A client sends QUIC transport parameters in its ClientHello, when a hello retry happens it sends a new ClientHello, and we don't validate that the second ClientHello has the same parameters as the first. We don't do anything with the parameters from the first ClientHello, they just get replaced with the new ones prior to passing them to the QUIC stack.
This is not a security issue.
A client sends QUIC transport parameters in its ClientHello, when a hello retry happens it sends a new ClientHello, and we don't validate that the second ClientHello has the same parameters as the first. We don't do anything with the parameters from the first ClientHello, they just get replaced with the new ones prior to passing them to the QUIC stack.
This is not a security issue.