What actually happens is that ssh-copy-id tries to run this code, expecting it
to fail:

REMOTE_VERSION=$(ssh -v -o PreferredAuthentications=',' "$@" 2>&1 |
                 sed -ne 's/.*remote software version //p')

However, if an existing control master is open, and ssh is configured to use
it, this will /not/ fail, leaving you controlling an ssh connection to the
remote host, without seeing any of the output (since it's being piped into
sed), making it look like ssh-copy-id has hung.

I think most (or maybe all) of the ssh invocations in ssh-copy-id should
probably just pass -o ControlPath=none since using an existing control master
is not desireable in those cases.

Reproducible here.

- -- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.0.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/lksh
Init: systemd (via /run/systemd/system)

Versions of packages openssh-client depends on:
ii  adduser           3.113+nmu3
ii  dpkg              1.18.1
ii  libc6             2.19-18
ii  libedit2          3.1-20150325-1
ii  libgssapi-krb5-2  1.12.1+dfsg-20
ii  libselinux1       2.3-2
ii  libssl1.0.0       1.0.2c-1
ii  passwd            1:4.2-3
ii  zlib1g            1:1.2.8.dfsg-2+b1

Versions of packages openssh-client recommends:
ii  xauth  1:1.0.9-1

Versions of packages openssh-client suggests:
pn  keychain      <none>
pn  libpam-ssh    <none>
pn  monkeysphere  <none>
pn  ssh-askpass   <none>

- -- Configuration Files:
/etc/ssh/moduli changed [not included]

- -- no debconf information
iQJOBAEBCAA4BQJVhwzhMRpodHRwczovL3d3dy5kb21pbmlrLWdlb3JnZS5kZS9n
cGctcG9saWN5LnR4dC5hc2MACgkQt5o8FqDE8pYvcA/+PE5muKt9llgXQsc3kp0R
OdlkA5eO6257MRuozawAXIMECivSwkp/1dQZdD1TnQLNMrJQK4V4u+g1nchmV56o
+42/UVJfA7XNKoodJYjLqDrhtaw7D3fzX53LnjxRQKzplIhZVMWdL+ihxWBjdm+F
2PlUZvtbn4rrXMlvo3gVI/YJm99aSogVBVVOub3Mi5w6AHvIwZ7zbUSk0HprlWFv
2S2tdmcr+XkM37C5/MLjFNL4dwFWl1smydfk/xMsLzZI1j71W1Keq0w6PeMz75MJ
qtpC61p6BYSIe9dJ9UkbVj+6MKsBbqTOqUGNiLr//nK0bc5gVyfewTVv4PeaquDL
OppiczILxvKRu2S2yhfcbO4EZWbtk5xP/X2t28zbvzsblLIscWnBx/sQ5ucyMEUj
e+stBFUP+NWnA+zGf0el+LDfQE2XGm9NYpZhjqMsUZg3f/7xRrluYlOqlPlWezqQ
zTM/NL2Xz3ZGAL0slvjpmy+bdcZiUY842xc5MXwnLspdDR9kV1IOl7VzJjMcqX+x
8u6pq+W1rvFdCkIGbFsKxhziwv23mzQvBqSK3TNfCjiW+Y5pmtz0tDo8MElzZSQe
i1X8AU4ikUUOjP5YDj54UUa6kUFEGjynfqvIYcG/SXY51ewJ6ZKG3ndxfaec2tyh
aN0aolWKKRiX1XYiuDjMz+4=
=sLrf
-----END PGP SIGNATURE-----