(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'proxy connect with privsep'>)}
          spids: [7]
        )
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy.orig'>}
    )
    (command.Simple
      words: [{<echo>} {(SQ <'UsePrivilegeSeparation yes'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {(${ Id.VSub_Name SSH)} {<-> ($ Id.VSub_DollarName '$p')} {<-F>} 
              {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>} {<999.999.999.999>} {<true>}
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<Id.Lit_LBracket '['>} {($ Id.VSub_QMark '$?')} {<-ne>} {<0>} 
                              {<Id.Lit_RBracket ']'>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'ssh privsep+proxyconnect protocol '> ($ Id.VSub_DollarName '$p') 
                          <' failed'>
                        )
                      }
                    )
                  ]
                  spids: [64 77]
                )
              ]
            )
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
    )
    (command.Simple
      words: [{<echo>} {(SQ <'UsePrivilegeSeparation sandbox'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {(${ Id.VSub_Name SSH)} {<-> ($ Id.VSub_DollarName '$p')} {<-F>} 
              {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>} {<999.999.999.999>} {<true>}
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<Id.Lit_LBracket '['>} {($ Id.VSub_QMark '$?')} {<-ne>} {<0>} 
                              {<Id.Lit_RBracket ']'>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<warn>} 
                      {
                        (DQ <'ssh privsep/sandbox+proxyconnect protocol '> ($ Id.VSub_DollarName '$p') 
                          <' failed'>
                        )
                      }
                    )
                  ]
                  spids: [145 158]
                )
              ]
            )
          ]
        )
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: 
                    (C {<Id.Lit_LBracket '['>} {<-z>} {(DQ <TEST_MALLOC_OPTIONS>)} 
                      {<Id.Lit_RBracket ']'>}
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:mopts)
                  op: assign_op.Equal
                  rhs: {(DQ <'C F G J R S U X < >'>)}
                  spids: [201]
                )
              ]
            )
          ]
          spids: [185 198]
        )
      ]
      else_action: [
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:mopts)
              op: assign_op.Equal
              rhs: 
                {
                  (command_sub
                    left_token: <Id.Left_Backtick '`'>
                    child: 
                      (command.Pipeline
                        children: [
                          (C {<echo>} {($ Id.VSub_DollarName '$TEST_MALLOC_OPTIONS')})
                          (C {<sed>} {(SQ <'s/./& /g'>)})
                        ]
                        negated: F
                      )
                  )
                }
              spids: [209]
            )
          ]
        )
      ]
    )
    (command.ForEach
      iter_name: m
      iter_words: [{(SQ )} {($ Id.VSub_DollarName '$mopts')}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.ForEach
              iter_name: p
              iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
              do_arg_iter: F
              body: 
                (command.DoGroup
                  children: [
                    (C {<env>} {<Id.Lit_VarLike 'MALLOC_OPTIONS='> (DQ ($ Id.VSub_DollarName '$m'))} 
                      {(${ Id.VSub_Name SSH)} {<-> ($ Id.VSub_DollarName '$p')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>} 
                      {<999.999.999.999>} {<true>}
                    )
                    (command.If
                      arms: [
                        (if_arm
                          cond: 
                            (condition.Shell
                              commands: [
                                (command.Sentence
                                  child: 
                                    (C {<Id.Lit_LBracket '['>} {($ Id.VSub_QMark '$?')} {<-ne>} {<0>} 
                                      {<Id.Lit_RBracket ']'>}
                                    )
                                  terminator: <Id.Op_Semi _>
                                )
                              ]
                            )
                          action: [
                            (C {<fail>} 
                              {
                                (DQ <'ssh privsep/sandbox+proxyconnect protocol '> 
                                  ($ Id.VSub_DollarName '$p') <' mopt \''> ($ Id.VSub_DollarName '$m') <'\' failed'>
                                )
                              }
                            )
                          ]
                          spids: [282 295]
                        )
                      ]
                    )
                  ]
                )
            )
          ]
        )
    )
  ]
)