pbkdf2-hmac-sha256 validation bug.  Same in the CPU format