Looks like this is fixed in 2.4.25-3+deb9u7. Safari is not dropping http2 requests any more.
> This update also contains bug fixes that were scheduled for inclusion in the > next stable point release. This includes a fix for a regression caused by a > security fix in version 2.4.25-3+deb9u6. https://www.debian.org/security/2019/dsa-4422
