The function/module in question is
dal_CSSM_ModuleLoadAndAttach() in the module
CSSM_ModuleAttach() (Page 108 Version 2 of the CDSA
Technical Standard) calls clearly for the version
parameter to be the:
"The major and minor version number of CDSA that the
application is compatible with."
This is enforced in cssm.c during module loading, i.e.
version is checked against the constants CSSM_MAJOR
The code below is using the product version assigned
to the version member of the CSSM_SUBSERVICE_UID
structure itself documented as representing the
"The version of the security service module"
This is backed up by the generic description of the
CSSM_VERSION structure which is:
"This structure is used to represent the version of
the CDSA components."
The actual use of the version is therefore slightly
ambiguous however I am sure the intention is that this
module loader is expecting the version of CDSA/CSSM
and not the version of the add-in module which is
intented to be supplied in the CSSM_SUBSERVICE_UID