nx_tls13_transcript_snapkat_test.nx

nx_tls13_transcript_snapkat_test.nx -- DURABLE anti-regression KAT for the TLS-FIN root fix (X-B1-FIN-001 / BL-015 / X-TLS-SNAPKAT-001). The bug it locks out: nx_tls13_transcript_snapshot once flat-byte-copied the Sha256 ctx, duplicating bufptr (a POINTER) so the clone SHARED the live transcript's 64-byte partial block. sha256_final(clone) then wrote padding into that shared block -- and in the two-block path (idx > 56) also zeroed bytes [0..55] -- CLOBBERING the live transcript. Every subsequent update() then compressed corrupted bytes and the Finished MAC diverged. It only triggered when a snapshot landed while idx was in the lethal {57..63} range (a function of cumulative handshake byte-count), so loopback + small cert chains passed while big real-server chains failed. The catch (the gate that WOULD have caught it): For each fill-level S in {55, 56, 57, 63} -- straddling the lethal idx>56 boundary -- snapshot the transcript at idx=S, THEN continue the SAME state with >=64 more bytes and finalize. Assert: (1) snapshot(S) == one-shot sha256(first S bytes) (2) continue-then-final == one-shot sha256(full S+extra bytes) Assertion (2) is precisely what the shallow-copy clobber violated: if the snapshot at idx in {57..63} corrupts the live partial block, the continuation hashes garbage and (2) fails (exit 32 / 42). expect_exit: 0 license_tier: ORIGINAL genealogy_id: international-research-sources/ietf/rfc_8446 lineage_id: nishi_tls13_transcript_snapkat_q10