CVE-2015-3193 in OpenSSL, CVE-2016-1938 in NSS. There were more, it's been a while.

Ultimately: things like a^b or a/b would return wrong results for certain inputs.