ASN1_INTEGER_get, SSL_select_next_proto and the X509 verify-parameter setters already implement every defined input; their remaining NotImplemented calls only covered inputs where the module faults. Throw std::invalid_argument there as the debt entries record, so the exports are no longer reported as unimplemented, and pin that exception in the existing tests.
SSL_select_next_proto validated both lists and threw for an empty list,
a zero-length entry or a truncated entry. The firmware 13.42 report on
PR #9785 shows the module runs LibreSSL 3.4.1's loop with no validation:
a zero-length entry is negotiated, no overlap returns the first supported
entry with its unchecked length byte, even for an empty supported list,
and an empty peer list has no overlap. Follow that loop, and throw only
for the null pointers the module would read. The test places each
reported list before a guard page and checks the six reported cases.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
rooklz