Ralf-Phillip Weinmann had a good Black Hat presentation about this bug class. It might not be online yet. He's part of one of a couple of efforts to come up with fuzzing and validation tools to find things like carry propagation bugs in bignum libraries.
The good news about this particular bug is that carry propagation bugs are well-studied (they seem to be the textbook case of a bignum math bug), and if OpenSSL says they've scoped down the places this bug impacts, they're probably right.
I don't know if it mitigates your existential dread, but carry propagation bugs in multiplication routines are not in fact all that rare.
The good news about this particular bug is that carry propagation bugs are well-studied (they seem to be the textbook case of a bignum math bug), and if OpenSSL says they've scoped down the places this bug impacts, they're probably right.
I don't know if it mitigates your existential dread, but carry propagation bugs in multiplication routines are not in fact all that rare.