ssh -L bind failure is a warning; ::1 half defeats ExitOnForwardFailure

If the local port of ssh -N -L PORT:dst:dport host is already taken, OpenSSH 10.0p1 prints 'bind [127.0.0.1]:PORT: Address already in use' and stays connected, so 127.0.0.1:PORT keeps reaching whatever already listens there (e.g. a local docker DB). A bare-port -L binds both 127.0.0.1 and ::1. If only the IPv4 bind fails, [::1]:PORT goes through the tunnel and 127.0.0.1:PORT does not. Because one bind succeeded, -o ExitOnForwardFailure=yes does not exit either (tested: still running after 5s). Use an explicit bind address with it: ssh -o ExitOnForwardFailure=yes -N -L 127.0.0.1:PORT:dst:dport host exits rc=255 with 'Could not request local forwarding.' Then check identity through the tunnel (e.g. select inet_server_addr()), not just that the port is open.