Commit b693ad2268 for openssl.org

commit b693ad22686f7c5a00e1757ef3cf84626855042f
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Mon Sep 21 09:17:39 2026 +0200

    ssl/statem/statem_dtls.c: remove a dead write in dtls1_do_write()

    Adjusting written for the header size became a dead write
    after a refactoring in db95a7cac8c3 "Place start of ClientHello correctly
    when calculating binder for DTLS 1.3", as written is overwritten on each
    iteration by dtls1_write_bytes() if it returns without an error.

    The issue was reported by Coverity as an integer underflow, CID 1652003.

    Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1652003
    Complements: db95a7cac8c3 "Place start of ClientHello correctly when calculating binder for DTLS 1.3"
    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Tue Sep 29 16:43:44 2026
    Merged-from: https://github.com/openssl/openssl/pull/32900

diff --git a/ssl/statem/statem_dtls.c b/ssl/statem/statem_dtls.c
index 90f4e72c0f..bf1e4a62f2 100644
--- a/ssl/statem/statem_dtls.c
+++ b/ssl/statem/statem_dtls.c
@@ -420,7 +420,6 @@ int dtls1_do_write(SSL_CONNECTION *s, uint8_t recordtype)
             }
             s->init_off += written;
             s->init_num -= written;
-            written -= DTLS1_HM_HEADER_LENGTH;
         }
     }
     return 0;