🟠 [Medium] Runtime DRBG disable APIs lack guardrail against disabling all DRBG types
Category: Unsafe default configurations

The new runtime DRBG disable/enable API (wc_Sha256Drbg_Disable(), wc_Sha512Drbg_Disable()) allows a caller to disable both SHA-256 and SHA-512 DRBGs simultaneously. Both functions unconditionally succeed (return 0) with no check that at least one DRBG type remains available. When both are disabled, any subsequent wc_InitRng() call will fail because the DRBG selection logic in _InitRng falls through all branches. While _InitRng does return an error (likely DRBG_NO_ENABLED_E) in this case, a defensive API should either refuse to disable the last available DRBG type or return a warning, rather than silently allowing a configuration that makes RNG initialization impossible. This is especially concerning in FIPS builds where RNG availability is a security requirement.

int wc_Sha256Drbg_Disable(void) { g_sha256DrbgDisabled = 1; return 0; }
int wc_Sha512Drbg_Disable(void) { g_sha512DrbgDisabled = 1; return 0; }

Recommendation: Add a check in each disable function to verify the other DRBG type is still enabled before disabling. Return a new error code (e.g., BAD_STATE_E) if disabling would leave no DRBG available. Alternatively, add FIPS-specific guards: #ifdef HAVE_FIPS that prevent disabling the last DRBG.

🔵 [Low] DRBG disable/enable global flags lack thread-safety documentation
Category: Unsafe default configurations

The new g_sha256DrbgDisabled and g_sha512DrbgDisabled global variables are plain static int with no synchronization. While this is consistent with wolfCrypt's existing pattern for configuration flags (e.g., seed callbacks, FIPS callback registration), the _InitRng function reads both flags in sequence without a lock. If one thread calls wc_Sha512Drbg_Disable() while another thread is inside _InitRng, the DRBG type selection depends on timing. For simple int stores on all wolfSSL-targeted platforms this is practically safe, but the API should document that these functions must be called during application startup before concurrent RNG use, consistent with how other wolfCrypt global configuration APIs are documented.

static int g_sha256DrbgDisabled = 0;
static int g_sha512DrbgDisabled = 0;

Recommendation: Add API documentation stating that wc_Sha*Drbg_Disable/Enable must be called during application initialization before any concurrent wc_InitRng() calls. Consider adding a comment in the code noting the threading contract, consistent with similar wolfCrypt configuration APIs.