diff --git a/CHANGELOG b/CHANGELOG
index 1dc12e7f..6c225dc0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,12 @@
+2024-09-09
+    - 4.0.11
+    - Fix assert failure related to splitting a large packet.
+
+2024-07-02
+    - 4.0.10
+    - Fix server initial packet padding.
+    - Fix a handshake failure corner case due to packet corruption.
+
 2024-06-12
     - 4.0.9
     - Fix bpq_count (issue #504).
diff --git a/docs/conf.py b/docs/conf.py
index 3b7c6f6c..030a7b3a 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -26,7 +26,7 @@
 # The short X.Y version
 version = u'4.0'
 # The full version, including alpha/beta/rc tags
-release = u'4.0.9'
+release = u'4.0.11'
 
 
 # -- General configuration ---------------------------------------------------
diff --git a/include/lsquic.h b/include/lsquic.h
index 7064da21..bf2508e1 100644
--- a/include/lsquic.h
+++ b/include/lsquic.h
@@ -27,7 +27,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 4
 #define LSQUIC_MINOR_VERSION 0
-#define LSQUIC_PATCH_VERSION 9
+#define LSQUIC_PATCH_VERSION 11
 
 /**
  * Engine flags:
diff --git a/src/liblsquic/ls-qpack b/src/liblsquic/ls-qpack
index 52179271..b1c04104 160000
--- a/src/liblsquic/ls-qpack
+++ b/src/liblsquic/ls-qpack
@@ -1 +1 @@
-Subproject commit 521792711f2839f05565fd3dd617708cfb5b80ee
+Subproject commit b1c04104b64df1be600a3a86d5144beb3d171a91
diff --git a/src/liblsquic/lsquic_full_conn_ietf.c b/src/liblsquic/lsquic_full_conn_ietf.c
index 02e86ca9..984bd9b4 100644
--- a/src/liblsquic/lsquic_full_conn_ietf.c
+++ b/src/liblsquic/lsquic_full_conn_ietf.c
@@ -4561,6 +4561,7 @@ generate_ping_frame (struct ietf_full_conn *conn, lsquic_time_t now)
         return;
     }
     lsquic_send_ctl_incr_pack_sz(&conn->ifc_send_ctl, packet_out, sz);
+    packet_out->po_regen_sz += sz;
     packet_out->po_frame_types |= 1 << QUIC_FRAME_PING;
     LSQ_DEBUG("wrote PING frame");
     conn->ifc_send_flags &= ~SF_SEND_PING;
@@ -7800,6 +7801,8 @@ process_incoming_packet_verneg (struct ietf_full_conn *conn,
         lsquic_send_ctl_expire_all(&conn->ifc_send_ctl);
         return 0;
     }
+    else if (HETY_RETRY == packet_in->pi_header_type)
+        return process_retry_packet(conn, packet_in);
 
     if (packet_in->pi_version != conn->ifc_u.cli.ifcli_ver_neg.vn_ver)
     {
@@ -8147,6 +8150,7 @@ check_or_schedule_mtu_probe (struct ietf_full_conn *conn, lsquic_time_t now)
      * resized, only discarded.
      */
     lsquic_send_ctl_incr_pack_sz(&conn->ifc_send_ctl, packet_out, sz);
+    packet_out->po_regen_sz += sz;
     packet_out->po_frame_types |= 1 << QUIC_FRAME_PING;
     avail = lsquic_packet_out_avail(packet_out);
     if (avail)
diff --git a/src/liblsquic/lsquic_mini_conn_ietf.c b/src/liblsquic/lsquic_mini_conn_ietf.c
index 3e083401..d82fc26a 100644
--- a/src/liblsquic/lsquic_mini_conn_ietf.c
+++ b/src/liblsquic/lsquic_mini_conn_ietf.c
@@ -265,6 +265,16 @@ imico_maybe_process_params (struct ietf_mini_conn *conn)
 }
 
 
+static void
+imico_zero_pad (struct lsquic_packet_out *packet_out, size_t pad_size)
+{
+    memset(packet_out->po_data + packet_out->po_data_sz, 0, pad_size);
+    packet_out->po_padding_sz = pad_size;
+    packet_out->po_data_sz += pad_size;
+    packet_out->po_frame_types |= QUIC_FTBIT_PADDING;
+}
+
+
 static int
 imico_generate_ack (struct ietf_mini_conn *conn, enum packnum_space pns,
                                                             lsquic_time_t now);
@@ -309,11 +319,14 @@ imico_stream_write (void *stream, const void *bufp, size_t bufsz)
             return -1;
         // NOTE: reduce the size of first crypto frame to combine packets
         int avail = lsquic_packet_out_avail(packet_out);
+        int coalescing = 0;
         if (cryst->mcs_enc_level == ENC_LEV_HSK
             && cryst->mcs_write_off == 0
-            && avail > conn->imc_hello_pkt_remain - conn->imc_long_header_sz)
+            && avail > (int)conn->imc_hello_pkt_remain - conn->imc_long_header_sz)
         {
             avail = conn->imc_hello_pkt_remain - conn->imc_long_header_sz;
+            conn->imc_hello_pkt_remain = 0;
+            coalescing = 1;
         }
         p = msg_ctx.buf;
         len = pf->pf_gen_crypto_frame(packet_out->po_data + packet_out->po_data_sz,
@@ -326,9 +339,15 @@ imico_stream_write (void *stream, const void *bufp, size_t bufsz)
         packet_out->po_data_sz += len;
         packet_out->po_frame_types |= 1 << QUIC_FRAME_CRYPTO;
         packet_out->po_flags |= PO_HELLO;
+        if (coalescing && len < avail)
+        {
+            LSQ_DEBUG("generated PADDING frame: %d bytes for packet %"PRIu64,
+                         avail - len, packet_out->po_packno);
+            imico_zero_pad(packet_out, avail - len);
+        }
         cryst->mcs_write_off += msg_ctx.buf - p;
         if (cryst->mcs_enc_level == ENC_LEV_INIT)
-            conn->imc_hello_pkt_remain = avail - len;
+            conn->imc_hello_pkt_remain = lsquic_packet_out_avail(packet_out);
     }
 
