OpenVPN 2.7.9 fixes --auth-user-pass parsing (overlong usernames leaked into the password field), the --extra-certs access check and a PUSH_UPDATE server memory leak, and sets IFF_BACKPRESSURE on Linux tun devices so the kernel queues packets instead of dropping them when userspace is slow. Its CVEs are Windows-only.

Debian hasn't packaged it yet (salsa stops at debian/2.7.8-1); bump scripts/package-build/openvpn/package.toml once debian/2.7.9-1 exists. The carried DCO patch (gerrit 1734) is still needed.