Based on #1956; only the last three commits are new. Random inputs almost never reach three paths: the retry loop in ECDSA signing, because RFC6979 practically never returns an invalid nonce; the rejection in ECDSA and Schnorr verification when the computed point is infinity; and silent payments output creation for a spend key of minus the output tweak. The first commit signs in the ecdsa and recovery targets with a nonce function that first returns 0 or a value above n, or fails at a chosen attempt, and checks that signing fails exactly when the nonce function does; schnorrsig gets such nonces too, checked only as far as its header documents. The second commit builds the key or signature that makes verification compute infinity, and checks that it is rejected. Both techniques come from @erickcestari's diffsecp. The third commit, as @Yudis-bit suggested on #1956, sometimes sets the spend key to minus the tweak, checks that output creation fails as documented and that the target's fallback then works, and moves the sent output among the decoys.
With -seed=1 -runs=20000, the retry loop in ecdsa and recovery, both infinity rejections and the silent payments fallback each run thousands of times; on #1956 all five are 0. Breaking each path on purpose, by stopping at an invalid nonce, accepting at infinity or creating an output for minus the tweak, makes the targets fail.
Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
