PT-2026-43441

HKDF expand: returns non-NULL on failure. The byte is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP HPKE CTX export fails it also returns an empty by...