Ralf-Phillip Weinmann had a good Black Hat presentation about this bug class. It might not be online yet. He&#x27;s part of one of a couple of efforts to come up with fuzzing and validation tools to find things like carry propagation bugs in bignum libraries.<p>The good news about this particular bug is that carry propagation bugs are well-studied (they seem to be the textbook case of a bignum math bug), and if OpenSSL says they&#x27;ve scoped down the places this bug impacts, they&#x27;re probably right.<p>I don&#x27;t know if it mitigates your existential dread, but carry propagation bugs in multiplication routines are not in fact all that rare.