So, uh, what happened next? Clearly this code never worked. Was it dead code? Did the vendor explain how their test suite could have missed this? Did you disqualify the vendor entirely? If not, how did you proceed with the rest of the audit knowing that this level of incompetence made it to shipping?
I had to reverse engineer Chinese SDK's for various embedded chips. Their libs were full of this shit. It works in some cases, but rarely in all. In embedded you can thankfully throw this shit out and replace it.