This leaves the blocking section twice, which confuses multithreaded applications (like ocsigen that uses lwt).
Looks like you copied the same bug that upstream ocaml-ssl had, and that was fixed here:
https://github.com/savonet/ocaml-ssl/pull/5