The scalar multiplication includes pre-computed tables for speedup (introduced in mirage-crypto-ec 0.11.3). The lookup algorithm for these tables performs secret-dependent reads instead of scanning the entire table.

Instead of using the index n - 1, where n is secret-dependent, use i - 1, as done in the Go reference implementation. If n is 0, there is a out-of-bounds read before the patch.