When parsing a literal IPv6 address in square brackets, pass the

whole string (including the brackets) to the remote shell.  (The
old code stripped the leading '[' but left the trailing ']'.)

options.c

@@ -1811,7 +1811,6 @@ char *check_for_hostspec(char *s, char **host_ptr, int *port_ptr)
 	}
 
 	if (*s == '[' && (p = strchr(s, ']')) != NULL && p[1] == ':') {
-		s++;
 		*p = '\0';
 		not_host = strchr(s, '/') || !strchr(s, ':');
 		*p = ']';