My apologies; turns out that that one special user has a command= in its authoried_keys server-side which points to a user-local copy of rsync with extra capabilities so it can read the source tree.
This doesn’t fix the problem, but it changes results. On Sat, 11 Jul 2026, Thorsten Glaser wrote: >- 3.2.3-4+deb11u1 (bullseye before the next point release) >receiving file list ... >Overflow in read_varint() >rsync error: error in rsync protocol data stream (code 12) at io.c(1747) >[Receiver=3.2.3] Stays the same. >- 3.1.3-6 (buster): > >Incompatible options specified for inc-recursive connection. >rsync error: syntax or usage error (code 1) at compat.c(304) [Receiver=3.1.3] When I switch the server also to buster: receiving file list ... hard-link reference out of range: 13890 (15) rsync error: protocol incompatibility (code 2) at flist.c(751) [Receiver=3.1.3] >- 3.1.3-6 (buster) if I change --delete-after to --delete: same >- 3.1.2-1+deb9u2 (stretch): same same, even if I drop --delete altogether.

