Cryptographic weakness on Debian systems

Let me offer a thought experiment that helps to show what's going on here, so far as I can
figure it out (and it's a bad sign that Debian's bug for this never gets anywhere near this
level of analysis)

Suppose I write a function int average(char *values, int count)

it takes 'count' bytes from the array pointed at by 'values' and is supposed to return an
arithmetic average, the mean value.

{
  /* for simplicity let's not worry about overflow right now */
  int total = 0;
  for (int k = 0; k < count; ++k) {
    total += values[k];
  }
  return total / count;
}

If you declare an array of 16 bytes, and pass it to me with the count of 16, then I will
return the average of those 16 bytes. Suppose you screw up, with an off-by-one error, and only
fill out 15 bytes, but still set the count parameter to 16, the size of your array. My
function will still work, it won't ever crash, and the result will be almost correct, since
whatever the value of the 16th byte, it will be dwarfed by the other 15 values in calculating
an average.

Now, when you run valgrind over the resulting program, it will report that my average()
function is faulty, it accesses an unintialised value.

Apparently at this point the Debian developers would say "Aha, stupid average function, we'll
soon fix that" and comment out the line total += values[k]; which is of course completely the
wrong fix.