wolfSSL TLS sessions retain native-CA trust after the application narrows trust

In curl 8.23.0 with the wolfSSL backend, a TLS session authenticated while the build-default native CA store is active can be resumed after the application changes the same easy handle to a policy that disables native trust. The second transfer succeeds and exchanges HTTP data even though an …

primary->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
...
if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
  ssl_origin->native_ca_store = TRUE;