It was self-inflicted. I was accidentally editing the hash after the sha256 instead of copying it and then editing it for a calculation.

😆 it had to be something like that

haha, copy() is your friend. if it's golang, then yeah, nasty race conditions if you operate on returned slices and the sending code reuses it. ooh nelly. tends to be an issue when the library has zero copy and memory allocation avoidance built into it but if it's written properly it loudly warns you to not mutate the result. actually, when i write such things if it's just a hash at the end better to return a copy and not have to worry about this bug at all.