The vulnerability (CVE-2024-5642) description clearly identifies SSLContext.set_npn_protocols() as the problematic function in CPython. This function allowed an empty list as input for NPN protocols. This input was passed to an underlying C function, _ssl._SSLContext._set_npn_protocols (implemented by _ssl__SSLContext__set_npn_protocols_impl in Modules/_ssl.c). The provided commit 39258d3595300bc7b952854c915f63ae2d4b9c3e, which is part of the fix (PR #23014), removes the C implementation of NPN support, including _ssl__SSLContext__set_npn_protocols_impl. The analysis of the removed C code shows that it accepted a zero-length protocol list (protos->len == 0) without validation, which is the core of CPython's part in this vulnerability, as it then passed this invalid configuration to OpenSSL. Therefore, both the Python entry point and its C implementation are identified as vulnerable in their state prior to the fix.