The vulnerability stemmed from the OpenSSL gem's cipher initialization logic. The function ossl_cipher_initialize in ext/openssl/ossl_cipher.c explicitly set a dummy key (all zeros) via EVP_CipherInit_ex(ctx, cipher, NULL, dummy_key, NULL, -1). This dummy key initialization was a workaround for a segfault issue in older OpenSSL versions. However, in AES-GCM mode, setting the IV before the real key after this dummy initialization would cause the IV to be reset to zero when the real key was later applied (due to OpenSSL's internal reinitialization behavior). The commit 8108e0a removed this dummy key initialization, fixing the IV retention issue. The presence of this dummy key setup directly enabled the IV reuse vulnerability.