Is it possible cb is negative?

It's extremely unlikely as the data we are dealing with here is typically a dozen to a few hundred bytes. If it overflows to negative then the array-new will give a runtime exception, but I don't anticipate it would ever happen unless someone was doing something extremely nonsensical.

And in case it's ambiguous, Win32 calls it DWORD, so there's not "negative", just "really, really big"

We could probably do some improvement here.

1. If cbData != keyIdentifier.Length return false without the second dip.
2. If cbData <= some cap, stackalloc.

cbData'll be 20 99% of the time, so even a stackalloc-128 probably eliminates all allocations from this routine.

And we could do even better if we did the stackalloc first.

const int MaxStackAlloc = 64;

if (keyIdentifier.Length <= MaxStackAlloc)
{
    Span<byte> actualKeyId = stackalloc byte[keyIdentifier.Length];

    if (!Interop.Crypt32.CertGetCertificateContextProperty(pCertContext, Interop.Crypt32.CertContextPropId.CERT_KEY_IDENTIFIER_PROP_ID, actualKeyId, ref cbData))
    {
        return false;
    }

    return actualKeyId.Slice(0, cbData).SequenceEquals(keyIdentifier);
}
else
{
    // the current code, more or less.
}

If cbData != keyIdentifier.Length return false without the second dip.

I'm a little nervous of that since some CAPI APIs I've seen, on the "give null and I'll give you a length" give you a size that is at least big enough to hold the result, while the second call with the real buffer gives the "real" length.

Agree we can put some things on the stack though.

stackalloc byte[keyIdentifier.Length];

ಠ_ಠ

OK,

Span<byte> actualKeyId = stackalloc byte[64];

if (keyIdentifier.Length <= actualKeyId.Length)
{
   ...
}

😄