#35873 test: add a tx_valid vector for CVE-2024-38365

• Add a positive test vector verifying transactions where embedded signatures survive inside pushdata
• Protects downstream implementations and future refactors against consensus regressions from CVE-2024-38365

This pull request adds a new test case to src/test/data/tx_valid.json exercising the positive path of FindAndDelete during pre-segwit scriptCode evaluation. Specifically, it tests that an opcode push containing an embedded signature is not stripped during FindAndDelete, which was the cause of the consensus split in CVE-2024-38365.

Problem: While negative paths and FindAndDelete failure behavior were already tested in script_FindAndDelete and tx_invalid.json, Core lacked a positive tx_valid.json test vector verifying that a transaction is accepted when an embedded signature survives inside a push. Downstream implementations and future refactors could inadvertently regress on this consensus edge case without a positive test vector.

P3 · test coverage

• P3 because it adds regression test coverage for a consensus edge case that split another implementation
• Pins critical script evaluation behavior against regressions where Core only tested failure paths

P3 because it adds valuable regression test coverage for a known consensus edge case that previously caused a chain split in btcd (CVE-2024-38365). Core's FindAndDelete implementation had negative failure test coverage, but lacked a vector asserting the positive acceptance of transactions where pushdata containing a signature must remain in the scriptCode.

Membership: validation.md covers block and transaction validity rules and the tests that pin this behavior, such as tx_valid.json vectors for script execution rules.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 1

• Ready for review: clean 7-line test vector change passing CI

The PR contains 7 lines in a single test vector file, passes CI, has no merge conflicts, and is ready for further review.

Author status: active

• Strong support with no open objections
• Verified by mutation testing that btcd-style deletion fails the test (sedited)

Strong support; sedited ACKed and confirmed through mutation testing that the test catches btcd-style deletions.

Sedited reviewed and tested the PR with mutation testing, confirming it catches the intended behavior without any objections raised.

• sedited ACKed commit 6cd2fa5fb4 after verifying that a mutation doing a btcd-style delete fails the test.

Review verdicts (DrahtBot): 1

• ACK: sedited

7 lines under test/bench/ci.

• src/test/data/tx_valid.json +7/-0

• Whether maintainers prefer keeping test vector additions solely tracked under tests or validation, though the category rubric explicitly directs area tests to the area itself.

This PR adds a test vector to tx_valid.json covering the positive acceptance rule for FindAndDelete in pre-segwit script execution. It tests that signatures embedded inside push data are preserved in the scriptCode rather than stripped, addressing the consensus divergence between btcd and Bitcoin Core in CVE-2024-38365. Bitcoin Core already had failure tests for this rule, but lacked a vector asserting that valid transactions relying on the preserved push are accepted. Review is ready and mergeable, with one ACK confirming mutation testing against btcd-style deletion. The PR is self-contained and has no dependencies.