Here is my proposal patch:

diff --git a/random/random-drbg.c b/random/random-drbg.c
index 5a46fd92..f1cfe286 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -341,6 +341,9 @@ enum drbg_prefixes
  * Global variables
  ***************************************************************/

I checked FIPS 186-4 (and FIPS 186-5-draft). It is Appendix A 1.3.

In computer, binary representation is used (generally), binary digits 0110 1110 (hex value 6e, 110) is rounded up to 1000 0000 (hex value 80, 128), when only one significant binary digit (bit) is required.
https://en.wikipedia.org/wiki/Rounding

Thanks for your explanation.

Patches applied and pushed. For the common/t-ssh-utils, I applied my fix for the use case with key on command line when FIPS mode is enabled (MD5 error is OK, in this case).

I just copied the value of 0xcafe2a8e and the name .note.fdo.integrity from Daiki's implementation. No other reason.

I think that good approach as of 2022 is:

libgpg-error 1.45 is out with the fix.

I think that it is OK to loop forever until we find a prime.

I don't know the exact procedure by FIPS, but just setting the least significant bit in the generation (after _gcry_mpi_randomize) can reduce the probability by half.

GPGME has its own system hooks to provide a (different) solution for portability (Windows and POSIX).

you also use the CPU cache size on GNU/Linux. Is it important to have that information on MS-Windows?

SOCKET handle is UINT_PTR on Windows. It is u_int on original MinGW, it is UINT_PTR (and unsinged __int64_t) on MinGW-W64.

Last part is applied. Let me consider how to solve, for other parts.

Original MinGW and MinGW-w64 handle differently.
For MinGW-w64 on 64-bit machine, pid_t is 64-bit integer.
For original MinGW on 64-bit machine, pid_t is 32-bit integer.

Not applying the change to GnuPG 2.2, users can use GnuPG 2.3 for that.

The patch I proposed was partial one, not fully solved the problem of socket resource leak on Windows.

Done in master to be 1.11 for server side rC754ad5815b5b: random: Remove use of experimental random daemon.

Done in 1.10.1.

I read OpenSSL implementation.
It does NOT implement backtracking.
In openssl/crypto/x509/x509_vfy.c, it has a function find_issuer which does:

• exclude a issuer when it's already in ctx->chain (can avoid recursion forever)
• prefer the first non-expired one, else take the most recently expired one.

When we will find reproducible test case, please reopen.