Reject high-S signatures before calling Signature.fromBytes, which does internal scalar arithmetic that overflows on out-of-range S values. The check was previously done after fromBytes using the parsed sig.s field, but the construction itself panicked on malformed signatures (e.g., high-S or DER-encoded test vectors from the interop fixtures). Now rejectHighS operates on the raw signature bytes directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>