Fix

Author: larseggert

src/aead.rs

@@ -708,15 +708,20 @@ mod recprot {
                 pTag: tag.as_mut_ptr(),
                 ulTagBits: super::TAG_BITS_UL,
             };
-            eprintln!(
-                "params: pIv={:?} ulIvLen={} ulIvFixedBits={} ivGenerator={} pTag={:?} ulTagBits={}",
+            // Copy fields to locals first: eprintln! takes references, which is
+            // a hard error (E0793) on packed structs on Windows.
+            let (p_iv, ul_iv_len, ul_iv_fixed, iv_gen, p_tag, ul_tag_bits) = (
                 params.pIv,
                 params.ulIvLen,
                 params.ulIvFixedBits,
                 params.ivGenerator,
                 params.pTag,
                 params.ulTagBits,
             );
+            eprintln!(
+                "params: pIv={p_iv:?} ulIvLen={ul_iv_len} ulIvFixedBits={ul_iv_fixed} \
+                 ivGenerator={iv_gen} pTag={p_tag:?} ulTagBits={ul_tag_bits}"
+            );
             // Show the raw bytes NSS will receive so we can spot any layout mismatch.
             let params_bytes: &[u8] = unsafe {
                 std::slice::from_raw_parts(

src/freebl.rs

@@ -37,10 +37,9 @@ pub type ChaCha20Poly1305Context = ChaCha20Poly1305ContextStr;
 // tag to verify. ulTagBits = TAG_LEN * 8 = 128.
 //
 // NSS's pkcs11t.h pulls in pkcs11p.h which applies `#pragma pack(push,
-// cryptoki, 1)` on Windows.  With that packing in effect and CK_ULONG = 4
-// bytes (MSVC LLP64), the natural 4-byte padding before `pTag` is removed and
-// sizeof = 32.  On LP64 all fields are 8 bytes wide so packing is a no-op and
-// sizeof = 48.  `#[repr(C, packed)]` matches both.
+// cryptoki, 1)` on all platforms.  On LP64 all six fields are 8 bytes wide so
+// packing is a no-op (sizeof = 48).  On Windows LLP64 (CK_ULONG = 4 bytes)
+// packing removes the natural 4-byte padding before `pTag` (sizeof = 32).
 #[repr(C, packed)]
 #[derive(Copy, Clone)]
 #[expect(non_snake_case, reason = "PKCS#11 naming conventions.")]
@@ -75,6 +74,7 @@ unsafe extern "C" {
     pub fn AES_DestroyContext(cx: *mut AESContext, freeit: c_int);
 
     /// AES ECB/CBC encrypt — used in tests to verify the AES context works.
+    #[cfg(test)]
     pub fn AES_Encrypt(
         cx: *mut AESContext,
         output: *mut c_uchar,