Falcon had crypto-level coverage (KAT + native round-trip in
wolfcrypt/test/test.c) but, unlike ML-DSA and SLH-DSA, no dedicated
tests/api/ unit test exercising the public wc_falcon_* / wc_Falcon_* API
surface. This adds one, wired into the unit test runner as the "falcon"
group.

Coverage (both Falcon-512 / L1 and Falcon-1024 / L5, which are always
compiled together):
- sizes:        size/priv_size/pub_size/sig_size vs the spec constants,
                get_level round-trip, and NULL / unset-level rejection.
- make_key:     NULL and unset-level rejection; real keygen -> check_key.
- sign_vfy:     sign -> verify; wrong-message and one-byte tamper rejected;
                too-small buffer -> BUFFER_E with the required length set;
                verify with no public key -> BAD_FUNC_ARG.
- import_export: public / private-only (raw) / private (concat) / export_key
                round-trips, each re-signed or verified, plus too-small
                (BUFFER_E) and wrong-size (BAD_FUNC_ARG) paths.
- check_key:    valid pass; corrupted public copy, public-only and
                private-only keys all fail (PUBLIC_KEY_E); NULL rejected.
- der:          KeyToDer / PrivateKeyToDer / PublicKeyToDer round-trips via
                PrivateKeyDecode / PublicKeyDecode, size-query (NULL output),
                and the SetAsymKeyDer too-small contract (BAD_FUNC_ARG).
- error_paths:  exhaustive NULL / bad-level / wrong-size / no-key-set
                argument sanitising for every public entry point.

Tests requiring key generation or signing are gated on
WC_FALCON_HAVE_NATIVE_SIGN so the file also builds in
WOLFSSL_FALCON_VERIFY_ONLY and WOLF_CRYPTO_CB_ONLY_FALCON configurations;
size and argument-sanitising tests run in every HAVE_FALCON build.

Verified: 7/7 pass under both --enable-falcon-avx2 and the default
constant-time build; compiles clean with WOLFSSL_FALCON_VERIFY_ONLY.

The new tests/api/test_falcon.c was wired into the automake unit test
(tests/api/include.am) but not the CMake one, so CMake-based CI builds
failed to link the unit test with undefined references to
test_wc_falcon_*. Add it to the CMake unit_test source list alongside the
other tests/api/test_*.c entries.

- wc_falcon.c: replace the lazily-initialised, mutable NTT twiddle-table
  cache with precomputed read-only const tables (falcon_zetas/izetas_l1/l5).
  This removes the data race on the shared cache (a reader could see the
  init flag set before all table entries were visible) and also drops the
  now-unused falcon_brv / falcon_build_tables helpers. Verify stays fast
  (const reads, no per-call rebuild); KAT confirms the values.
- falcon.c: correct the wc_falcon_sign_msg doc comment (signing needs the
  *private* key; required buffer size is the active level's signature size,
  not always FALCON_LEVEL1_SIG_SIZE) and validate rng != NULL in the
  software path so the error is reported at the API boundary.
- wc_falcon_sign.c / wc_falcon_sign.h: route key->heap into
  falcon_complete_private and falcon_expand_privkey (their large fpr scratch
  allocations previously used a NULL heap hint, bypassing custom heap
  routing); and fail fast in falcon_do_sign_tree on the sampler's sticky
  PRNG error (passed in as samplerErr) instead of running to the restart
  bound.
- wc_falcon_codec.h: use the project-standard WOLF_CRYPT_WC_FALCON_CODEC_H
  include guard instead of the collision-prone generic FALCON_CODEC_H.
- doc/dox_comments (ssl.h + -ja): drop the stale "or HAVE_LIBOQS" from the
  ML-KEM hybrid group requirements; liboqs is no longer supported.

