It's also confused with the sources of malleability, listing DSA sign and DER encoding (which you note it calls asn.1) as the only sources; unfortunately there are a dozen of them... and as we came up with workaround with some, we'd find more. This is why are complete fix was needed rather than a series of hacks.