Bouncy Castle and Salsa 20
My code above is a fascinating huge damping pile of... you know.

generator.init(password, salt, iterations);
Arrays.fill(password, (byte) 0);


BC fails to copy the content of the password array, so my security "improvement" of clearing the password after use, clears it before use and leads to a password of all zeros.

Btw., the mailing list was no better than this site. No answer.