This adds two test vectors, each with a p2pkh input whose scriptSig also pushes another valid pubkey.
The first uses the scriptSig from the test in bitcoin/bitcoin#36338 by @theStack: <sig> <pubkey> <bogus_sig> OP_OVER OP_CHECKSIG OP_IF <other_pubkey> OP_ENDIF. Evaluating this scriptSig with a checker that accepts any signature leaves <other_pubkey> on top of the stack. The existing malleated p2pkh vector does not cover this.
The second is the <dummy> OP_DROP <sig> <pubkey> case @jonatack suggested in that PR, with a valid pubkey as the dummy. It catches an extractor that takes the first 33-byte push without checking its hash.
The expected values come from reference.py. btclib-wallet's vector tests also pass on the new file.
I ran Bitcoin Core's bip352_tests with the new file in place of its vendored copy:
- at the head of #36338 (cdfaa534), all 30 vectors pass;
- on master's code, the first new vector fails;
- on #36338 without its Hash160 check, the second new vector fails.
Core's test does not compare input_pub_keys, so each failure shows on the receiving side: the wrong key gives a wrong tweak, and no output is found.
Made with my usual tools: a computer, the Internet and an LLM. The mistakes, as usual, are all mine.