Comment 9 for bug 1593657

I am not 100% sure it's not the OpenSSH client. These two debug lines make me think there's something more to check:

debug3: muxserver_listen: temporary control path /tmp/sshcontrol-f1b458a85cd2aa9d5c115abc12afee9f485ad6b0.OqWT4bhQP7Hgit3A
debug1: channel 1: new [/tmp/sshcontrol-f1b458a85cd2aa9d5c115abc12afee9f485ad6b0]

The former path matches what lsof reports (without arguments), the latter matches what the file system does.
At line 1262 the path appendix is created in a for loop.
The expanded path (options.control_path) is then passed to the unix_listener function.

That path extension is clearly created by OpenSSH client that way.
But maybe there's something going wrong with the subsequent move, as lsof is still reporting that expanded path!