Confirmed for default OpenWrt: Dropbear is not affected.
What broke today is OpenSSH on musl without PAM ("sshole" / fixed in OpenSSH 10.6p2, released 2026-11-05): https://www.openssh.org/releasenotes.html#10.6p2 and the write-up at https://sshhole.com/ — a long password (about 257–1024 bytes) ...