I discovered that several of the tests call the library function with the wrong string length.
Example (t-test68.c):
status = dkim_body(dkim, BODY06, strlen(BODY05));
This is obviously wrong, as it calls the function with the string BODY06 and the length of the string BODY05. This was discovered by running the tests with address sanitizer enabled.
I found three such issues, patch attached.
Applied for next release.