tests: fix more CI config-specific build failures

Three more config-specific failures surfaced once the ecc link error was
resolved:

- test_wolfmath.c: test_wc_SpIntExptGcdDecisionCoverage called sp_gcd, whose
  definition (sp_int.c) is guarded by !NO_RSA && WOLFSSL_KEY_GEN - narrower
  than its sp_int.h prototype (|| ). Guard the sp_gcd block with the same
  condition so builds like --enable-curl (RSA on, key-gen off) link.
- test_cmac.c: the crypto-cb badlen callback dereferences wc_CryptoInfo's
  cmac member (WOLFSSL_CMAC only) and uses the Cmac type, but was guarded by
  WOLF_CRYPTO_CB alone; configs with the callback framework but no CMAC
  (e.g. --enable-wolftpm) failed to compile. Match the callback's guard to
  its only caller (WOLFSSL_CMAC && !NO_AES && WOLFSSL_AES_128 &&
  WOLF_CRYPTO_CB).
- test_dsa.c: test_wc_DsaExportKeyRaw_individual_args re-initialized WC_RNG
  three times but freed it once, leaking two DRBGs (caught by LeakSanitizer
  in the --enable-all sanitizer build). Free the RNG before each re-init,
  mirroring the existing DsaKey free-before-reinit.

Verified: --enable-curl and --enable-wolftpm build/link; --enable-all with
-fsanitize=leak runs unit.test leak-free (test_wc_DsaExportKeyRaw_individual_args
passes).

tests/api/test_cmac.c

@@ -611,7 +611,11 @@ int test_wc_AesCmacVerifyExDecisionCoverage(void)
     return EXPECT_RESULT();
 } /* END test_wc_AesCmacVerifyExDecisionCoverage */
 
-#ifdef WOLF_CRYPTO_CB
+/* Match test_wc_AesCmacVerify_CryptoCb_LenMismatch's guard: the callback
+ * dereferences wc_CryptoInfo's cmac member (WOLFSSL_CMAC only) and uses the
+ * Cmac type / wc_AesCmacGenerate_ex, so WOLF_CRYPTO_CB alone is not enough. */
+#if defined(WOLF_CRYPTO_CB) && defined(WOLFSSL_CMAC) && !defined(NO_AES) && \
+    defined(WOLFSSL_AES_128)
 #define TEST_CMAC_CRYPTOCB_DEVID 0x434d4143 /* "CMAC" */
 
 /* Toggled by the test function below: when set, the callback fails
@@ -655,7 +659,7 @@ static int test_cmac_cryptocb_badlen_cb(int cbDevId, wc_CryptoInfo* info,
     }
     return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
 }
-#endif /* WOLF_CRYPTO_CB */
+#endif /* WOLF_CRYPTO_CB && WOLFSSL_CMAC && !NO_AES && WOLFSSL_AES_128 */
 
 /*
  * MC/DC: wc_AesCmacVerify_ex()'s (ret == 0 && aSz != checkSz) guard. In

tests/api/test_dsa.c

@@ -1017,6 +1017,8 @@ int test_wc_DsaExportKeyRaw_individual_args(void)
      * compilers, but the source is a plain && so MC/DC still needs this
      * combination demonstrated with x forced non-zero and y forced zero. */
     ExpectIntEQ(wc_InitDsaKey(&key), 0);
+    /* free the RNG from the previous block before re-initializing it */
+    wc_FreeRng(&rng);
     ExpectIntEQ(wc_InitRng(&rng), 0);
     ExpectIntEQ(wc_MakeDsaParameters(&rng, 1024, &key), 0);
     ExpectIntEQ(wc_MakeDsaKey(&rng, &key), 0);
@@ -1027,6 +1029,8 @@ int test_wc_DsaExportKeyRaw_individual_args(void)
 
     /* only x is zero (y non-zero) */
     ExpectIntEQ(wc_InitDsaKey(&key), 0);
+    /* free the RNG from the previous block before re-initializing it */
+    wc_FreeRng(&rng);
     ExpectIntEQ(wc_InitRng(&rng), 0);
     ExpectIntEQ(wc_MakeDsaParameters(&rng, 1024, &key), 0);
     ExpectIntEQ(wc_MakeDsaKey(&rng, &key), 0);

tests/api/test_wolfmath.c

@@ -873,6 +873,9 @@ int test_wc_SpIntExptGcdDecisionCoverage(void)
     ExpectIntEQ(sp_set(&a, 20), 0);
     ExpectIntEQ(sp_exptmod_ex(&a, &b, 0, &m, &m), WC_NO_ERR_TRACE(MP_VAL));
 
+    /* sp_gcd is only compiled when !NO_RSA && WOLFSSL_KEY_GEN (its definition
+     * guard in sp_int.c, narrower than the prototype's || in sp_int.h). */
+#if !defined(NO_RSA) && defined(WOLFSSL_KEY_GEN)
     /* sp_gcd: NULL args; a or b too big (>= SP_INT_DIGITS, skipped: needs
      * an operand at the compile limit, documented residual); undersized
      * dest; both zero (undefined); a zero, b nonzero (gcd = b); normal;
@@ -931,6 +934,7 @@ int test_wc_SpIntExptGcdDecisionCoverage(void)
     sp_setneg(&b);
     ExpectIntEQ(sp_gcd(&a, &b, &r), WC_NO_ERR_TRACE(MP_VAL)); /* b negative */
 #endif
+#endif /* !NO_RSA && WOLFSSL_KEY_GEN (sp_gcd) */
 
     /* sp_prime_is_prime / sp_prime_is_prime_ex: trials out of range;
      * a == 1 shortcut; a even (composite, single-digit fast path). */