--- crypto/openssh/authfd.c.orig
+++ crypto/openssh/authfd.c
@@ -666,7 +666,7 @@
     struct dest_constraint **dest_constraints, size_t ndest_constraints)
 {
 	struct sshbuf *msg;
-	int r, constrained = (life || confirm);
+	int r, constrained = (life || confirm || dest_constraints);
 	u_char type;
 
 	if (add) {