I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $$q$$, $$m$$, and $$r$$ and outputting $$P^{-m}$$ and $$m+r$$ where $$P$$ is derived from the password. (I am omitting the analogous ECDH part). I did a little work to see that it is computationally equivalent to CDH, so it is not about basing it on a harder problem.
Is it to protect from some side-channel attacks? If so, what type of side-channel attack is that which works with normal DH but not on Dragonfly? I expect timing attacks on $$p$$ and $$m$$ to be equivalent, so I don't think it's about timing attacks on the private exponent. Or is it some side-channel attack targeted towards finding $$P$$ to facilitate offline dictionary attacks?