开启 tun 时，ssh 对 ipv6 无法发送命令，但是可以登陆进 shell

Operating system

Linux

System version

Archlinux with Linux 6.19.6

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.13.2

Environment: go1.26.1-X:nodwarf5 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_naive_outbound,badlinkname,tfogo_checklinkname0
CGO: enabled

Description

当使用 tun 模式时，tun 网卡同时配置了 v4 和 v6 地址，此时可以通过 ssh 正常登录进其它机器的 shell ，但是无法通过 ssh 发送命令比如 ssh root@2001::1 ls
抓包发现会有很多类似
901 12.741596184 fdfe:dcba:9876::1 2400:8a20:112:1::200 TCP 138 [TCP Retransmission] 44020 → 22 [PSH, ACK] Seq=4995 Ack=4522 Win=88064 Len=52 TSval=895386009 TSecr=3407417391 的重传包

Reproduction

{
  "log": {
    "level": "trace",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "type": "https",
        "tag": "google",
        "detour": "PROXY",
        "server": "8.8.8.8"
      },
      {
        "type": "https",
        "tag": "cndns",
        "server": "1.12.12.12"
      },
      {
        "type": "fakeip",
        "tag": "fakeip",
        "inet4_range": "198.18.0.0/15",
        "inet6_range": "fc00::/18"
      }
    ],
    "rules": [
      {
        "clash_mode": "Direct",
        "server": "cndns"
      },
      {
        "query_type": "HTTPS",
        "action": "reject"
      },
      {
        "query_type": [
          "A",
          "AAAA"
        ],
        "server": "fakeip",
        "rewrite_ttl": 1
      },
      {
        "clash_mode": "Global",
        "server": "google"
      }
    ],
    "final": "google",
    "strategy": "prefer_ipv4",
    "independent_cache": true
  },
  "inbounds": [
    {
      "type": "tun",
      "mtu": 9000,
      "address": [
        "172.18.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "auto_route": true,
      "strict_route": true,
      "stack": "mixed",
      "endpoint_independent_nat": true
    },
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
      "listen_port": 7890
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "PROXY",
      "outbounds": [
        "DIRECT"
      ]
    },
    {
      "type": "direct",
      "tag": "DIRECT"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff",
        "sniffer": [
          "http",
          "tls",
          "quic",
          "dns",
          "ssh"
        ]
      },
      {
        "type": "logical",
        "mode": "or",
        "rules": [
          {
            "port": 53
          },
          {
            "protocol": "dns"
          }
        ],
        "action": "hijack-dns"
      },
      {
        "protocol": "ssh",
        "outbound": "DIRECT"
      },
      {
        "ip_is_private": true,
        "outbound": "DIRECT"
      },
      {
        "clash_mode": "Direct",
        "outbound": "DIRECT"
      },
      {
        "clash_mode": "Global",
        "outbound": "PROXY"
      },

      {
        "action": "resolve",
        "strategy": "prefer_ipv4"
      }
    ],
    "rule_set": [
    ],
    "final": "PROXY",
    "auto_detect_interface": true,
    "default_domain_resolver": "cndns"
  }
}