- falcon.c (wc_falcon_import_private_only): call falcon_store_pub_behind_priv
  unconditionally after setting prvKeySet. The raw-size branch previously only
  synced the behind-private public copy in the concat layout, so importing a
  public key first and then a raw private key left key->k + KEY_SIZE zero and
  made wc_falcon_check_key return a false PUBLIC_KEY_E. Added a regression case
  to test_wc_falcon_check_key covering the public-then-raw-private ordering.
- wc_falcon.c (native sign cleanup): free the sampler's SHAKE256 context with
  wc_Shake256_Free(&spc.p.shake) when it was initialized, before ForceZero.
  Without it, WOLFSSL_ASYNC_CRYPT + WC_ASYNC_ENABLE_SHA3 builds leaked the
  async device context allocated by wc_InitShake256 on every sign, unlike the
  keygen and hash-to-point paths which already free their SHAKE contexts.

configure.ac sets enable_option_checking=fatal, so removing the
--with-liboqs option turned it into a hard "unrecognized options" error.
Test matrices / CI (e.g. the Jenkins PRB liboqs config branch) and user
scripts that still pass --with-liboqs then fail at the configuration phase
before any build runs.

Re-add --with-liboqs as a recognised, deprecated no-op that warns it has no
effect and points at --enable-falcon. It links no liboqs and does not change
the build (SBOM unaffected); it only prevents the fatal unknown-option abort.
Mirrors the existing --enable-cryptodev deprecation shim.

The check-source-text unknown-macro check (subtest K) flags preprocessor
symbols used in the sources that are neither #defined in a header nor listed
in .wolfssl_known_macro_extras. The native Falcon backends add several
configure/-D build gates that are not #defined anywhere, so a build that
scans the Falcon sources without those options set (e.g. --enable-all
without the sub-backends) reported them as unknown.

Register the nine new gates (LC_ALL=C sorted):
  WOLF_CRYPTO_CB_ONLY_FALCON
  WOLFSSL_FALCON_FFT_AVX2, WOLFSSL_FALCON_FFT_NEON
  WOLFSSL_FALCON_FPR_ASM, WOLFSSL_FALCON_FPR_DOUBLE
  WOLFSSL_FALCON_NTT_DSP, WOLFSSL_FALCON_NO_NTT_DSP
  WOLFSSL_FALCON_SIGN_STATS, WOLFSSL_FALCON_VERIFY_ONLY

HAVE_FALCON and WC_FALCON_HAVE_NATIVE_SIGN are already known (configure /
falcon.h), so they are not added.

The sign retry loop capped the compressed signature at the caller-supplied
*outLen instead of the level's fixed size, so a buffer larger than the max
let an over-length (e.g. 667-byte Falcon-512) signature escape without a
restart, and verification then rejected it. Cap at sigMax instead.

tests/falcon/ hammers make_key -> sign -> verify across many keys and
messages to catch intermittent non-verifying signatures, dumping a
replayable artifact on any mismatch. Includes Makefile and run.sh.

The keygen/sign/verify fuzzer now lives in the testing repo
(fuzzers/falcon); it is not part of the library or its CI. Removing it
here also drops tests/falcon/run.sh from the PR's changed-shell set.

On 32-bit ARM targets lacking a double-precision FPU (Cortex-M0/M3/M4/
M23/M33), C double maps onto slow libgcc soft-double, making the opt-in
WOLFSSL_FALCON_FPR_DOUBLE backend a pessimization versus the default
integer fpr backend. Emit a #warning to steer users away. Detect via
__ARM_FP bit 3; AArch64 does not define __arm__ so it is unaffected.

…s, footprint)

Four fixes from PR review:

- zephyr/CMakeLists.txt: the native port split falcon.c into wc_falcon_*.c
  translation units; add the portable sources so a Zephyr build with Falcon
  links. x86-64 asm/AVX2 and the NEON backend are left out (not selected by any
  Zephyr config).

- configure.ac: fold the standalone --enable-falcon-{asm,double,avx2,neon}
  switches into comma-separated sub-options of --enable-falcon
  (e.g. --enable-falcon=avx2), matching the common wolfSSL idiom. avx2/neon
  imply the double backend after arch-gating so ignoring an unsupported vector
  backend does not clobber an explicit 'double'. Sweep the qemu-falcon-neon doc
  to the new spelling.

- configure.ac: align the Falcon line in the two feature summaries.

- falcon.c/falcon.h: drop the duplicate public-key copy kept behind the private
  key. Its only remaining reader was wc_falcon_check_key, whose compare was
  against a copy of the same bytes and so could never detect a real mismatch;
  wc_falcon_export_private already rebuilds the concat layout on demand. Shrink
  key->k from FALCON_MAX_PRV_KEY_SIZE to FALCON_MAX_KEY_SIZE (saves 1793 bytes
  per key at level 5). check_key now verifies both halves are present and
  documents a full cryptographic cross-check as a follow-up. Update the unit
  test that relied on the old in-memory-copy compare.

