that of the result pointer to bn_mul was the same as one of the two arguments,
That argument might have it's sign destroyed.  He provided this fix.