I've literally just spent most of my afternoon debugging this issue. The issue only occurs when https is enabled (which might explain why it doesn't occur in your dev environment).
Line 835 of
PATCH_SUPEE-9767_CE_18.104.22.168_v1-2017-05-25-09-32-57.sh makes this change to
- $baseUrl = Mage::getBaseUrl(Mage_Core_Model_Store::URL_TYPE_WEB, Mage::app()->getStore()->isCurrentlySecure());
+ $baseUrl = Mage::getBaseUrl(Mage_Core_Model_Store::URL_TYPE_WEB,
The issue is that
shouldUrlBeSecure returns false because the admin frontname is not on the list of secure URLs. That causes
Mage::getBaseUrl to return the unsecure base_url, and subsequent comparison with the current URL to fail (different protocol/scheme). Therefore Magento will redirect you to the base_url (i.e. the redirect to the http home page behaviour you're seeing).
I hate core hacks as a fix, but undoing the effect of that patch at line 317 of
app/code/core/Mage/Core/Controller/Varien/Front.php seems to be the best option.
Cue Ben Marks...