git ssh log

debug1: OpenSSH_10.2p1, OpenSSL 3.6.1 27 Jan 2026
debug3: Running on Linux 6.19.6-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Wed, 04 Mar 2026 18:24:56 +0000 x86_64
debug3: Started with: ssh -vvv root@2400:8a20:112:1::200 ls
debug1: Reading configuration data /home/cherrling/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 2: Including file /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
debug2: resolve_canonicalize: hostname 2400:8a20:112:1::200 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/cherrling/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/cherrling/.ssh/known_hosts2'
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to 2400:8a20:112:1::200 [2400:8a20:112:1::200] port 22.
debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0xb8
debug1: Connection established.
debug1: loaded pubkey from /home/cherrling/.ssh/id_rsa: RSA SHA256:fmkKbMqFPtvUigpByLbHdar3SqFgFbGR2iETm36RyIs
debug1: identity file /home/cherrling/.ssh/id_rsa type 0
debug1: no identity pubkey loaded from /home/cherrling/.ssh/id_rsa
debug1: no pubkey loaded from /home/cherrling/.ssh/id_ecdsa
debug1: identity file /home/cherrling/.ssh/id_ecdsa type -1
debug1: no identity pubkey loaded from /home/cherrling/.ssh/id_ecdsa
debug1: no pubkey loaded from /home/cherrling/.ssh/id_ecdsa_sk
debug1: identity file /home/cherrling/.ssh/id_ecdsa_sk type -1
debug1: no identity pubkey loaded from /home/cherrling/.ssh/id_ecdsa_sk
debug1: loaded pubkey from /home/cherrling/.ssh/id_ed25519: ED25519 SHA256:lWH0RggM6AjVzUY/SYqsW/98ZKXSGB99e3bh7buCvsA
debug1: identity file /home/cherrling/.ssh/id_ed25519 type 2
debug1: no identity pubkey loaded from /home/cherrling/.ssh/id_ed25519
debug1: no pubkey loaded from /home/cherrling/.ssh/id_ed25519_sk
debug1: identity file /home/cherrling/.ssh/id_ed25519_sk type -1
debug1: no identity pubkey loaded from /home/cherrling/.ssh/id_ed25519_sk
debug1: Local version string SSH-2.0-OpenSSH_10.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_10.0p2 Debian-7
debug1: compat_banner: match: OpenSSH_10.0p2 Debian-7 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 2400:8a20:112:1::200:22 as 'root'
debug3: record_hostkey: found key type ED25519 in file /home/cherrling/.ssh/known_hosts:257
debug3: load_hostkeys_file: loaded 1 keys from 2400:8a20:112:1::200
debug1: load_hostkeys: fopen /home/cherrling/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,ext-info-s,kex-strict-s-v00@openssh.com
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug3: kex_choose_conf: will use strict KEX ordering
debug1: kex: algorithm: mlkem768x25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:4aaB3x6i+jBiEpVyk2+jgOf6eXT9tZzLBsDpf8kqvds
debug3: record_hostkey: found key type ED25519 in file /home/cherrling/.ssh/known_hosts:257
debug3: load_hostkeys_file: loaded 1 keys from 2400:8a20:112:1::200
debug1: load_hostkeys: fopen /home/cherrling/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '2400:8a20:112:1::200' is known and matches the ED25519 host key.
debug1: Found key in /home/cherrling/.ssh/known_hosts:257
debug3: send packet: type 21
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: Sending SSH2_MSG_EXT_INFO
debug3: send packet: type 7
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug2: KEX algorithms: mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256>
debug3: kex_input_ext_info: extension publickey-hostbound@openssh.com
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug3: kex_input_ext_info: extension ping@openssh.com
debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256>
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Will attempt key: /home/cherrling/.ssh/id_rsa RSA SHA256:fmkKbMqFPtvUigpByLbHdar3SqFgFbGR2iETm36RyIs
debug1: Will attempt key: /home/cherrling/.ssh/id_ecdsa 
debug1: Will attempt key: /home/cherrling/.ssh/id_ecdsa_sk 
debug1: Will attempt key: /home/cherrling/.ssh/id_ed25519 ED25519 SHA256:lWH0RggM6AjVzUY/SYqsW/98ZKXSGB99e3bh7buCvsA
debug1: Will attempt key: /home/cherrling/.ssh/id_ed25519_sk 
debug2: pubkey_prepare: done
debug1: Offering public key: /home/cherrling/.ssh/id_rsa RSA SHA256:fmkKbMqFPtvUigpByLbHdar3SqFgFbGR2iETm36RyIs
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/cherrling/.ssh/id_rsa RSA SHA256:fmkKbMqFPtvUigpByLbHdar3SqFgFbGR2iETm36RyIs
debug3: sign_and_send_pubkey: using publickey-hostbound-v00@openssh.com with RSA SHA256:fmkKbMqFPtvUigpByLbHdar3SqFgFbGR2iETm36RyIs
debug3: sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:fmkKbMqFPtvUigpByLbHdar3SqFgFbGR2iETm36RyIs
debug3: send packet: type 50
debug3: receive packet: type 52
Authenticated to 2400:8a20:112:1::200 ([2400:8a20:112:1::200]:22) using "publickey".
debug2: fd 5 setting O_NONBLOCK
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting no-more-sessions@openssh.com
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: filesystem
debug3: client_repledge: enter
debug2: client_loop: session QoS is now interactive
debug2: fd 3 setting TCP_NODELAY
debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0xb8
debug3: receive packet: type 80
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug3: client_input_hostkeys: received RSA key SHA256:YhM1lnkHziJnkKZeLiERQHzZv4K1juiElmrIT4i6sHY
debug3: client_input_hostkeys: received ECDSA key SHA256:3Wg5+4E518GosPqUWFCsGI2GpA8KIO4/NGxzshURVwg
debug3: client_input_hostkeys: received ED25519 key SHA256:4aaB3x6i+jBiEpVyk2+jgOf6eXT9tZzLBsDpf8kqvds
debug1: client_input_hostkeys: searching /home/cherrling/.ssh/known_hosts for 2400:8a20:112:1::200 / (none)
debug3: hostkeys_foreach: reading file "/home/cherrling/.ssh/known_hosts"
debug3: hostkeys_find: found ssh-ed25519 key under different name/addr at /home/cherrling/.ssh/known_hosts:143
debug3: hostkeys_find: found ssh-rsa key under different name/addr at /home/cherrling/.ssh/known_hosts:144
debug3: hostkeys_find: found ecdsa-sha2-nistp256 key under different name/addr at /home/cherrling/.ssh/known_hosts:145
debug3: hostkeys_find: found ssh-ed25519 key at /home/cherrling/.ssh/known_hosts:257
debug1: client_input_hostkeys: searching /home/cherrling/.ssh/known_hosts2 for 2400:8a20:112:1::200 / (none)
debug1: client_input_hostkeys: hostkeys file /home/cherrling/.ssh/known_hosts2 does not exist
debug3: client_input_hostkeys: 3 server keys: 2 new, 18446744073709551615 retained, 2 incomplete match. 0 to remove
debug1: client_input_hostkeys: host key found matching a different name/address, skipping UserKnownHostsFile update
debug3: client_repledge: enter
debug3: receive packet: type 4
debug1: Remote: /root/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug3: receive packet: type 4
debug1: Remote: /root/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug3: receive packet: type 91
debug2: channel_input_open_confirmation: channel 0: callback start
debug2: client_session2_setup: id 0
debug1: Sending command: ls
debug2: channel 0: request exec confirm 1
debug3: send packet: type 98
debug3: client_repledge: enter
debug1: pledge: fork
debug2: channel_input_open_confirmation: channel 0: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: client_loop: session QoS is now non-interactive
debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x00

