https://github.com/curl/curl/commit/87ed650d04dc1a6f7944a5d952f7d5b0934a19ac
Author: Harry Sintonen <sintonen@iki.fi>
Date:   Thu Feb 16 06:26:26 2023 +0200

    http2: set drain on stream end
    
    Ensure that on_frame_recv() stream end will trigger a read if there is
    pending data. Without this it could happen that the pending data is
    never consumed.
    
    This combined with https://github.com/curl/curl/pull/10529 should fix
    https://github.com/curl/curl/issues/10525
    
    Ref: https://github.com/curl/curl/issues/10525
    Closes #10530

--- a/lib/http2.c
+++ b/lib/http2.c
@@ -868,6 +868,14 @@ static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
         return NGHTTP2_ERR_CALLBACK_FAILURE;
       }
     }
+    if(frame->hd.flags & NGHTTP2_FLAG_END_STREAM) {
+      /* Stream has ended. If there is pending data, ensure that read
+         will occur to consume it. */
+      if(!data->state.drain && stream->memlen) {
+        drain_this(cf, data_s);
+        Curl_expire(data, 0, EXPIRE_RUN_NOW);
+      }
+    }
     break;
   case NGHTTP2_HEADERS:
     DEBUGF(LOG_CF(data_s, cf, "[h2sid=%u] recv frame HEADERS", stream_id));

https://github.com/curl/curl/commit/3103de2053ca8cacf9cdbe78764ba6814481709f
Author: Stefan Eissing <stefan@eissing.org>
Date:   Wed Feb 15 22:11:13 2023 +0100

    http2: buffer/pausedata and output flush fix.
    
     * do not process pending input data when copying pausedata to the
       caller
     * return CURLE_AGAIN if the output buffer could not be completely
       written out.
    
    Ref: #10525
    Closes #10529

--- a/lib/http2.c
+++ b/lib/http2.c
@@ -467,6 +467,7 @@ static CURLcode flush_output(struct Curl_cfilter *cf,
   }
   if((size_t)written < buflen) {
     Curl_dyn_tail(&ctx->outbuf, buflen - (size_t)written);
+    return CURLE_AGAIN;
   }
   else {
     Curl_dyn_reset(&ctx->outbuf);
@@ -1790,6 +1791,7 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
 
     stream->pausedata += nread;
     stream->pauselen -= nread;
+    drain_this(cf, data);
 
     if(stream->pauselen == 0) {
       DEBUGF(LOG_CF(data, cf, "[h2sid=%u] Unpaused", stream->stream_id));
@@ -1798,18 +1800,6 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
 
       stream->pausedata = NULL;
       stream->pauselen = 0;
-
-      /* When NGHTTP2_ERR_PAUSE is returned from
-         data_source_read_callback, we might not process DATA frame
-         fully.  Calling nghttp2_session_mem_recv() again will
-         continue to process DATA frame, but if there is no incoming
-         frames, then we have to call it again with 0-length data.
-         Without this, on_stream_close callback will not be called,
-         and stream could be hanged. */
-      if(h2_process_pending_input(cf, data, err) != 0) {
-        nread = -1;
-        goto out;
-      }
     }
     DEBUGF(LOG_CF(data, cf, "[h2sid=%u] recv: returns unpaused %zd bytes",
                   stream->stream_id, nread));
@@ -1933,6 +1923,7 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
       drained_transfer(cf, data);
     }
 
+    *err = CURLE_OK;
     nread = retlen;
     DEBUGF(LOG_CF(data, cf, "[h2sid=%u] cf_h2_recv -> %zd",
                   stream->stream_id, nread));