HMAC KDF failure log omits the crypto-provider return code #612

Version and environment

Reproduced on SQLCipher commit 810db22f575ee7cf94ea96a3e91622b5fcece3dc, Linux amd64, using SQLite 3.53.3 / SQLCipher 4.17.0 Community. A local preload helper deterministically fails only the fast HMAC derivation call.

Describe the bug

The HMAC-key KDF error path passes rc to sqlcipher_log(), but the format string has no conversion for it. Consequently, the provider layer logs its return value while SQLCipher's following CORE error loses the already available code.

Minimal reproduction

bash sqlcipher-021-inconclusive-diagnostic-analogue-hmac-kdf-failure-log-d814773e/poc/run_repro.sh

The wrapper builds fail_fast_pbkdf2.c as a preload library. It returns 0 only when the PBKDF2 iteration count is 2, then runs:

PRAGMA cipher_log='stderr';
PRAGMA key='poc021-passphrase';
CREATE TABLE t(v);
INSERT INTO t VALUES(1);

Actual behavior/output

The provider log includes returned 0. The next CORE line is:

sqlcipher_cipher_ctx_key_derive: error occurred from provider kdf generating HMAC key

No return code appears, even though rc is supplied to the logging call. The trigger exits 1, and the bounded liveness query succeeds.

Expected behavior

The CORE diagnostic should include the return code, for example ... HMAC key, error 1, or the unused rc argument should be removed if the omission is intentional.

Impact and scope

This is a low-severity observability defect. It makes production provider/KDF failures harder to diagnose and distinguish, but it does not independently cause the cryptographic operation to succeed.

Relevant source/root cause

At src/sqlcipher.c:1907-1911, the call is effectively:

sqlcipher_log(SQLCIPHER_LOG_ERROR, SQLCIPHER_LOG_CORE,
  "%s: error occurred from provider kdf generating HMAC key", __func__, rc);

Only %s consumes an argument; rc is never formatted. The OpenSSL provider diagnostic around src/crypto_openssl.c:272 does include its underlying result.

Suggested regression test

Inject a deterministic HMAC KDF failure, capture the CORE log, and assert that it contains both the function name and the SQLCipher/provider error code.

Reproduction bundle

Attached: sqlcipher-021-inconclusive-diagnostic-analogue-hmac-kdf-failure-log-d814773e_attachment.zip. It contains the focused PoC, validation evidence, and candidate metadata.

sqlcipher-021-inconclusive-diagnostic-analogue-hmac-kdf-failure-log-d814773e_attachment.zip