Backport of:

From 487e8ac146f7d6616f65c125d5edb210519b833a Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 2 Apr 2026 07:42:16 +0000
Subject: [PATCH] upstream: when downloading files as root in legacy (-O) mode
 and

without the -p (preserve modes) flag set, clear setuid/setgid bits from
downloaded files as one might expect.

AFAIK this bug dates back to the original Berkeley rcp program.

Reported by Christos Papakonstantinou of Cantina and Spearbit.

OpenBSD-Commit-ID: 49e902fca8dd933a92a9b547ab31f63e86729fa1
---
 scp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/scp.c
+++ b/scp.c
@@ -1614,8 +1614,10 @@ sink(int argc, char **argv, const char *
 
 	setimes = targisdir = 0;
 	mask = umask(0);
-	if (!pflag)
+	if (!pflag) {
+		mask |= 07000;
 		(void) umask(mask);
+	}
 	if (argc != 1) {
 		run_err("ambiguous target");
 		exit(1);
