This is the backdoor that’s deployed after a host is compromised. How the host is compromised is somewhat irrelevant. It could be exploited manually, social engineering, a worm, etc.

Yes, weird corner cases in musl cause a lot of things to misbehave when run on musl. For example, DNS upgrade to TCP, which is required for certain queries and covered by one of the DNS RFCs, wasn’t implemented in musl for the longest time, although I think it finally got implemented recently. However, there are other cases like this fwiu.