OpenSSL TLS/DTLS handshake memory-bloat DoS ("HollowByte"): when reading a handshake message, tls_get_message_body() allocated the init_buf to the full message size declared in the 4-byte handshake header before the payload data arrived. A remote peer can send a tiny (~11-byte) message header claiming a very large size and then never send the body, forcing the server to reserve a large buffer and block. Repeated across connections with randomized sizes this fragments the heap and permanently bloats process memory until restart. Fixed by growing init_buf incrementally (in <=16KB chunks) as data actually arrives (new grow_init_buf() in ssl/statem/statem_lib.c). Reported by Okta Red Team; handled by OpenSSL as a bug/hardening fix. Fixed in 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21.