tl;dr: OpenSSH on musl-based Linux (Alpine, OpenWrt, etc.) without PAM has accepted any password between 257 and 1024 characters for accounts with `*` in their shadow field (locked/key-only accounts like root on Alpine's AWS/Azure images). The bug stems from musl's crypt() returning `*` on failure combined with its 256-byte sha512crypt limit, which then matches the `*` placeholder in shadow when sshd's CVE-2016-6210 timing fix hashes the password against another user's salt. Fixed in OpenSSH 10.6p2; mitigate by disabling password authentication.