discussion: downgrade override

quiche/src/lib.rs

@@ -6816,6 +6816,7 @@ impl Connection {
             .as_ref()
             .map_or(false, |conn_err| !conn_err.is_app)
         {
+            let mut force_downgrade = false;
             let epoch = match self.handshake.write_level() {
                 crypto::Level::Initial => packet::Epoch::Initial,
                 crypto::Level::ZeroRTT => unreachable!(),
@@ -6831,6 +6832,7 @@ impl Connection {
                         // Initial later on.
                         //
                         // https://datatracker.ietf.org/doc/html/rfc9000#name-immediate-close-during-the-
+                        force_downgrade = true;
                         packet::Epoch::Handshake
                     }
                 },
@@ -6845,9 +6847,17 @@ impl Connection {
 
                     // Downgrade the epoch to Initial as the remote peer might
                     // not be able to decrypt handshake packets yet.
+                    //
+                    // We don't downgrade if we forcibly downgraded an Application
+                    // packet to a Handshake one since the
+                    // client drops the keys for the Initial epoch upon
+                    // sending a Handshake packet. In that scenario, we need the
+                    // packet to remain in the Handshake
+                    // epoch.
                     packet::Epoch::Handshake
                         if self.pkt_num_spaces[packet::Epoch::Initial]
-                            .has_keys() =>
+                            .has_keys() &&
+                            !force_downgrade =>
                         return Ok(packet::Type::Initial),
 
                     _ => (),