ssl/statem/statem.c:806: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `statem_do_write`.
Showing all 13 steps of the trace


ssl/statem/statem.c:711:1: Parameter `s->rlayer.numwpipes`
709.    * result in an NBIO event.
710.    */
711. > static SUB_STATE_RETURN write_state_machine(SSL *s)
712.   {
713.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:806:19: Call
804.                   dtls1_start_timer(s);
805.               }
806.               ret = statem_do_write(s);
                         ^
807.               if (ret <= 0) {
808.                   return SUB_STATE_ERROR;

ssl/statem/statem.c:655:1: Parameter `s->rlayer.numwpipes`
  653.    * Send a previously constructed message to the peer.
  654.    */
  655. > static int statem_do_write(SSL *s)
  656.   {
  657.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:662:20: Call
  660.           || st->hand_state == TLS_ST_SW_CHANGE) {
  661.           if (SSL_IS_DTLS(s))
  662.               return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
                            ^
  663.           else
  664.               return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);

ssl/statem/statem_dtls.c:109:1: Parameter `s->rlayer.numwpipes`
    107.    * SSL3_RT_CHANGE_CIPHER_SPEC)
    108.    */
    109. > int dtls1_do_write(SSL *s, int type)
    110.   {
    111.       int ret;

ssl/statem/statem_dtls.c:239:15: Call
    237.           }
    238.   
    239.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                         ^
    240.                                   &written);
    241.           if (ret < 0) {

ssl/record/rec_layer_d1.c:730:1: Parameter `s->rlayer.numwpipes`
      728.    * not all data has been sent or non-blocking IO.
      729.    */
      730. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
      731.                         size_t *written)
      732.   {

ssl/record/rec_layer_d1.c:740:9: Call
      738.       }
      739.       s->rwstate = SSL_NOTHING;
      740.       i = do_dtls1_write(s, type, buf, len, 0, written);
                     ^
      741.       return i;
      742.   }

ssl/record/rec_layer_d1.c:744:1: Parameter `s->rlayer.numwpipes`
        742.   }
        743.   
        744. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
        745.                      size_t len, int create_empty_fragment, size_t *written)
        746.   {

ssl/record/rec_layer_d1.c:936:12: Call
        934.   
        935.       /* we now just need to write the buffer */
        936.       return ssl3_write_pending(s, type, buf, len, written);
                          ^
        937.    err:
        938.       return -1;

ssl/record/rec_layer_s3.c:1058:1: <LHS trace>
1056.    * Return values are as per SSL_write()
1057.    */
1058. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1059.                          size_t *written)
1060.   {

ssl/record/rec_layer_s3.c:1058:1: Parameter `s->rlayer.numwpipes`
          1056.    * Return values are as per SSL_write()
          1057.    */
          1058. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
          1059.                          size_t *written)
          1060.   {

ssl/record/rec_layer_s3.c:1077:16: Binary operation: ([0, +oo] - 1):unsigned64 by call to `statem_do_write` 
          1075.           /* Loop until we find a buffer we haven't written out yet */
          1076.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
          1077.               && currbuf < s->rlayer.numwpipes - 1) {
                                 ^
          1078.               currbuf++;
          1079.               continue;
