I found an issue with select() not called properly in the ssh_exchange_identification(). Variable "fdset" is passed as readfd, exceptionfd to the select(). Select() should be called with independent fdset so we should have two different variables instead of reusing the same variable "fdset". The reported issue is in line 566, 567 (sshconnect.c file).
Thanks for reminding me. This has been committed and will be in openssh-7.6 https://anongit.mindrot.org/openssh.git/commit/?id=4540428cd0adf039bcf5a8a27f2d5cdf09191513
closing resolved bugs as of 8.6p1 release