[cconlon]

This PR includes 3 Fenrir fixes:

• F-15695: Return the extension value from X509_get_extension() instead of its OID. WolfSSLX509.getExtensionValue() now returns DER encoding matching the JDK.

• F-15741: Always register the native verify callback in setVerify(), and throw if the Java callback cannot be stored.

• F-15696: Return every EKU OID in certificate order from getExtendedKeyUsage(), including OIDs wolfSSL has no flag for, and throw if the EKU cannot be decoded.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #437

Scan targets checked: wolfssljni-src, wolfssljni-bugs
Not reviewed (no scan target covers them): examples/certs/test/eku-bad-oid-cert.pem, examples/certs/test/eku-large-arc-cert.pem, examples/certs/test/eku-unknown-cert.pem, examples/certs/test/eku-unknown-mixed-cert.pem, examples/certs/update-certs.sh
Coverage: 4 of 8 in-scope changed file(s) opened by the reviewer; not opened: src/java/com/wolfssl/WolfSSLSession.java, src/java/com/wolfssl/provider/jsse/WolfSSLEngineHelper.java, src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java, src/test/com/wolfssl/test/WolfSSLCertificateTest.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite