[douzzer]

configure.ac, wolfcrypt/src/aes.c, wolfssl/wolfcrypt/wc_mldsa.h: add missing exemptions to the FIPS v7 refusals: for $ENABLED_MLDSA_NO_CTX / WOLFSSL_MLDSA_NO_CTX / WOLFSSL_MLDSA_FIPS204_DRAFT, when fips-dev and experimental are both enabled; and for $ENABLED_AESSIV / WOLFSSL_AES_SIV, $ENABLED_AESEAX / WOLFSSL_AES_EAX, $ENABLED_AESGCMSIV / WOLFSSL_AESGCM_SIV, $ENABLED_AESCTS / WOLFSSL_AES_CTS, and $ENABLED_AESKEYWRAP_PADDING / WOLFSSL_AES_KEYWRAP_PADDING, when fips-dev is enabled.

tested with

wolfssl-multi-test.sh ...
fips-140-3-dev-optest-acvp-sp-asm
fips-140-3-ready-optest-acvp-sp-asm
check-configure
check-source-text

With wolfssl/fips#437

[Copilot]

🔵 Needs a closer look

Integration of the FIPS-boundary exemptions with wolfssl/fips#437 needs validation because the companion changes and FIPS overlay are unavailable in this checkout.

No open issues 🎉

What changed in this PR

This PR adds development-only exemptions to wolfSSL’s FIPS v7 feature restrictions while preserving the restrictions for non-development FIPS builds.

Changes:

• Permit ML-DSA no-context and draft APIs when both FIPS development mode and experimental settings are enabled.
• Permit AES-SIV, EAX, GCM-SIV, CTS, and key-wrap padding in FIPS development mode.
• Align configure-time checks with source-level guards.

File	Description
wolfssl/​wolfcrypt/​wc_mldsa.h	Exempts experimental FIPS development builds from ML-DSA API restrictions.
wolfcrypt/​src/​aes.c	Exempts FIPS development builds from the listed AES feature restrictions.
configure.ac	Adds corresponding development-mode exemptions to configuration checks.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +36 B, text +11,680 B (+4.2%, 294,188 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12114

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): configure.ac
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max