     assert(msg_ctx.buf == msg_ctx.end);
@@ -795,19 +814,6 @@ imico_can_send (const struct ietf_mini_conn *conn, size_t size)
 }
 
 
-// static void
-// imico_zero_pad (struct lsquic_packet_out *packet_out)
-// {
-//     size_t pad_size;
-//
-//     pad_size = lsquic_packet_out_avail(packet_out);
-//     memset(packet_out->po_data + packet_out->po_data_sz, 0, pad_size);
-//     packet_out->po_padding_sz = pad_size;
-//     packet_out->po_data_sz += pad_size;
-//     packet_out->po_frame_types |= QUIC_FTBIT_PADDING;
-// }
-
-
 static lsquic_time_t
 imico_rechist_largest_recv (void *rechist_ctx);
 
@@ -939,14 +945,19 @@ ietf_mini_conn_ci_next_packet_to_send (struct lsquic_conn *lconn,
                           "enough quota", packet_out->po_packno);
                 return NULL;
             }
-//             if (!(packet_out->po_frame_types & (1 << QUIC_FRAME_PADDING))
-//                 && (packet_out->po_frame_types & IQUIC_FRAME_ACKABLE_MASK)
-//                 && lsquic_packet_out_avail(packet_out) > 0)
-//             {
-//                 LSQ_DEBUG("generated PADDING frame: %hd bytes for packet %"PRIu64,
-//                         lsquic_packet_out_avail(packet_out), packet_out->po_packno);
-//                 imico_zero_pad(packet_out);
-//             }
+            // NOTE: do not padd INIT packet only, here, instead pad the coalesced
+            //       later, can save one packet, more efficient.
+            // if (!(packet_out->po_frame_types & (1 << QUIC_FRAME_PADDING))
+            //     && (packet_out->po_frame_types & IQUIC_FRAME_ACKABLE_MASK)
+            //     && IQUIC_MIN_INIT_PACKET_SZ > packet_out->po_data_sz)
+            // {
+            //     size_t pad_size;
+            //
+            //     pad_size = IQUIC_MIN_INIT_PACKET_SZ - packet_out->po_data_sz;
+            //     LSQ_DEBUG("generated PADDING frame: %zd bytes for packet %"PRIu64,
+            //             pad_size, packet_out->po_packno);
+            //     imico_zero_pad(packet_out, pad_size);
+            // }
         }
         packet_size = lsquic_packet_out_total_sz(lconn, packet_out);
         if (!(to_coal
diff --git a/src/liblsquic/lsquic_send_ctl.c b/src/liblsquic/lsquic_send_ctl.c
index edcab84f..58363f56 100644
--- a/src/liblsquic/lsquic_send_ctl.c
+++ b/src/liblsquic/lsquic_send_ctl.c
@@ -1569,8 +1569,10 @@ send_ctl_next_lost (lsquic_send_ctl_t *ctl)
                 lost_packet = TAILQ_FIRST(&ctl->sc_lost_packets);
                 while (lost_packet != NULL && lost_packet->po_regen_sz >= lost_packet->po_data_sz)
                 {
-                    LSQ_DEBUG("Dropping packet %"PRIu64" from lost queue",
-                              lost_packet->po_packno);
+                    LSQ_DEBUG("Dropping packet %"PRIu64
+                              " from lost queue, data size: %d, frames: %x",
+                              lost_packet->po_packno, lost_packet->po_data_sz,
+                              lost_packet->po_frame_types);
                     TAILQ_REMOVE(&ctl->sc_lost_packets, lost_packet, po_next);
                     lost_packet->po_flags &= ~PO_LOST;
                     send_ctl_destroy_chain(ctl, lost_packet, NULL);
diff --git a/src/lshpack b/src/lshpack
index 32e96f10..55c0ba47 160000
--- a/src/lshpack
+++ b/src/lshpack
@@ -1 +1 @@
-Subproject commit 32e96f10593c7cb8553cd8c9c12721100ae9e924
+Subproject commit 55c0ba472d54790555b63ab2e7241a4395d243d0