For IP-based DoT/DoQ connections, IP address is set for SNI

[sfionov]

This is incorrect behaviour because there is no RFC for setting IP in SNI field.

try:

tls://1.1.1.1
quic://1.1.1.1

tlsext_hostname should not be set, and certificate verification should verify SubjectAltName ip instead of hostname