Hacker News Reader

Depends on the mode. AES-CTR encrypts an increasing counter to make a keystream, then xors that with the plaintext to make the ciphertext, or with the ciphertext to make the plaintext. Any consistent error in encryption will lead to a consistently wrong keystream, which will round-trip successfully.

It's possible other modes have this property because of the structure of the cipher itself, but that's way out of my league.

The intel AES instructions work at a block level. You build the mode on top of the block level primitives intel gives you. https://en.wikipedia.org/wiki/AES_instruction_set

Sounds like a corrupted S-box or something like that in the hardware implementing AES-NI

This specifically stood out to me - it implies it is possible to hide weakened/bad crypto via manufacturing bugs

I'm not sure about that. I think it's just that the AES hardware was busted somehow and didn't actually perform the AES algorithm correctly. The intel AES hardware just deterministically performs the algorithm, so Intel can't just weaken the algorithm somehow, at least if you're not worrying about local side channels.