20260424-fixes

[douzzer]

linuxkm/lkcapi_ecdsa_glue.c: in km_ecdsa_verify(), add checks on hash_len following pattern of #10131, before calling wc_ecc_verify_hash(), for defense-in-depth.

tests/api.c: fix -Wnull-dereferences in wolfSSL_UseSecureRenegotiation().

tests/api/test_pkcs7.c: in test_wc_PKCS7_BER(), in expected-failure wc_PKCS7_DecodeEnvelopedData() in WOLFSSL_SP_MATH build, allow failure with either WC_KEY_SIZE_E or BUFFER_E, to accommodate blinding added by #10128 / 589feab.

wolfcrypt/test/test.c and wolfcrypt/test/test.h: fix gating for dsa_test() and srp_test() prototypes to avoid -Wunused-function in --enable-sp-math builds.

.github/workflows/:

• add -Wnull-dereference to all existing -pedantic -Wdeclaration-after-statement configs;
• add an --enable-sp-math config to .github/workflows/pq-all.yml and .github/workflows/multi-arch.yml.

wolfcrypt/test/test.c: in random_bank_test(), accommodate WOLFSSL_DRBG_SHA512 in the WC_RNG_BANK_FLAG_NO_VECTOR_OPS test;

linuxkm/lkcapi_sha_glue.c: in wc_mix_pool_bytes(), accommodate WOLFSSL_DRBG_SHA512.

wolfssl/wolfcrypt/random.h: fix "comma at end of enumerator list [-Werror=pedantic]" in enum wc_DrbgType.

configure.ac:

• allow for fips-dev in v7|ready|dev ENABLED_SHA256_DRBG and ENABLED_SHA512_DRBG setup, and change from AC_MSG_WARN to AC_MSG_ERROR if user tries to disable outside fips-dev;
• set ENABLED_SHA512_DRBG=no in lean-aesgcm setup;

wolfcrypt/test/test.c: suppress concurrency-mt-unsafe in myFipsCb();

.wolfssl_known_macro_extras: fix lexical order.

tested with

wolfssl-multi-test.sh ...
super-quick-check
linuxkm-legacy-6.12-insmod
quantum-safe-fips-dev-wolfssl-all-noasm-stack-sizes-linuxkm-6.12
'.*cust-kernel-2.*'
all-gcc-c99
check-source-text
all-crypt-sp-math-vector-register-access
lean-fips-dev-clang-tidy
lean-fips-dev-sanitizer
linuxkm-6.15-all-cryptonly-quantum-safe-fips-dev-intelasm-insmod-crypto-fuzzer-ksan
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-fips-dev-linuxkm-next-insmod

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10308

Scan targets checked: linuxkm-bugs, linuxkm-src

No new issues found in the changed files. ✅

[kaleb-himes]

1. configure.ac: I see, replacing the "warn then override attempt to disable drbg at configure time" with "honor the request to disable with a build error", that's actually more in line with historical patterns. Good change.

2. I'm pretty sure WC_MIN_DIGEST_SIZE is defined for lkcapi_ecdsa_glue.c but if not in all cases I could see that causing build issues eventually. Noteworthy but not PR holdup worthy.

3. test_pkcs7.c ~ line 4580 accepts two error conditions now, the original only expected WC_KEY_SIZE_E, could hide a regression someday with the || logic (what if WC_KEY_SIZE_E never returns in some future PR we'd lose it and not know it). Shifting error codes, note-worthy, not PR hold up worthy.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-tls12

[douzzer]

retest this please
(tooling glitch in Visual Studio Build Test)

[douzzer]

note, hostap and OpenVPN test failures appear to be unrelated to this PR (present in master).

[douzzer]

note, this PR contains critical test layer fixes for #9843