Re: How can I catch the bug?

state_ctx isn't supposed to change. And state_ctx=NULL might be OK. I'll take a look. Thank you.

Yeah. It's best to fix the state code so that if State is larger than 16 octets, then the state code uses MD5(State), which should be better. I think `fr_state_find()` function also require a fix https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/main/state.c... because it still uses only first 16 octets. Or am I wrong?

-- Vladimir