0 = all ok, >0 = so much more bytes needed to encrypt last block */
source not stored for this graph (policy: none)
nothing calls this directly
no test coverage detected