It's accurate, but the calling convention of the top-level function is such that any non-zero value is accepted as boolean true (i.e. a valid CA) and only a zer

It's accurate, but the calling convention of the top-level function is such that any non-zero value is accepted as boolean true (i.e. a valid CA) and only a zero return value is understood as false. Because of this problem of returning the errno-style result code as a boolean-style result code, the cert being looked at would always verify as correct. That's why the fix simply added another label to clear the result variable (to be logically false) before running through the cleanup code and returning the result.