20260618-FORCE_FAILURE_RDSEED-fixes

[douzzer]

wolfcrypt/src/random.c:

• in USE_WINDOWS_API wc_GenerateSeed(), recognize HAVE_AMD_RDSEED, and properly enforce FORCE_FAILURE_RDSEED when CPU support is missing;

• in WOLFSSL_LINUXKM wc_GenerateSeed(), initialize ret to RNG_FAILURE_E, and properly enforce FORCE_FAILURE_RDSEED when CPU support is missing;

• in WOLFSSL_BSDKM wc_GenerateSeed(), properly enforce FORCE_FAILURE_RDSEED when CPU support is missing;

detected and tested with

wolfssl-multi-test.sh ...
check-source-text
linuxkm-fips-v5-strict-dist-insmod-cust-kernel-2-amdrdseed
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-rdseed-fips-dev-linuxkm-next-insmod
clang-tidy-all-sp-all

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10732

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src
Findings: 1

Critical (1)

Default wc_GenerateSeed returns RNG_FAILURE_E on successful seed read

File: wolfcrypt/src/random.c:5515
Function: wc_GenerateSeed
Category: Incorrect error handling

ret is now initialized to RNG_FAILURE_E, but the getrandom and /dev/urandom read loops set ret only on error. On a successful read ret stays RNG_FAILURE_E, so return ret yields -199 and if (ret == 0) at 5417 never fires, breaking the default seed path.

Recommendation: Set ret = 0 on the getrandom and /dev/urandom success paths, or keep this function's ret initializer at 0.

Referenced code: wolfcrypt/src/random.c:5515-5520 (6 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10732

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src

No new issues found in the changed files. ✅

[douzzer]

retest this please

FAIL: scripts/google.test

[lealem47]

Thanks douzzer!

[philljj]

Tests good on bsdkm with this PR:

• bsdkm: fix bsdkm build with rdseed. #10736