I've figured out the secret!
As I posted in the "edit" above, the remote shell was BusyBox
libbb/lineedit.c:2336-2338, in the BusyBox sources:
/* Print out the command prompt, optionally ask where cursor is */
That is used to print out the command prompt in
ash. But notice, as soon as it prints the prompt, another function called
ask_terminal is called. What does
ask_terminal do? It prints out the following characters:
You never see those characters in your terminal. Actually, they are an ANSI terminal control escape code.
<ESC>[6n is a "Query Cursor Position" command -- it tells the terminal emulator to send back another ANSI escape code, which tells the shell where the cursor (text insertion point) is located in the terminal window.
So as soon as you press
ash prints out
sshd passes that back to
ssh and from there to the terminal emulator. Immediately, before you can press
~, your terminal emulator sends something like
<ESC>[47;13R to standard input, and
ssh passes that over the connection to
sshd and from there to
ash where your cursor is.
Now, the SSH client doesn't actually know what those ANSI escape codes mean. To SSH, they are all just characters read from standard input. Rather than seeing
<ENTER>~C, the SSH client sees
<ENTER><ESC>[47;13R~C, and since it doesn't see the
~ right after
Enter, it doesn't think that it is an escape code.
The question is what to do about this. It would be nice if OpenSSH understood those ANSI escapes sent by the terminal and would still accept the
~ escape character after an ANSI terminal control command. I may send the OpenSSH guys a patch and see if they are interested in fixing this...