feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/openssl-cve-2025-69421/fixed.c

@@ -0,0 +1,46 @@
+/* Provenance: openssl/openssl PKCS12_item_decrypt_d2i_ex (fixed).
+ * repo: openssl/openssl
+ * commit: 2c13bf15286328641a805eb3b7c97e27d42881fb
+ * parent: ea8fc4c345fbd749048809c9f7c881ea656b0b94
+ * commit_url: https://github.com/openssl/openssl/commit/2c13bf15286328641a805eb3b7c97e27d42881fb
+ * cve: CVE-2025-69421
+ * license: Apache-2.0
+ * function: PKCS12_item_decrypt_d2i_ex
+ * relpath: crypto/pkcs12/p12_decr.c
+ */
+
+void *PKCS12_item_decrypt_d2i_ex(const X509_ALGOR *algor, const ASN1_ITEM *it,
+    const char *pass, int passlen,
+    const ASN1_OCTET_STRING *oct, int zbuf,
+    OSSL_LIB_CTX *libctx,
+    const char *propq)
+{
+    unsigned char *out = NULL;
+    const unsigned char *p;
+    void *ret;
+    int outlen = 0;
+
+    if (oct == NULL) {
+        ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_NULL_PARAMETER);
+        return NULL;
+    }
+
+    if (!PKCS12_pbe_crypt_ex(algor, pass, passlen, oct->data, oct->length,
+            &out, &outlen, 0, libctx, propq))
+        return NULL;
+    p = out;
+    OSSL_TRACE_BEGIN(PKCS12_DECRYPT)
+    {
+        BIO_printf(trc_out, "\n");
+        BIO_dump(trc_out, out, outlen);
+        BIO_printf(trc_out, "\n");
+    }
+    OSSL_TRACE_END(PKCS12_DECRYPT);
+    ret = ASN1_item_d2i(NULL, &p, outlen, it);
+    if (zbuf)
+        OPENSSL_cleanse(out, outlen);
+    if (!ret)
+        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
+    OPENSSL_free(out);
+    return ret;
+}