ktls: appears to be broken for some hardware combinations

Describe the bug
haproxy32-3.2.20_1 (bundled with os-haproxy 5.1 on OPNsense 26.7.r2) emits
protocol-invalid HTTP/2 frames when a client multiplexes many concurrent
streams on one connection: a ":status" pseudo-header appears in a
subsequent HEADERS frame, which is illegal per RFC 9113. Compliant clients
(nghttp2, all browsers) treat this as a connection error and kill the
session, so all in-flight streams fail. Practical effect: asset-heavy
pages behind haproxy load partially/intermittently (first observed on the
OPNsense GUI itself behind the proxy: dashboard widgets missing, icon
fonts never loading). Single requests succeed, which hides the bug from
simple tests.

To Reproduce
Against any haproxy TLS frontend with h2 enabled, any static asset:

seq 1 24 | xargs -I{} echo "https:///" |
xargs curl -sk --http2 -Z --parallel-max 24 -o /dev/null
-w "%{http_code} %{size_download} %{errormsg}\n"

Output on 3.2.20 (all 24 streams fail):

200 0 Invalid HTTP header field was received: frame type: 1, stream: 5,
name: [:status], value: [200]
200 0 process_pending_input: nghttp2_session_mem_recv() returned
-902:The user callback function failed
200 0 Failure writing output to destination, passed 15009 ...

Identical command with --http1.1: 24x "200 " — h1 path clean.

Expected behavior
24x complete transfers over h2, as on 26.1.

Relevant version info
haproxy -v: HAProxy version 3.2.20-9d6f82e72 2026/06/26
OPNsense 26.7.r2 (amd64), FreeBSD 15.1-RELEASE-p1, os-haproxy-5.1

haproxy 3.2.20's known-bugs page lists "BUG/MAJOR: htx: Don't swap
buffers for empty HTX message with an error", fixed in 3.2.21 released
2026-07-03. Requesting a bump of haproxy32 to 3.2.21 — ideally before
26.7 GA, since every reverse-proxy deployment is affected and the
failure mode is silent response corruption.

Workaround: disable HTTP/2 / set ALPN to http11 on frontends.