Follow up for 61751 as underflow should be returned when no app bytes are produced but all encrypted input bytes have been consumed. Handshake remains specific as app bytes are never produced.
tomcat/trunk/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
tomcat/trunk/webapps/docs/changelog.xml