Logs

12857	02:54:42	debug  	[3317628595 1m30s] connection: connection download finished
12856	02:54:42	trace  	[3317628595 1m30s] connection: connection upload closed
12855	02:54:42	debug  	[4229018518 33.22s] connection: connection upload finished
12854	02:54:42	trace  	[4229018518 33.22s] connection: connection download closed
12853	02:54:40	info   	[4278608672 0ms] outbound/direct[DIRECT]: outbound connection to [2400:8a20:112:1::200]:22
12852	02:54:40	debug  	[4278608672 0ms] router: match[2] protocol=ssh => route(DIRECT)
12851	02:54:40	debug  	[4278608672 0ms] router: sniffed protocol: ssh
12850	02:54:40	debug  	[4278608672 0ms] router: match[0] => sniff(http,tls,quic,dns,ssh)
12849	02:54:40	info   	[4278608672 0ms] inbound/tun[0]: inbound connection to [2400:8a20:112:1::200]:22
12848	02:54:40	info   	[4278608672 0ms] inbound/tun[0]: inbound connection from [fdfe:dcba:9876::1]:45442

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reproducing the SSH IPv6 command failure with the provided sing-box configuration and compare it with an interactive shell session. Trace the TUN inbound's IPv6 packet handling and the retransmissions shown in the capture. Done means commands sent through an IPv6 SSH connection complete successfully while the same configuration still permits shell login.