From c7a4869eb9df2ec9cfdb2cd473db75d1a90b1439 Mon Sep 17 00:00:00 2001
From: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Date: Wed, 11 Nov 2026 09:09:08 +0000
Subject: [PATCH] docs(pe): explain legacy Windows target selection failures

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
---
 docs/pe-certificates.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/pe-certificates.md b/docs/pe-certificates.md
index 20ef9261e5..c425270974 100644
--- a/docs/pe-certificates.md
+++ b/docs/pe-certificates.md
@@ -51,6 +51,12 @@ image is unsigned in every catalog or overlay sense.
 
 ## Limits and failures
 
+Confirmed DOS-only MZ files and declared NE, LE, or LX signatures are outside
+this PE32/PE32+ workflow and return `unsupported_target` with target-selection
+recovery. A recognized non-PE signature does not need a PE COFF header to be
+classified. Unrecognized signatures and truncated PE headers remain malformed
+input. `inspect-pe-resources` uses the same header admission and classifications.
+
 The selected file is limited to 64 MiB by default (512 MiB maximum). At most
 eight `WIN_CERTIFICATE` entries are examined by default. Malformed PE headers,
 truncated certificate entries, and PKCS#7 that is not structurally signedData