[yosuke-wolfssl]

Problem

The curl Test job fails on every PR since 2026-10-29 ~10:30 UTC. Only the master leg fails, on curl test 1964 (HTTP AWS_SIGV4 with X-Xxx-Date header set manually), which segfaults (exit 139) before sending a request.

The trigger is curl commit d2f86ea632 ("NTLM: drop support"). It changed how runtests.pl defines the crypto test feature from NTLM || Kerberos || SPNEGO to SSL || Kerberos || SPNEGO. Our build never had NTLM, so tests needing crypto were all skipped until now. 1964 now runs for the first time and hits a curl bug:

• Curl_HMAC_init() places the two hash contexts right after the 24-byte struct HMAC_context, 8 bytes off 16-byte alignment.
• struct wc_Sha256 has ALIGN16 members on 64-bit CPUs, so GCC initializes it with movaps, which faults on the misaligned address in wc_InitSha256_ex.

This is not a wolfSSL regression. The CRAM-MD5 tests go through the same curl HMAC code and pass, because wc_Md5 has no ALIGN16.

Fix (.github/workflows/curl.yml)

• The master leg passes TFLAGS='!1964' to make test-nonflaky, which skips that one test. All other tests still run, including the 105 other newly enabled crypto tests.
• The curl-8_4_0 leg is unchanged.

The skip should be removed once curl fixes the HMAC context alignment.

Verification

• Reproduced in an x86_64 ubuntu:24.04 container under valgrind: General Protection Fault at movaps %xmm0,(%rdi) in wc_InitSha256_ex, called from Curl_HMAC_init / Curl_output_aws_sigv4.
• Negative control: padding struct HMAC_context to 32 bytes makes the fault go away and test 1964 pass.
• With the same wolfSSL, curl c7d6a625c2 skips 1964 ("curl lacks crypto support") and curl d2f86ea632 runs it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,600 B (+0.6%, 284,048 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[github-actions]

retest this please

[yosuke-wolfssl]

@claude review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11933

Scan targets checked: wolfssl-pr-general
Review type: general (no scan target covers the changed files)
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[claude]

LGTM. This CI-only change skips curl test 1964 on the master leg and leaves everything else as it was.

What was reviewed:

• The matrix expression: master gets !1964, and curl-8_4_0 gets an empty TFLAGS. That leg passes nothing extra to runtests, so it runs the same tests as before.
• Passing TFLAGS on the make command line: curl's test-nonflaky target hands it to runtests along with the non-flaky flags. !N is runtests' syntax for excluding a test. History expansion is off in non-interactive bash, so ! inside the double quotes is safe.

Extended reasoning...

The change touches only .github/workflows/curl.yml. It adds a step-level env var and passes it as TFLAGS to curl's make test-nonflaky, which excludes test 1964 only on the curl master leg. No wolfSSL library, build or test code changes, and there is no security-sensitive surface beyond skipping one external test. The comment documents the root cause as a misaligned HMAC context in curl and says when to remove the skip. I approved because the change is small and self-contained, no CODEOWNERS file covers it, and the only earlier review was a non-blocking COMMENTED review.

[yosuke-wolfssl]

Jenkins retest please

[philljj]

Retest this please.

(PRB disrupted or something)

[philljj]

Thank you @yosuke-wolfssl