfd;
+ 	int r, ms_remain;
 -	char buf[8192];
 +	char buf[SSH_IOBUFSZ];
  	struct timeval start;
- 	struct timespec timespec, *timespecp = NULL;
+ 	struct timespec timeout, *timeoutp;
  
  	DBG(debug("packet_read()"));
 diff --git a/packet.h b/packet.h
@@ -1071,7 +1120,7 @@
 +	else
 +		options.hpn_buffer_size = 2 * 1024 * 1024;
 +
-+	if (ssh->compat & SSH_BUG_LARGEWINDOW) {
++	if (ssh_compat_fellows(ssh, SSH_BUG_LARGEWINDOW)) {
 +		debug("HPN to Non-HPN Connection");
 +	} else {
 +		int sock, socksize;
@@ -1135,14 +1184,14 @@
  	}
 @@ -2089,6 +2167,11 @@ ssh_session2_open(struct ssh *ssh)
  	    window, packetmax, CHAN_EXTENDED_WRITE,
- 	    "client-session", /*nonblock*/0);
+ 	    "client-session", CHANNEL_NONBLOCK_STDIO);
  
 +	if ((options.tcp_rcv_buf_poll > 0) && !options.hpn_disabled) {
 +		c->dynamic_window = 1;
 +		debug("Enabled Dynamic Window Scaling");
 +	}
 +
- 	debug3_f("channel_new: %d", c->self);
+ 	debug2_f("channel %d", c->self);
  
  	channel_send_open(ssh, c->self);
 @@ -2105,6 +2188,13 @@ ssh_session2(struct ssh *ssh, const struct ssh_conn_info *cinfo)
@@ -1226,9 +1275,9 @@
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
 @@ -74,6 +74,7 @@
+ #include "hostfile.h"
+ #include "ssherr.h"
  #include "utf8.h"
- #include "ssh-sk.h"
- #include "sk-api.h"
 +#include "myproposal.h"
 
  #ifdef GSSAPI
@@ -1247,7 +1296,7 @@
  /*
   * SSH2 key exchange
   */
-@@ -212,6 +219,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
+@@ -212,6 +220,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
  	return ret;
  }
  
@@ -1256,7 +1305,7 @@
  void
  ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
      const struct ssh_conn_info *cinfo)
-@@ -220,6 +229,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+@@ -220,6 +230,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
  	char *s, *all_key;
  	int r, use_known_hosts_order = 0;
  
@@ -1265,7 +1314,7 @@
  	xxx_host = host;
  	xxx_hostaddr = hostaddr;
  	xxx_conn_info = cinfo;
-@@ -489,6 +500,33 @@ ssh_userauth2(struct ssh *ssh, const char *local_user,
+@@ -489,6 +501,33 @@ ssh_userauth2(struct ssh *ssh, const char *local_user,
  
  	if (!authctxt.success)
  		fatal("Authentication failed.");
@@ -1324,7 +1373,29 @@
  		/* Bind the socket to the desired port. */
  		if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) == -1) {
  			error("Bind to port %s on %s failed: %.200s.",
-@@ -1727,6 +1734,19 @@ main(int ac, char **av)
+@@ -1625,13 +1632,14 @@
+ 		if (ssh_digest_update(ctx, sshbuf_ptr(server_cfg),
+ 		    sshbuf_len(server_cfg)) != 0)
+ 			fatal_f("ssh_digest_update");
+-		len = ssh_digest_bytes(digest_alg);
+-		hash = xmalloc(len);
+-		if (ssh_digest_final(ctx, hash, len) != 0)
+-			fatal_f("ssh_digest_final");
+-		options.timing_secret = PEEK_U64(hash);
+-		freezero(hash, len);
+-		ssh_digest_free(ctx);
++		if ((len = ssh_digest_bytes(digest_alg)) > 0) {
++			hash = xmalloc(len);
++			if (ssh_digest_final(ctx, hash, len) != 0)
++				fatal_f("ssh_digest_final");
++			options.timing_secret = PEEK_U64(hash);
++			freezero(hash, len);
++			ssh_digest_free(ctx);
++		}
+ 		ctx = NULL;
+ 		return;
+ 	}
+@@ -1727,6 +1735,19 @@ main(int ac, char **av)
  		fatal("AuthorizedPrincipalsCommand set without "
  		    "AuthorizedPrincipalsCommandUser");
  
