Update notes for submitted changes

* MD5: add a missing bounds check