the main Tonelli–Shanks loop (`while (1)` starting around line 286 of bn_sqrt.c) can fail to terminate — When p is composite. Tension: its only exits are BN_is_one(b) success or the inner `if (i == e)` not-a-square error.

19cd4f30-0858-4343-81ff-a3e9372e8329