Strict-Transport-Security headers are set with different settings (e.g. different
max-age values), how will the browser behave? Does the browser just follow one of them, or simply error out and discard all? Is this behaviour different across various browsers?
According to RFC 6797, 8.1, the browser must only process the first header:
If a UA receives more than one STS header field in an HTTP response message over secure transport, then the UA MUST process only the first such header field.