diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index 185ef9332d..4f019d7573 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -255,6 +255,13 @@ static void simulate_badmac_seen_on(mbedtls_test_ssl_endpoint *client,
     defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) && \
     defined(MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE) && \
     defined(PSA_WANT_ECC_SECP_R1_384)
+/* This is intentionally not a full Hello parser. The test only needs to create
+ * a well-formed duplicate-extension vector entry, so for simplicity and
+ * maintainability it uses two TLS 1.3 properties: ClientHello and ServerHello
+ * carry extensions as their final field, and the generated messages in this
+ * test configuration always contain extensions. Extension entries are
+ * variable-size, so the helper walks the vector only far enough to identify the
+ * final complete extension. */
 static int tls13_duplicate_last_extension(mbedtls_ssl_context *ssl,
                                           unsigned int hs_type,
                                           unsigned char *buf,
@@ -276,9 +283,6 @@ static int tls13_duplicate_last_extension(mbedtls_ssl_context *ssl,
     TEST_ASSERT(buf == ssl->in_msg + 4);
     TEST_EQUAL(buf_len, ssl->in_hslen - 4);
 
-    /* The tests fetch a syntactically valid Hello message generated by Mbed TLS
-     * and only need to locate its final extensions vector. Keep this parser
-     * narrow: skip the known prefix for the selected Hello type. */
     p = buf;
 
     if (hs_type == MBEDTLS_SSL_HS_CLIENT_HELLO) {
@@ -296,12 +300,8 @@ static int tls13_duplicate_last_extension(mbedtls_ssl_context *ssl,
     extensions_len_p = p;
     extensions_len = MBEDTLS_GET_UINT16_BE(extensions_len_p, 0);
     p += 2;
-    /* In TLS 1.3 ClientHello and ServerHello, extensions are the last field. */
     TEST_ASSERT(p + extensions_len == extensions_end);
 
-    /* Extension data is variable-length, so walk the list to identify one
-     * complete extension. Duplicating the last one keeps the malformed message
-     * simple: append a well-formed extension entry to the existing vector. */
     while (p < extensions_end) {
         TEST_LE_U(4, (size_t) (extensions_end - p));
 
@@ -327,9 +327,7 @@ static int tls13_duplicate_last_extension(mbedtls_ssl_context *ssl,
     TEST_LE_U((size_t) (content_end - ssl->in_buf) + last_ext_len,
               (size_t) (input_buf_end - ssl->in_buf));
 
-    /* The fetched message is kept for the next handshake step. Patch both the
-     * wire-format lengths and ssl's in-memory length fields so the normal
-     * parser sees the appended duplicate extension. */
+    /* Preserve anything coalesced after this Hello in the same record. */
     memmove(extensions_end + last_ext_len, extensions_end,
             content_end - extensions_end);
     memcpy(extensions_end, last_ext, last_ext_len);
@@ -4471,17 +4469,23 @@ void tls13_rejects_extension_duplicate(int endpoint)
                 &(client_ep.ssl), MBEDTLS_SSL_HS_SERVER_HELLO,
                 &buf, &buf_len);
             TEST_EQUAL(ret, 0);
+            /* Do not consume, re-use the modified message */
             client_ep.ssl.keep_current_message = 1;
 
             ret = tls13_duplicate_last_extension(
                 &(client_ep.ssl), MBEDTLS_SSL_HS_SERVER_HELLO, buf, buf_len);
             TEST_EQUAL(ret, 0);
 
+            /* Resume normal processing and verify the duplicate is rejected by
+             * mbedtls_ssl_tls13_check_received_extension(). */
             ret = mbedtls_ssl_handshake_step(&(client_ep.ssl));
             TEST_EQUAL(ret, MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
             break;
 
         case MBEDTLS_SSL_IS_SERVER:
+            /* Fetch ClientHello without advancing the transcript, then keep
+             * and mutate it in-place so the next handshake step parses the
+             * duplicate extension normally. */
             ret = mbedtls_test_move_handshake_to_state(
                 &(server_ep.ssl), &(client_ep.ssl),
                 MBEDTLS_SSL_CLIENT_HELLO);
@@ -4502,12 +4506,15 @@ void tls13_rejects_extension_duplicate(int endpoint)
                 &(server_ep.ssl), MBEDTLS_SSL_HS_CLIENT_HELLO,
                 &buf, &buf_len);
             TEST_EQUAL(ret, 0);
+            /* Do not consume, re-use the modified message */
             server_ep.ssl.keep_current_message = 1;
 
             ret = tls13_duplicate_last_extension(
                 &(server_ep.ssl), MBEDTLS_SSL_HS_CLIENT_HELLO, buf, buf_len);
             TEST_EQUAL(ret, 0);
 
+            /* Resume normal processing and verify the duplicate is rejected by
+             * mbedtls_ssl_tls13_check_received_extension(). */
             ret = mbedtls_ssl_handshake_step(&(server_ep.ssl));
             TEST_EQUAL(ret, MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
             break;