Cryptographic Misuse: Nonce validation and region indexing were incorrect, potentially allowing authentication bypass; multiple nonce patterns needed support.

Cryptographic Integrity Bypass: Static AsyncLocal cache allowed version downgrades to go undetected during multi-part downloads; per-instance cache required.

Cryptographic Verification Bypass: Empty inclusion-proof arrays were not rejected, enabling verification bypass.