The DSP-NTT gate in wc_falcon.c keys off the compiler-predefined
__ARM_FEATURE_DSP, and the FPR_DOUBLE soft-double guard in wc_falcon_fpr.h
keys off __ARM_FP; neither was listed in .wolfssl_known_macro_extras, so
the source-text unknown-macro check flags them. Add both in sorted order.

wolfSSL C style forbids recursion. The reference implementation expresses
the ffLDL tree construction, tree normalization and Fast Fourier sampling
as self-recursions on logn; flatten all three into iterations over small
fixed-size frame stacks (depth bounded by logn <= 10):

- ffLDL_fft_inner and ffLDL_binary_normalize do all their work before
  their two half-degree sub-invocations, so a LIFO work list of pending
  jobs suffices (at most logn + 1 <= 11 frames).

- falcon_ffSampling_fft has work interleaved between its sub-invocations,
  so it becomes a three-stage state machine over at most 8 frames. The
  reference's inlined base cases are split out into WC_INLINE helpers
  (ffSampling_fft_deg4 / ffSampling_fft_deg2), and a bounds check on logn
  keeps the frame stack safe even for invalid callers.

Sub-invocations run in exactly the reference order; for ffSampling this is
a hard requirement since the discrete Gaussian sampler consumes a PRNG
stream, and any reordering would change the produced signatures.

Verified with a differential harness (old recursive code from git vs the
new build): expanded keys and ffSampling outputs are bit-identical for
logn 1..10, with identical sampler invocation counts and an identical
order-sensitive hash of every (mu, isigma) sampler argument pair.
Performance is unchanged (within noise at logn 9 and 10).

Remaining fixes from the second review round:

- keygen: falcon_compute_public's scratch buffer holds NTT(f) (private-key
  material) in its tail; wc_ForceZero it before both frees (the
  f-not-invertible reject path and the success path). Also zeroize the
  internally allocated hwork for consistency with the tmpbuf hardening.

- sampler: falcon_sampler_z's rejection loop never consulted the sticky
  PRNG error flag, so a mid-signature SHAKE256 squeeze failure could make
  berexp deterministically reject and the loop spin forever. Check p.err
  each iteration and bail out; the returned value is discarded since
  falcon_sign_core rejects the whole signature once p.err is set.
  falcon_prng_init now frees the SHAKE256 context when a later init step
  fails (plugs a device-context leak in WOLFSSL_ASYNC_CRYPT builds), and
  falcon_prng_refill early-returns once the error is latched instead of
  re-issuing failing squeezes.

- codec: guard the bits-dependent shifts in falcon_trim_i8_encode/decode
  against out-of-range widths (defense in depth; callers only pass 5..8).

- check_key: implement the cryptographic private/public cross-check that
  91ebd89 documented as a follow-up. New falcon_native_check_key decodes
  (f, g) from the private key and h from the public key and verifies the
  defining relation h*f == g (mod q, mod X^n + 1) slot-wise in the NTT
  domain (falcon_ntt keeps values canonical in [0, q)); a slot with
  NTT(f) == 0 is rejected too, as keygen only emits invertible f.
  wc_falcon_check_key dispatches to it whenever the native signing core is
  compiled in, and falls back to the presence check in verify-only /
  callback-only builds. Doxygen updated to the actual contract, and a unit
  test added: a mismatched pair (public half from a different key) must
  fail with PUBLIC_KEY_E. This also strengthens the keypair validation
  done via wc_falcon_check_key in asn.c.

Regenerated from wolfssl-scripts falcon/x86_64/falcon.rb (commit
b680440), which documents in the file header that the backend is
SysV AMD64 ABI only and requires the default MXCSR state.  No code
change, comment only.

test_wc_falcon_sign_verify in tests/api/test_signature.c was merged to
master gated on HAVE_FALCON && HAVE_LIBOQS.  With liboqs removed the
macro is defined nowhere, so the test was dead code and check-source-text
failed with 'unrecognized macros used: HAVE_LIBOQS'.

