From 58df604f13ca7529c0607f0d22aed0b3fc85e3aa Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Tue, 18 Aug 2026 16:35:17 -0600
Subject: [PATCH] F-3998: zeroize abandoned DH secret buffers in
 engineGenerateSecret

---
 .../java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java
index 29bb8746..c3dcca62 100644
--- a/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java
+++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java
@@ -227,10 +227,12 @@ public class WolfCryptKeyAgreement extends KeyAgreementSpi {
              * running on a Java version later than Java 8.
              */
             if (this.type == KeyAgreeType.WC_DH) {
+                zeroArray(tmp);
                 tmp = new byte[this.primeLen];
                 Arrays.fill(tmp, (byte)0);
                 System.arraycopy(secret, 0, tmp,
                     tmp.length - secret.length, secret.length);
+                zeroArray(secret);
                 secret = tmp.clone();
             }