Describe the bug

We're connecting to an SQL server using Data Source=<server>\<instance>; Integrated Security = true from linux. This first requests a port number from SSRP, and then requests a service ticket from kerberos.
Seeing from packet trace we see that the SPN requested uses instance name in the port field similar to issue #2187.

This is a problem because we cannot self-register SPNs for machines using instance name instead of port number in AD, so developer machines using connection string Data Source=.\SQLEXPRESS; Integrated Security = true (using our self-made SSRP-daemon) fails to fetch the ticket due to the incorrect principal name.

If i specify port number after the instance name, the SPN requested does not reference instance name but instead uses port number so this leads me to believe there is a bug in what SPN is requested when the port is resolved through SSRP.

To reproduce

Connect to an sql server named instance without port number so that SSRP is invoked. Using packet trace we observe that the ticket requested specifies instance name.

Expected behavior

I expect the service ticket requested to specify the port number per the docs similar to the issue #2187

Further technical details

Microsoft.Data.SqlClient version: 6.1.0-preview2.25178.5 (from nuget.org)
.NET target: .NET 8.0
SQL Server version: Any
Operating system: Ubuntu 25.04