Example: CARP SHA1 HMAC

void
carp_hmac_generate(struct carp_softc *sc, 
    u_int32_t counter[2], unsigned char md[20]) {
        /* 
         * Cut a bunch of stuff
         */
        /* outer hash */
        SHA1Init(&sha1ctx);
        SHA1Update(&sha1ctx, opad, CARP_HMAC_PAD);
        SHA1Update(&sha1ctx, md, sizeof(md));
        SHA1Final(md, &sha1ctx);

        SHA1Update(&sha1ctx, md, sizeof(md));


Oops.  Hashing sizeof(pointer) is not the same as hashing sizeof(object).
        SHA1Update(&sha1ctx, md, sizeof(md));
        SHA1Update(&sha1ctx, md, sizeof(*md));



Thankfully the result is different between 32-bit and 64-bit architectures.