Tavis explains clearly why he thinks it's well maintained in the post, complete with linkages to source code. To paraphrase: [...] NSS was one of the very firs

Tavis explains clearly why he thinks it's well maintained in the post, complete with linkages to source code. To paraphrase: [...] NSS was one of the very first projects included with oss-fuzz [...] [...] Mozilla has a mature, world-class security team. They pioneered bug bounties, invest in memory safety, fuzzing and test coverage. [... all links to evidence ...] Did Mozilla have good test coverage for the vulnerable areas? YES. Did Mozilla/chrome/oss-fuzz have relevant inputs in their fuzz corpus? YES. Is there a mutator capable of extending ASN1_ITEMs? YES. I don't think at any point anyone assumed anything.