In OpenSSL 1.1.1a, setting AAD for AES-256-OCB mode using EVP_CipherUpdate() returns a surprising outlen. I would have expected outlen to match aad_size but it seems to be truncated down to the nearest multiple of blocks, unlike ciphers such as GCM or ChaCha20-Poly1305.

int outlen = 0;
EVP_CipherUpdate(ctx, NULL, &outlen, aad, aad_size);
if (outlen != aad_size) {
  printf("outlen=%i aad_size=%i\n", outlen, aad_size);
}
assert(outlen == aad_size);