Later in the thread it seems like https://github.com/mricon/b4 was involved. Maybe just a bug this time but exposes it as a weak link in the whole kernel contributor web of trust