crypto/tls/handshake_client.go has clientHandshake() that whittles c.config.cipherSuites() down to those in cipherSuites that aren't TLS1.2 suites unless we're doing a TLS1.2 ClientHello. Assume we're not doing TLS1.2. This cut-down list goes to the server in the ClientHello and it sends back the one to use. We check that it's in c.config.cipherSuites() or else send an Alert back, but that's the original list and so allows the server to specify a suite that was omitted from the advertised list because suite.flags&suiteTLS12 was true.
crypto/tls/handshake_client.go has clientHandshake() that whittles c.config.cipherSuites() down to those in cipherSuites that aren't TLS1.2 suites unless we're doing a TLS1.2 ClientHello. Assume we're not doing TLS1.2. This cut-down list goes to the server in the ClientHello and it sends back the one to use. We check that it's in c.config.cipherSuites() or else send an Alert back, but that's the original list and so allows the server to specify a suite that was omitted from the advertised list because suite.flags&suiteTLS12 was true.