diff --git a/src/winhello.c b/src/winhello.c
index 3fb95d58..ff969a4f 100644
--- a/src/winhello.c
+++ b/src/winhello.c
@@ -408,6 +408,10 @@ pack_cred_ext(WEBAUTHN_EXTENSIONS *out, const fido_cred_ext_t *in)
 	}
 	out->cExtensions = (DWORD)n;
 	if (in->mask & FIDO_EXT_HMAC_SECRET) {
+		/*
+		 * NOTE: webauthn.dll ignores requests to enable hmac-secret
+		 * unless a discoverable credential is also requested.
+		 */
 		if ((b = calloc(1, sizeof(*b))) == NULL) {
 			fido_log_debug("%s: calloc", __func__);
 			return -1;