[ci-scan] Test failure: SslStream_TargetHostName_Succeeds reports zero callbacks

[jkoritzinsky]

Description

SslStream_TargetHostName_Succeeds(useEmptyName: True, useCallback: True) completes its TLS handshake and ping-pong, but observes zero remote-certificate-validation callback invocations instead of one.

This was observed in the Windows x86 Checked CoreCLR libraries leg of runtime build 20261001.53.

Reproduction Steps

Run the existing System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds case with useEmptyName: True and useCallback: True in the configuration below. This report records a concrete CI occurrence; no deterministic local reproduction is claimed.

Expected behavior

The remote-certificate-validation callback is invoked once.

Actual behavior

The test fails with Expected: 1 and Actual: 0. The full failure excerpt is below.

Regression?

Unknown.

Known Workarounds

None confirmed.

Configuration

• Leg: net11.0-windows-Debug-x86-coreclr_checked-Windows.10.Amd64.Open
• Test process architecture: x86
• Reported worker OS: Windows Server 2016, build 10.0.14393
• Whether the failure is exclusive to this configuration is unknown.

Other information

Found while triaging #135038. That PR changes interpreter/WASM codegen, not SslStream, and its sort changes are gated by HOST_WASM; this failure is in the regular Windows x86 CoreCLR libraries leg.

Related incorrect-server-name failures are tracked by #135031. This KBE is scoped to the distinct zero-callback assertion; a shared root cause has not been established.

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1619952
Build error leg or test failing: net11.0-windows-Debug-x86-coreclr_checked-Windows.10.Amd64.Open - System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds
Pull request: #135038

KBE authoring guidance (ci-failure-scan)

• Error Details is for readers. The excerpt below is from the failing test.
• Build Analysis parses only the single JSON block under Error Message.
• Each ErrorMessage element is a case-sensitive literal substring from a line in the log, in order.
• BuildRetry is false; ExcludeConsoleLog is false.

Error Details

System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds(useEmptyName: True, useCallback: True) [FAIL]
  Assert.Equal() Failure: Values differ
  Expected: 1
  Actual:   0
  Stack Trace:
    /_/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs(798,0): at System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds(Boolean useEmptyName, Boolean useCallback)
    --- End of stack trace from previous location ---

Console log: https://helixr1107v0xdcypoyl9e7f.blob.core.windows.net/dotnet-runtime-refs-pull-135038-merge-73e86d532136444fb6/System.Net.Security.Tests/1/console.7804703e.log?helixlogtype=result

Test result: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1619952&view=ms.vss-test-web.build-test-results-tab&runId=44873014&resultId=178113

Error Message

{
  "ErrorMessage": [
    "SslStream_TargetHostName_Succeeds(useEmptyName: True, useCallback: True) [FAIL]",
    "Assert.Equal() Failure: Values differ",
    "Expected: 1",
    "Actual:   0"
  ],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 1 hits in failure.log

Note

This issue was prepared with GitHub Copilot assistance.

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1619952
Error message validated: [SslStream_TargetHostName_Succeeds(useEmptyName: True, useCallback: True) [FAIL] Assert.Equal() Failure: Values differ Expected: 1 Actual: 0]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 10/1/2026 9:22:48 PM UTC

Report

Build	Repository	Test	Pull Request
1621192	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_BeginEnd.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#135101
1621136	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135088
1621013	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_MemoryAsync.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#135010
1621036	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#133660
1621034	dotnet/runtime	System.Net.Security.Tests.SslStreamFramingTests.Handshake_Success	#133658
1619646	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135022
1620864	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_SyncParameters.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#134869
1620842	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_BeginEnd.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail
1620769	dotnet/runtime	System.Net.Security.Tests.TlsSessionTests.ServerSession_ExternalValidation_PreservesClientCertificateChain	#133662
1620759	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#134819
1620743	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135080
1620531	dotnet/runtime	System.Net.Security.Tests.SslStreamTlsResumeTests.DifferentEncryptionPolicy_NoResume	#134843
1620461	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135048
1620539	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135074
1620515	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_SyncParameters.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#134982
1620478	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_BeginEnd.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#134811
1620445	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135067
1620437	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135066
1620394	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#134966
1620359	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#133659
1620360	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_SyncSslOptions.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#133662
1620357	dotnet/runtime	System.Net.Security.Tests.SslStreamTlsResumeTests.ClientCert_DefaultValue_ResumeSucceeds	#133660
1620313	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#134623
1620310	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_SyncSslOptions.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail	#134965
1620135	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_SyncSslOptions.SslStream_StreamToStream_Authentication_IncorrectServerName_Fail
1619952	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#135038
1619585	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_TargetHostName_Succeeds	#134898

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
26	27	27

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.