Specifying a bind_address for the -R option does not seem to have any effect - the socket is always bound to 127.0.0.1 and [::1]. There is no such problem with local forwards (-L). Using OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8e 23 Feb 2007 on both ends.
Created attachment 1253 [details] Server debug output
Created attachment 1254 [details] Client debug output
That was bound to happen. Of course this behaviour is by design, I just didn't look hard enough. So now I'm requesting that there be some feedback to the client if the server quietly bumps the bind to onto localhost. (Sorry for my noise.)
Created attachment 1515 [details] send notification in debug message Unfortunately there isn't any clean way for the server to inform the client - the best we can do is a debug message (see attachment). I'm not sure whether it is worth it...
patch applied; will be in openssh-6.4
Set all RESOLVED bugs to CLOSED with release of OpenSSH 7.1