Harden CI digest parsing and failure cleanup

include/Domito.MinCrypt.h

@@ -352,7 +352,7 @@ typedef struct _MINCRYPT_POLICY_INFO
 
 #endif // NTDDI_VERSION >= NTDDI_WIN10
 
-}MINCRYPT_POLICY_INFO, PMINCRYPT_POLICY_INFO;
+}MINCRYPT_POLICY_INFO, *PMINCRYPT_POLICY_INFO;
 #include <poppack.h>
 
 
@@ -491,7 +491,10 @@ typedef MINCRYPT_ALLOCATE_ROUTINE* PMINCRYPT_ALLOCATE_ROUTINE;
 *
 *  @param  PublisherName[out] - publisher name.
 *
-*  @return buffer length.
+*  @return NTSTATUS. The string byte count is returned in PublisherName->Length.
+*  Free PublisherName->Buffer with the allocator paired with AllocateRoutine,
+*  including on failure if a buffer was allocated. This routine extracts a name;
+*  it does not verify the certificate or its signer.
 */
 MINCRYPTAPI
 NTSTATUS

include/Domito.h

@@ -170,8 +170,10 @@ DOMITO_CALG_TO_BCRYPT_ALGORITHM(
  */
 
 //
-// Extracts the CALG_ID from a signed PE that was used to
-// calculate the message digest when it was signed
+// Heuristically detects the CALG_ID in the first WIN_CERTIFICATE using byte patterns.
+// Returns CALG_SHA1 when absent, malformed, or unrecognized; this is not ASN.1
+// validation or signature verification. The directory array must contain the
+// IMAGE_DIRECTORY_ENTRY_SECURITY entry.
 //
 _IRQL_requires_max_(DISPATCH_LEVEL)
 EXTERN_C
@@ -183,7 +185,12 @@ DomitoGetPortableExecutableDigestKind(
 );
 
 //
-// Extracts Authenticode signing information and calculates the file digest of a PE file.
+// Calculates a PE digest using the existing linear hashing convention.
+// Validates accessed header/certificate ranges and clears outputs on failure
+// when all output pointers are valid. The input buffer must remain stable.
+// The returned certificate pointer borrows the input buffer; free only the digest
+// with DomitoFreePortableExecutableDigest. Algorithm detection is heuristic;
+// general section-ordered Authenticode hashing is not implemented here.
 // 
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_