sign_ecdsa(..., rfc6979=True) in the test framework derives the nonce from the raw message hash. RFC6979 section 2.3.4 (bits2octets) reduces the hash mod n first. libsecp256k1 has done so since 0.2.0. So for a hash >= n the framework's signature differs from libsecp256k1's, though it is still valid.
This is a small, correct fix with a test. The test checks two signatures computed with libsecp256k1, one of them for a hash >= n, and fails without the fix. The change has no practical effect on current tests: the only caller, feature_taproot.py, signs double-SHA256 sighashes, which are >= n with probability about 2^-128. If reviewers see no benefit, feel free to close it.
This is one of several PRs from a large audit of Bitcoin Core that I did with the help of LLM tools. The audit produced its evidence all at once, which is why the PRs arrive together. I understand each change fully and will answer review questions myself.
