diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c
index 4346aacb4..1ff49a8d4 100644
--- a/wolfcrypt/benchmark/benchmark.c
+++ b/wolfcrypt/benchmark/benchmark.c
@@ -8100,7 +8100,8 @@ void bench_lms(void)
 
 #if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
 
-static int xmss_write_key_mem(const byte * priv, word32 privSz, void *context)
+static enum wc_XmssRc xmss_write_key_mem(const byte * priv, word32 privSz,
+    void *context)
 {
    /* WARNING: THIS IS AN INSECURE WRITE CALLBACK THAT SHOULD ONLY
     * BE USED FOR TESTING PURPOSES! Production applications should
@@ -8109,7 +8110,8 @@ static int xmss_write_key_mem(const byte * priv, word32 privSz, void *context)
     return WC_XMSS_RC_SAVED_TO_NV_MEMORY;
 }
 
-static int xmss_read_key_mem(byte * priv, word32 privSz, void *context)
+static enum wc_XmssRc xmss_read_key_mem(byte * priv, word32 privSz,
+    void *context)
 {
    /* WARNING: THIS IS AN INSECURE READ CALLBACK THAT SHOULD ONLY
     * BE USED FOR TESTING PURPOSES! */
@@ -8179,14 +8181,14 @@ static void bench_xmss_sign_verify(const char * params)
     }
 
     /* Allocate secret keys.*/
-    sk = XMALLOC(skSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    sk = (unsigned char *)XMALLOC(skSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     if (sk == NULL) {
         fprintf(stderr, "error: allocate xmss sk failed\n");
         goto exit_xmss_sign_verify;
     }
 
     /* Allocate signature array. */
-    sig = XMALLOC(sigSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    sig = (byte *)XMALLOC(sigSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     if (sig == NULL) {
         fprintf(stderr, "error: allocate xmss sig failed\n");
         goto exit_xmss_sign_verify;
@@ -8300,11 +8302,6 @@ exit_xmss_sign_verify:
         freeKey = 0;
     }
 
-    if (sig != NULL) {
-        XFREE(sig, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
-        sig = NULL;
-    }
-
     return;
 }
 
diff --git a/wolfcrypt/src/ext_xmss.c b/wolfcrypt/src/ext_xmss.c
index 5126c9747..c19e95e91 100644
--- a/wolfcrypt/src/ext_xmss.c
+++ b/wolfcrypt/src/ext_xmss.c
@@ -57,7 +57,7 @@ static int rng_cb(void * output, size_t length)
         return 0;
     }
 
-    ret = wc_RNG_GenerateBlock(xmssRng, output, (word32) length);
+    ret = wc_RNG_GenerateBlock(xmssRng, (byte *)output, (word32)length);
 
     if (ret) {
         WOLFSSL_MSG("error: XMSS rng_cb failed");
@@ -415,7 +415,8 @@ static int wc_XmssKey_AllocSk(XmssKey* key)
         return -1;
     }
 
-    key->sk = XMALLOC(key->sk_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    key->sk = (unsigned char *)XMALLOC(key->sk_len, NULL,
+                                       DYNAMIC_TYPE_TMP_BUFFER);
 
     if (key->sk == NULL) {
         WOLFSSL_MSG("error: malloc XMSS key->sk failed");
@@ -731,6 +732,16 @@ int wc_XmssKey_Sign(XmssKey* key, byte * sig, word32 * sigLen, const byte * msg,
         return -1;
     }
 
+    if (key->write_private_key == NULL || key->read_private_key == NULL) {
+        WOLFSSL_MSG("error: XmssKey write/read callbacks are not set");
+        return -1;
+    }
+
+    if (key->context == NULL) {
+        WOLFSSL_MSG("error: XmssKey context is not set");
+        return -1;
+    }
+
     /* Finally, sign and update the secret key. */
     wc_XmssKey_SignUpdate(key, sig, sigLen, msg, msgLen);
 
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index 9ececfb91..9e4ea9f10 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -35122,7 +35122,8 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t kyber_test(void)
 #endif /* WOLFSSL_HAVE_KYBER */
 
 #if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
-static int xmss_write_key_mem(const byte * priv, word32 privSz, void *context)
+static enum wc_XmssRc xmss_write_key_mem(const byte * priv, word32 privSz,
+    void *context)
 {
    /* WARNING: THIS IS AN INSECURE WRITE CALLBACK THAT SHOULD ONLY
     * BE USED FOR TESTING PURPOSES! Production applications should
@@ -35131,7 +35132,8 @@ static int xmss_write_key_mem(const byte * priv, word32 privSz, void *context)
     return WC_XMSS_RC_SAVED_TO_NV_MEMORY;
 }
 
-static int xmss_read_key_mem(byte * priv, word32 privSz, void *context)
+static enum wc_XmssRc xmss_read_key_mem(byte * priv, word32 privSz,
+    void *context)
 {
    /* WARNING: THIS IS AN INSECURE READ CALLBACK THAT SHOULD ONLY
     * BE USED FOR TESTING PURPOSES! */
@@ -35191,7 +35193,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t xmss_test(void)
     if (ret != 0) { return WC_TEST_RET_ENC_EC(ret); }
 
     /* Allocate signature array. */
-    sig = XMALLOC(sigSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    sig = (byte *)XMALLOC(sigSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     if (sig == NULL) { return WC_TEST_RET_ENC_ERRNO; }
 
     bufSz = sigSz;
@@ -35204,10 +35206,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t xmss_test(void)
 #endif
 
     /* Allocate current and old secret keys.*/
-    sk = XMALLOC(skSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    sk = (unsigned char *)XMALLOC(skSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     if (sk == NULL) { return WC_TEST_RET_ENC_ERRNO; }
 
-    old_sk = XMALLOC(skSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    old_sk = (unsigned char *)XMALLOC(skSz, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     if (old_sk == NULL) { return WC_TEST_RET_ENC_ERRNO; }
 
     XMEMSET(sk, 0, skSz);
diff --git a/wolfssl/wolfcrypt/xmss.h b/wolfssl/wolfcrypt/xmss.h
index aef2c5b5f..7cd8f27ff 100644
--- a/wolfssl/wolfcrypt/xmss.h
+++ b/wolfssl/wolfcrypt/xmss.h
@@ -91,10 +91,6 @@
 
 typedef struct XmssKey XmssKey;
 
-/* Private key write and read callbacks. */
-typedef int (*write_private_key_cb)(const byte * priv, word32 privSz, void *context);
-typedef int (*read_private_key_cb)(byte * priv, word32 privSz, void *context);
-
 /* Return codes returned by private key callbacks. */
 enum wc_XmssRc {
   WC_XMSS_RC_NONE,
@@ -116,6 +112,10 @@ enum wc_XmssState {
     WC_XMSS_STATE_NOSIGS      /* Signatures exhausted. */
 };
 
+/* Private key write and read callbacks. */
+typedef enum wc_XmssRc (*write_private_key_cb)(const byte * priv, word32 privSz, void *context);
+typedef enum wc_XmssRc (*read_private_key_cb)(byte * priv, word32 privSz, void *context);
+
 #ifdef __cplusplus
     extern "C" {
 #endif