When you ask ssh-keyscan to scan something that isn't an SSH server, it sometimes fatals before scanning the rest of the list, rather than printing a debug message and continuing as it's supposed to. This appears to be because remote_major and remote_minor aren't initialized in congreet(), so if the sscanf() for the SSH version banner fails then they just contain whatever happens to be on the stack. A patch will follow in a moment.
Created attachment 570 [details] Initialize remote_major and remote_minor for each connection
Applied - thanks.
Mass change of RESOLVED bugs to CLOSED