[ci-scan] Test failure: System.Security.Cryptography.Tests.AesGcmTests.AesGcmNistTestsTamperCiphertext

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1563837
Build error leg or test failing: android-arm Release AllSubsets_CoreCLR - System.Security.Cryptography.Tests
Recurs in follow-up build https://dev.azure.com/dnceng-public/public/_build/results?buildId=1564198 (runtime-extra-platforms, def 154).

KBE authoring guidance (ci-failure-scan)

• Error Details is for readers. Paste the full exception, stack trace, or build error excerpt so the failure is understandable without opening the raw log.
• Build Analysis parses only the single JSON block under Error Message.
• ErrorMessage is a case-sensitive ordinal String.Contains substring copied verbatim from the failing log.
• Set BuildRetry to true only for a clear infrastructure retry case. ExcludeConsoleLog disables Helix console-log scanning.

Error Details

[FAIL] System.Security.Cryptography.Tests.AesGcmTests.AesGcmNistTestsTamperCiphertext
   Test name: System.Security.Cryptography.Tests.AesGcmTests.AesGcmNistTestsTamperCiphertext(testCase: NIST GCM Spec test cases - 2 (128/96/128/128/0))
   Exception messages: Assert.Throws() Failure: Exception type was not an exact match
Expected: typeof(System.Security.Cryptography.AuthenticationTagMismatchException)
Actual:   typeof(System.Security.Cryptography.CryptographicException)

The AES-GCM tampered-ciphertext test expects an AuthenticationTagMismatchException but the mobile crypto backend throws the base CryptographicException instead.

Error Message

{
  "ErrorMessage": [
    "[FAIL] System.Security.Cryptography.Tests.AesGcmTests.AesGcmNistTestsTamperCiphertext",
    "Expected: typeof(System.Security.Cryptography.AuthenticationTagMismatchException)",
    "Actual:   typeof(System.Security.Cryptography.CryptographicException)"
  ],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 1 hits in failure.log

Generated by CI Outer-Loop Failure Scanner · opus48 · 573.8 AIC · ⌖ 11.3 AIC · ⊞ 20.7K · ◷

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

[vcsjones]

This looks like the same thing as the ChaCha one. Something is polluting Conscrypt's error queue.

Will take a look.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.