The function _mongoc_async_cmd_phase_send sends an ismaster command to the node it's checking. It uses mongoc_stream_writev to send the message.
https://github.com/mongodb/mongo-c-driver/blob/1.9.2/src/mongoc/mongoc-async-cmd.c#L248

However, mongoc_stream_writev is not guaranteed to send the entire message of the iovec. If you jerry-rig an ismaster command with fake fields (which mongo doesn't mind) to increase the size of the ismaster command to something like 1MB, it will not send the full command and timeout checking. The repro.patch file is a simple way to reproduce this.

It's unlikely we'd ever hit this, since an ismaster message should be small enough never to be broken up on any reasonable system. But I think a reasonable and simple fix is to use _mongoc_stream_writev_full instead, which sets an error if it cannot send the full message in one call to stream->write.