GoAhead's DH bug turns a 2048-bit prime into 255. I counted the 8 secrets left.

GoAhead's Mbed TLS backend passes a 1-byte length for a 256-byte DH prime, truncating it to 255. I enumerated the 8 possible shared secrets and simulated the passive decryption: mean 4.35 attempts.