Detailed steps to reproduce the problem?

A TLS peer can refuse a handshake with a reply, rather than dropping the connection. Right now the driver would label that error in a way that would back off and retry. But it's likely that the server would never accept the connection (e.g. a bad certificate).

Definition of done: what must be done to consider the task complete?

We need to unwrap net.OpError in wrapConnectionError and return the connection error if the Op field is "remote error":

var opErr *net.OpError
if errors.As(connErr.Wrapped, &opErr) && opErr.Op == "remote error" {
    return connErr
}

The exact Go version used, with patch level:

NA

The exact version of the Go driver used:

main

Describe how MongoDB is set up. Local vs Hosted, version, topology, load balanced, etc.

NA

The operating system and version (e.g. Windows 7, OSX 10.8, ...)

NA

Security Vulnerabilities

NA