pwhash: return a zeroed output buffer on error paths.