diff --git a/tests/api/test_cmac.c b/tests/api/test_cmac.c
index f2040b48b5..3768f9ec30 100644
--- a/tests/api/test_cmac.c
+++ b/tests/api/test_cmac.c
@@ -611,7 +611,11 @@ int test_wc_AesCmacVerifyExDecisionCoverage(void)
     return EXPECT_RESULT();
 } /* END test_wc_AesCmacVerifyExDecisionCoverage */
 
-#ifdef WOLF_CRYPTO_CB
+/* Match test_wc_AesCmacVerify_CryptoCb_LenMismatch's guard: the callback
+ * dereferences wc_CryptoInfo's cmac member (WOLFSSL_CMAC only) and uses the
+ * Cmac type / wc_AesCmacGenerate_ex, so WOLF_CRYPTO_CB alone is not enough. */
+#if defined(WOLF_CRYPTO_CB) && defined(WOLFSSL_CMAC) && !defined(NO_AES) && \
+    defined(WOLFSSL_AES_128)
 #define TEST_CMAC_CRYPTOCB_DEVID 0x434d4143 /* "CMAC" */
 
 /* Toggled by the test function below: when set, the callback fails
@@ -655,7 +659,7 @@ static int test_cmac_cryptocb_badlen_cb(int cbDevId, wc_CryptoInfo* info,
     }
     return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
 }
-#endif /* WOLF_CRYPTO_CB */
+#endif /* WOLF_CRYPTO_CB && WOLFSSL_CMAC && !NO_AES && WOLFSSL_AES_128 */
 
 /*
  * MC/DC: wc_AesCmacVerify_ex()'s (ret == 0 && aSz != checkSz) guard. In
diff --git a/tests/api/test_dsa.c b/tests/api/test_dsa.c
index 3759d89416..51f484b782 100644
--- a/tests/api/test_dsa.c
+++ b/tests/api/test_dsa.c
@@ -1017,6 +1017,8 @@ int test_wc_DsaExportKeyRaw_individual_args(void)
      * compilers, but the source is a plain && so MC/DC still needs this
      * combination demonstrated with x forced non-zero and y forced zero. */
     ExpectIntEQ(wc_InitDsaKey(&key), 0);
+    /* free the RNG from the previous block before re-initializing it */
+    wc_FreeRng(&rng);
     ExpectIntEQ(wc_InitRng(&rng), 0);
     ExpectIntEQ(wc_MakeDsaParameters(&rng, 1024, &key), 0);
     ExpectIntEQ(wc_MakeDsaKey(&rng, &key), 0);
@@ -1027,6 +1029,8 @@ int test_wc_DsaExportKeyRaw_individual_args(void)
 
     /* only x is zero (y non-zero) */
     ExpectIntEQ(wc_InitDsaKey(&key), 0);
+    /* free the RNG from the previous block before re-initializing it */
+    wc_FreeRng(&rng);
     ExpectIntEQ(wc_InitRng(&rng), 0);
     ExpectIntEQ(wc_MakeDsaParameters(&rng, 1024, &key), 0);
     ExpectIntEQ(wc_MakeDsaKey(&rng, &key), 0);
diff --git a/tests/api/test_wolfmath.c b/tests/api/test_wolfmath.c
index 3974e34ba4..4092077640 100644
--- a/tests/api/test_wolfmath.c
+++ b/tests/api/test_wolfmath.c
@@ -873,6 +873,9 @@ int test_wc_SpIntExptGcdDecisionCoverage(void)
     ExpectIntEQ(sp_set(&a, 20), 0);
     ExpectIntEQ(sp_exptmod_ex(&a, &b, 0, &m, &m), WC_NO_ERR_TRACE(MP_VAL));
 
+    /* sp_gcd is only compiled when !NO_RSA && WOLFSSL_KEY_GEN (its definition
+     * guard in sp_int.c, narrower than the prototype's || in sp_int.h). */
+#if !defined(NO_RSA) && defined(WOLFSSL_KEY_GEN)
     /* sp_gcd: NULL args; a or b too big (>= SP_INT_DIGITS, skipped: needs
      * an operand at the compile limit, documented residual); undersized
      * dest; both zero (undefined); a zero, b nonzero (gcd = b); normal;
@@ -931,6 +934,7 @@ int test_wc_SpIntExptGcdDecisionCoverage(void)
     sp_setneg(&b);
     ExpectIntEQ(sp_gcd(&a, &b, &r), WC_NO_ERR_TRACE(MP_VAL)); /* b negative */
 #endif
+#endif /* !NO_RSA && WOLFSSL_KEY_GEN (sp_gcd) */
 
     /* sp_prime_is_prime / sp_prime_is_prime_ex: trials out of range;
      * a == 1 shortcut; a even (composite, single-digit fast path). */