int doFinalInternal(byte[] input, int inputOffset, int inputLen,
            byte[] output, int outputOffset)
            throws ShortBufferException, IllegalBlockSizeException, BadPaddingException {
        checkInitialization();

        byte[] in;
        int inOffset;
        int inLen;
        if (bufCount > 0) {
            if (inputLen > 0) {
                appendToBuf(input, inputOffset, inputLen);
            }
            in = buf.array();
            inOffset = 0;
            inLen = bufCount;
        } else {
            if (inputLen == 0 && input == null) {
                in = EmptyArray.BYTE; // input can be null when inputLen == 0
            } else {
                in = input;
            }
            inOffset = inputOffset;
            inLen = inputLen;
        }

        byte[] aad = getAad();
        final int bytesWritten;
        try {
            if (isEncrypting()) {
                bytesWritten = NativeCrypto.EVP_AEAD_CTX_seal(evpAead, encodedKey,
                        tagLengthInBytes, output, outputOffset, iv, in, inOffset, inLen, aad);
            } else {
                bytesWritten = NativeCrypto.EVP_AEAD_CTX_open(evpAead, encodedKey,
                        tagLengthInBytes, output, outputOffset, iv, in, inOffset, inLen, aad);
            }
        } catch (BadPaddingException e) {
            throwAEADBadTagExceptionIfAvailable(e.getMessage(), e.getCause());
            throw e;
        }
        if (isEncrypting()) {
            mustInitialize = true;
        }
        reset();
        return bytesWritten;
    }
Returns whether reusing nonces is allowed (aka, whether this is nonce misuse-resistant).
Most AEAD ciphers are not, but some are specially constructed so that reusing a key/nonce
pair is safe.
common/src/main/java/org/conscrypt/OpenSSLAeadCipher.java