diff --git a/tests/api/test_ed448.c b/tests/api/test_ed448.c
index f64b83a202..2fe404b9c9 100644
--- a/tests/api/test_ed448.c
+++ b/tests/api/test_ed448.c
@@ -1353,7 +1353,7 @@ int test_wc_ed448_check_key_decisions(void)
 
     /* Same construction but with an extra byte (p[1]) perturbed so the
      * second range-check loop exits early with ret == 0 before the final
-     * byte compare runs -- closes that compare's (ret == PUBLIC_KEY_E)
+     * byte compare runs -- closes that compare's PUBLIC_KEY_E
      * guard operand's FALSE side. */
     near_p[1] = 0x00;
     ExpectIntEQ(wc_ed448_init(&freshKey), 0);
diff --git a/tests/api/test_kdf.c b/tests/api/test_kdf.c
index d1b88a5502..4eea6a3e1d 100644
--- a/tests/api/test_kdf.c
+++ b/tests/api/test_kdf.c
@@ -59,7 +59,7 @@
 #define TEST_KDF_CRYPTOCB_DEVID 0x4b444630 /* "KDF0" */
 
 /* Toggled by the test below: when set, the callback fails outright instead
- * of computing the KDF, giving the (ret != CRYPTOCB_UNAVAILABLE) guard in
+ * of computing the KDF, giving the CRYPTOCB_UNAVAILABLE fall-through guard in
  * wc_KDA_KDF_twostep_cmac an independence pair (dispatch-taken-and-fails vs
  * dispatch-taken-and-succeeds), both within this one registered devId. */
 static int test_kdf_cryptocb_force_fail = 0;
@@ -631,7 +631,7 @@ int test_wc_KdfDecisionCoverage(void)
 
 #if defined(WOLF_CRYPTO_CB)
         /* devId != INVALID_DEVID: dispatch taken. Independence pair for
-         * the (ret != CRYPTOCB_UNAVAILABLE) guard: succeeds, then fails
+         * the CRYPTOCB_UNAVAILABLE fall-through guard: succeeds, then fails
          * outright, both via the SAME registered devId. */
         ExpectIntEQ(wc_CryptoCb_RegisterDevice(TEST_KDF_CRYPTOCB_DEVID,
             test_kdf_cryptocb, NULL), 0);
diff --git a/tests/api/test_mlkem.c b/tests/api/test_mlkem.c
index e98ea2911a..db6644e6e4 100644
--- a/tests/api/test_mlkem.c
+++ b/tests/api/test_mlkem.c
@@ -4148,9 +4148,15 @@ static int mlkem_feature_roundtrip(int type)
 
     ExpectIntEQ(wc_MlKemKey_MakeKey(key, &rng), 0);
 
-    priv = (byte*)XMALLOC(privLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    pub  = (byte*)XMALLOC(pubLen,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    ct   = (byte*)XMALLOC(ctLen,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* The size queries above set these; guard each allocation so static
+     * analysis sees a nonzero size (clang-tidy flags a possible 0-byte
+     * malloc otherwise). ExpectNotNull below still catches a 0-size query. */
+    if (privLen > 0)
+        priv = (byte*)XMALLOC(privLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (pubLen > 0)
+        pub  = (byte*)XMALLOC(pubLen,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (ctLen > 0)
+        ct   = (byte*)XMALLOC(ctLen,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
     ExpectNotNull(priv);
     ExpectNotNull(pub);
     ExpectNotNull(ct);