Control: fixed -1 1:2.20.1-2+deb10u1 Control: fixed -1 1:2.26.2-1~bpo10+1 I tried reproducing this on the Git 2.20 in buster (with the reproduction recipe from message #14), and it seems it has been fixed! Same with the Git 2.26 backported from bullseye.
Instead of a fork bomb, there's an error message: nobody@678fb692c9b5:/tmp/bar$ git status fatal: 'foo/.git' not recognized as a git repository which seems pretty OK. Cheers, Greg