Add BUGS section.

doc/ssl/SSL_pending.pod

@@ -25,6 +25,19 @@ L<SSL_read(3)|SSL_read(3)>.
 
 The number of bytes pending is returned.
 
+=head1 BUGS
+
+SSL_pending() takes into account only bytes from the TLS/SSL record
+that is currently being processed (if any).  If the B<SSL> object's
+I<read_ahead> flag is set, additional protocol bytes may have been
+read containing more TLS/SSL records; these are ignored by
+SSL_pending().
+
+SSL_pending() does not check if the record type of pending data is
+application data.
+
+=head1 SEE ALSO
+
 L<SSL_read(3)|SSL_read(3)>, L<ssl(3)|ssl(3)>
 
 =cut