tests: fix check-source-text and clang-tidy findings in Part-3 tests

check-source-text (rule I) flags error-code identifiers used as comparison
operands even inside comments. Reword three comments so the code name is no
longer written as "(ret == PUBLIC_KEY_E)" / "(ret != CRYPTOCB_UNAVAILABLE)"
(test_kdf.c, test_ed448.c); the bare token on its own is fine.

clang-tidy reported a possible 0-byte malloc in test_mlkem.c: the ML-KEM
key/ciphertext sizes come from wc_MlKemKey_*Size() queries, which the analyzer
cannot prove nonzero. Guard each XMALLOC with a >0 check so the allocation
size is provably positive; the ExpectNotNull() checks still catch a 0-size
query at runtime.

Author: danielinux

tests/api/test_ed448.c

@@ -1353,7 +1353,7 @@ int test_wc_ed448_check_key_decisions(void)
 
     /* Same construction but with an extra byte (p[1]) perturbed so the
      * second range-check loop exits early with ret == 0 before the final
-     * byte compare runs -- closes that compare's (ret == PUBLIC_KEY_E)
+     * byte compare runs -- closes that compare's PUBLIC_KEY_E
      * guard operand's FALSE side. */
     near_p[1] = 0x00;
     ExpectIntEQ(wc_ed448_init(&freshKey), 0);

tests/api/test_kdf.c

@@ -59,7 +59,7 @@
 #define TEST_KDF_CRYPTOCB_DEVID 0x4b444630 /* "KDF0" */
 
 /* Toggled by the test below: when set, the callback fails outright instead
- * of computing the KDF, giving the (ret != CRYPTOCB_UNAVAILABLE) guard in
+ * of computing the KDF, giving the CRYPTOCB_UNAVAILABLE fall-through guard in
  * wc_KDA_KDF_twostep_cmac an independence pair (dispatch-taken-and-fails vs
  * dispatch-taken-and-succeeds), both within this one registered devId. */
 static int test_kdf_cryptocb_force_fail = 0;
@@ -631,7 +631,7 @@ int test_wc_KdfDecisionCoverage(void)
 
 #if defined(WOLF_CRYPTO_CB)
         /* devId != INVALID_DEVID: dispatch taken. Independence pair for
-         * the (ret != CRYPTOCB_UNAVAILABLE) guard: succeeds, then fails
+         * the CRYPTOCB_UNAVAILABLE fall-through guard: succeeds, then fails
          * outright, both via the SAME registered devId. */
         ExpectIntEQ(wc_CryptoCb_RegisterDevice(TEST_KDF_CRYPTOCB_DEVID,
             test_kdf_cryptocb, NULL), 0);

tests/api/test_mlkem.c

@@ -4148,9 +4148,15 @@ static int mlkem_feature_roundtrip(int type)
 
     ExpectIntEQ(wc_MlKemKey_MakeKey(key, &rng), 0);
 
-    priv = (byte*)XMALLOC(privLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    pub  = (byte*)XMALLOC(pubLen,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    ct   = (byte*)XMALLOC(ctLen,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* The size queries above set these; guard each allocation so static
+     * analysis sees a nonzero size (clang-tidy flags a possible 0-byte
+     * malloc otherwise). ExpectNotNull below still catches a 0-size query. */
+    if (privLen > 0)
+        priv = (byte*)XMALLOC(privLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (pubLen > 0)
+        pub  = (byte*)XMALLOC(pubLen,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (ctLen > 0)
+        ct   = (byte*)XMALLOC(ctLen,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
     ExpectNotNull(priv);
     ExpectNotNull(pub);
     ExpectNotNull(ct);