This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce. The prompt was simply directed at a vulnerable version and told to find a h2 race, which is generically the most common culprit these days. Once it found one, I had it attempt the same against a patched version (which failed).

Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.