@@ -1344,7 +1415,7 @@
  	/*
  	 * Check whether there is any path through configured auth methods.
  	 * Unfortunately it is not possible to verify this generally before
-@@ -2166,6 +2186,9 @@ main(int ac, char **av)
+@@ -2166,6 +2187,9 @@ main(int ac, char **av)
  	    rdomain == NULL ? "" : "\"");
  	free(laddr);
  
@@ -1354,7 +1425,7 @@
  	/*
  	 * We don't want to listen forever unless the other side
  	 * successfully authenticates itself.  So we set up an alarm which is
-@@ -2343,6 +2366,12 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -2343,6 +2367,12 @@ do_ssh2_kex(struct ssh *ssh)
  	struct kex *kex;
  	int r;
  
diff -ur '--exclude=.*.un~' '--exclude=*.rej' '--exclude=*.orig' a/openssh-8_5_P1-hpn-PeakTput-15.2.diff b/openssh-8_5_P1-hpn-PeakTput-15.2.diff
--- a/openssh-8_5_P1-hpn-PeakTput-15.2.diff	2024-03-21 15:01:05.670551713 -0700
+++ b/openssh-8_5_P1-hpn-PeakTput-15.2.diff	2024-03-21 15:01:28.194712065 -0700
@@ -12,9 +12,9 @@
  static long stalled;		/* how long we have been stalled */
  static int bytes_per_second;	/* current speed in bytes per second */
 @@ -127,6 +129,7 @@ refresh_progress_meter(int force_update)
+ 	off_t bytes_left;
  	int cur_speed;
- 	int hours, minutes, seconds;
- 	int file_len, cols;
+ 	int len;
 +	off_t delta_pos;
  
  	if ((!force_update && !alarm_fired && !win_resized) || !can_output())
@@ -30,45 +30,22 @@
  	if (bytes_left > 0)
  		elapsed = now - last_update;
  	else {
-@@ -171,13 +178,14 @@ refresh_progress_meter(int force_update)
- 		bytes_per_second = cur_speed;
- 
- 	last_update = now;
-+	last_pos = cur_pos;
- 
- 	/* Don't bother if we can't even display the completion percentage */
- 	if (win_size < 4)
- 		return;
- 
- 	/* filename */
--	file_len = cols = win_size - 36;
-+	file_len = cols = win_size - 45;
- 	if (file_len > 0) {
- 		asmprintf(&buf, INT_MAX, &cols, "%-*s", file_len, file);
- 		/* If we used fewer columns than expected then pad */
-@@ -191,6 +198,13 @@ refresh_progress_meter(int force_update)
+@@ -191,6 +198,15 @@ refresh_progress_meter(int force_update)
  	    (off_t)bytes_per_second);
  	strlcat(buf, "/s ", win_size);
  
 +	/* instantaneous rate */
 +	if (bytes_left > 0)
-+		format_rate((off_t)delta_pos);
++		format_rate(buf + strlen(buf), win_size - strlen(buf),
++			    delta_pos);
 +	else
-+		format_rate((off_t)max_delta_pos);
++		format_rate(buf + strlen(buf), win_size - strlen(buf),
++			    max_delta_pos);
 +	strlcat(buf, "/s ", win_size);
 +
  	/* ETA */
  	if (!transferred)
  		stalled += elapsed;
-diff --git a/ssh-keygen.c b/ssh-keygen.c
-index cfb5f115..986ff59b 100644
---- a/ssh-keygen.c
-+++ b/ssh-keygen.c
-@@ -2959,7 +2959,6 @@ do_download_sk(const char *skprovider, const char *device)
- 
- 	if (skprovider == NULL)
- 		fatal("Cannot download keys without provider");
--
- 	pin = read_passphrase("Enter PIN for authenticator: ", RP_ALLOW_STDIN);
- 	if (!quiet) {
- 		printf("You may need to touch your authenticator "
+@@ -227 +243,2 @@ refresh_progress_meter(int force_update)
+ 	last_update = now;
++	last_pos = cur_pos;
