=== fix_build: compiling patched copies of the audit targets ===
(see fix_build.log on the runner host for compiler output)

=== DF-3564 fix validation: siphash.c with explicit_bzero(k) ===
NOT FOUND: key copy was not retained on stack
not confirmed: raw key bytes do not persist on the stack after SipHash_SetKey returned
exit=1 (1 = retention GONE = fix effective)

=== DF-3564 fix correctness: patched siphash full KAT ===
== 64 official reference vectors (SipHash-2-4) ==
   (all 64 checked: match)
== kernel vs from-paper reference, SipHash-2-4 & 1-3 ==
   (512+512 cross-checks done)
== chunked-update equivalence (partial-word buffer paths) ==
   (chunked equivalence done)
== SipHash_Final byte encoding ==
RESULT: PASS: 2111 checks, 0 failures

=== DF-3565 fix validation: des_setkey.c with des_check_key=1 ===
   (weak/semi-weak table verified vs 4096 random + 16 near-miss negatives)
== default policy: des_set_key with des_check_key==0 ==
   des_set_key(0x0101010101010101) rc=-2 (0=ACCEPTED) [des_check_key=1]
FAIL expected weak key accepted by default
RESULT: FAIL: 8916 checks, 1 failures
(the single FAIL is the acceptance check inverted: weak key now rejected rc=-2)