Looks like this is fixed in 2.4.25-3+deb9u7. Safari is not dropping http2 requests any more. > This update also contains bug fixes that were scheduled for inclusion in the next stable point release. This includes a fix for a regression caused by a security fix in version 2.4.25-3+deb9u6. https://www.debian.org/security/2019/dsa-4422