[CamperBob2]

Who said anything about leaving a vulnerability in the code? If your security model depends on a suboptimal implementation of strcmp(), you have bigger problems than timing attacks.

[tptacek]

I have no idea what you mean by "suboptimal implementation of strcmp".