In other words, this minor difference between two Zip libraries made it possible to bypass the entire security model of the operating system.

viaduct will lower-case each header and pass it on to Necko. And here is the problem: the API checks in Necko are case-insensitive while the lower-level HTTP/3 code is case-sensitive.