Harden CI digest parsing and failure cleanup

include/Domito.h

@@ -170,8 +170,10 @@ DOMITO_CALG_TO_BCRYPT_ALGORITHM(
  */
 
 //
-// Extracts the CALG_ID from a signed PE that was used to
-// calculate the message digest when it was signed
+// Heuristically detects the CALG_ID in the first WIN_CERTIFICATE using byte patterns.
+// Returns CALG_SHA1 when absent, malformed, or unrecognized; this is not ASN.1
+// validation or signature verification. The directory array must contain the
+// IMAGE_DIRECTORY_ENTRY_SECURITY entry.
 //
 _IRQL_requires_max_(DISPATCH_LEVEL)
 EXTERN_C
@@ -183,7 +185,12 @@ DomitoGetPortableExecutableDigestKind(
 );
 
 //
-// Extracts Authenticode signing information and calculates the file digest of a PE file.
+// Calculates a PE digest using the existing linear hashing convention.
+// Validates accessed header/certificate ranges and clears outputs on failure
+// when all output pointers are valid. The input buffer must remain stable.
+// The returned certificate pointer borrows the input buffer; free only the digest
+// with DomitoFreePortableExecutableDigest. Algorithm detection is heuristic;
+// general section-ordered Authenticode hashing is not implemented here.
 // 
 _Success_(return == STATUS_SUCCESS)
 _Must_inspect_result_