Dimitry Andric spotted that DH gex with SHA-256 was overflowing a buffer.