At the time, it felt like Debian got a lot of flack for the bug, but there's the collaboration attempt you mention above. Plus, the upstream OpenSSL code was i

At the time, it felt like Debian got a lot of flack for the bug, but there's the collaboration attempt you mention above. Plus, the upstream OpenSSL code was invoking undefined behaviour. Hence the compiler could have validly made the exact same transformation as the Debian maintainer. At the time this felt academic: surely compilers can't be that mean! Since then I think undefined behaviour is better understood as a thing to avoid entirely. Then, eight years later, Heartbleed was discovered. And we suddenly all realised how badly maintained OpenSSL was. In their defence, it was pretty much a volunteer job. Thankfully, subsequent funding has improved the situation.