Repository: dotnet/runtime
File: src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs (C#)

Code before:
            await ForceAuthenticationAsync(adapter, receiveFirst: false, buffer).ConfigureAwait(false);
            FinishHandshakeRead(LockNone);
        }

        // reAuthenticationData is only used on Windows in case of renegotiation.
        private async Task ForceAuthenticationAsync<TIOAdapter>(TIOAdapter adapter, bool receiveFirst, byte[] reAuthenticationData, bool isApm = false)
             where TIOAdapter : ISslIOAdapter
        {
            _framing = Framing.Unknown;
            ProtocolToken message;

            if (reAuthenticationData == null)
            {
                // prevent nesting only when authentication functions are called explicitly. e.g. handle renegotiation transparently.
                if (Interlocked.Exchange(ref _nestedAuth, 1) == 1)
                {
                    throw new InvalidOperationException(SR.Format(SR.net_io_invalidnestedcall, isApm ? "BeginAuthenticate" : "Authenticate", "authenticate"));
                }
            }

            try
            {

                if (!receiveFirst)
                {
                    message = _context.NextMessage(reAuthenticationData == null ? default : new ReadOnlySpan<byte>(reAuthenticationData));
                    if (message.Size > 0)
                    {
                        await adapter.WriteAsync(message.Payload, 0, message.Size).ConfigureAwait(false);
                    }

                    if (message.Failed)
                    {
                        // tracing done in NextMessage()
                        throw new AuthenticationException(SR.net_auth_SSPI, message.GetException());
                    }
                }

                _handshakeBuffer = new ArrayBuffer(InitialHandshakeBufferSize);
                do
                {
                    message = await ReceiveBlobAsync(adapter).ConfigureAwait(false);
                    if (message.Size > 0)
                    {
                        // If there is message send it out even if call failed. It may contain TLS Alert.
                        await adapter.WriteAsync(message.Payload, 0, message.Size).ConfigureAwait(false);
                    }

                    if (message.Failed)
                    {
                        throw new AuthenticationException(SR.net_auth_SSPI, message.GetException());

Review comment (security):
This conditional shouldn't be necessary, as a null array is converted to a default span by span's ctor/implicit cast/etc.
```suggestion
                    message = _context.NextMessage(reAuthenticationData);
```

Code after:
            await ForceAuthenticationAsync(adapter, receiveFirst: false, buffer).ConfigureAwait(false);
            FinishHandshakeRead(LockNone);
        }

        // reAuthenticationData is only used on Windows in case of renegotiation.
        private async Task ForceAuthenticationAsync<TIOAdapter>(TIOAdapter adapter, bool receiveFirst, byte[] reAuthenticationData, bool isApm = false)
             where TIOAdapter : ISslIOAdapter
        {
            _framing = Framing.Unknown;
            ProtocolToken message;

            if (reAuthenticationData == null)
            {
                // prevent nesting only when authentication functions are called explicitly. e.g. handle renegotiation transparently.
                if (Interlocked.Exchange(ref _nestedAuth, 1) == 1)
                {
                    throw new InvalidOperationException(SR.Format(SR.net_io_invalidnestedcall, isApm ? "BeginAuthenticate" : "Authenticate", "authenticate"));
                }
            }

            try
            {

                if (!receiveFirst)
                {
                    message = _context.NextMessage(reAuthenticationData);
                    if (message.Size > 0)
                    {
                        await adapter.WriteAsync(message.Payload, 0, message.Size).ConfigureAwait(false);
                    }

                    if (message.Failed)
                    {
                        // tracing done in NextMessage()
                        throw new AuthenticationException(SR.net_auth_SSPI, message.GetException());
                    }
                }

                _handshakeBuffer = new ArrayBuffer(InitialHandshakeBufferSize);
                do
                {
                    message = await ReceiveBlobAsync(adapter).ConfigureAwait(false);
                    if (message.Size > 0)
                    {
                        // If there is message send it out even if call failed. It may contain TLS Alert.
                        await adapter.WriteAsync(message.Payload, 0, message.Size).ConfigureAwait(false);
                    }

                    if (message.Failed)
                    {
                        throw new AuthenticationException(SR.net_auth_SSPI, message.GetException());