Gate it on WC_FALCON_HAVE_NATIVE_SIGN like the rest of the native
signing tests, and replace the obsolete liboqs-RNG comment.  The tree
now has zero HAVE_LIBOQS references, so no .wolfssl_known_macro_extras
entry is needed.

- wc_falcon.c: replace the stale "Phase 1: verification only" file banner
  (the file now holds keygen/sign/verify cores).
- falcon.c: fix the garbled wc_falcon_verify_msg doc comment (removed a
  non-existent contextLen parameter; state the level-dependent BUFFER_E
  bound and the *res convention).
- wc_falcon.c: name the sign compression-fit retry bound
  FALCON_SIGN_MAX_ENCODE_RETRIES (was a bare 32) and document why the
  bound is safe, mirroring FALCON_SIGN_MAX_RESTARTS in wc_falcon_sign.c.
- test_falcon.c: add a direct wc_falcon_import_private_only concat(priv,pub)
  test that recovers the public key and signs+verifies from that single
  import, covering the recover-pub-from-concat path end to end.

Merge the nine wc_falcon_*.c cores into wolfcrypt/src/falcon.c, matching the
one-file-per-algorithm convention (ed25519.c, wc_mldsa.c). Sign and keygen are
gated internally on WOLFSSL_FALCON_VERIFY_ONLY and the internal helpers become
static. The fpr/fft/poly primitives stay external (shared with the separate
AVX2/NEON FFT backends) so their three headers are retained; the other five
internal headers are removed.

The max bit width for encoding F and G is a constant 8 for every Falcon
degree, so the per-logn lookup table carried no information. Replace it with
a FALCON_MAX_FG_BITS define. falcon_max_fg_bits stays a table (it genuinely
varies with logn).

Reflow the REV10 bit-reversal table into an aligned 12-per-row grid (values
right-justified) and collapse the one-value-per-line falcon_max_fg_bits into a
single row with a logn index legend. No functional change.

falcon_hash_to_point malloc'd a buffer solely to concatenate nonce and message
for a single wc_Shake256_Absorb. Since Absorb is an Update plus the SHAKE
finalize on the same sponge, feed the nonce with wc_Shake256_Update first and
the message with Absorb: same absorbed bytes, same state, but no allocation or
copy on every sign and verify.

Sign (8), keygen (5) and check_key (6) each carved their temporaries from that
many separate XMALLOCs; combine each into one alignment-ordered arena with a
single free and a single ForceZero over the secrets. Verify's ~8KB working set
(h/c/t/s2) now lives on the stack by default and only allocates under
WOLFSSL_SMALL_STACK. Cuts allocation churn to one call per operation.

Port the Falcon reference dynamic signer (sign_dyn / ffSampling_fft_dyntree),
which rebuilds the ffLDL tree inside the sampler instead of precomputing the
whole expanded key -- roughly halving the sign working set (Falcon-1024 ~168KB
to ~78KB) at the cost of redoing the tree work per attempt. The reference
recursion is flattened to an explicit stack per the no-recursion rule, and the
signer is byte-for-byte identical to the default path (verified with a
deterministic-RNG differential over both levels). Selected with
--enable-falcon=small-mem (WOLFSSL_FALCON_SIGN_SMALL_MEM); the eager tree signer
is compiled out in that mode.

falcon_prng_get_u64 and get_rng_u64 assembled a little-endian word64 from eight
explicit byte shifts. Replace both with a falcon_load_le64 helper: a single word
load on a little-endian CPU and a load plus byte-swap on a big-endian one, using
readUnalignedWord64/ByteReverseWord64. The spec-defined MSB-first bitstream codec
reads and the big-endian hash-to-point read are unchanged (their byte order is
fixed by the Falcon spec, not the CPU).

A review flagged zint_bezout as looking inefficient. It is in fact the reference
constant-time binary GCD: x and y derive from the secret key during keygen, so
its fixed-count loops and mask/sign-bit conditionals (rather than data-dependent
branches or early exits) are what keep the private key off the timing side
channel. It already reduces the operands ~31 bits per iteration word-wise. Add a
comment explaining this so the structure is not mistaken for a missed
optimization; no code change.

…rrett)

- configure.ac: list small-mem in the --enable-falcon help string and the
  sub-option doc block (the parser already accepted it).
- WOLFSSL_FALCON_SIGN_STATS: define falcon_sign_restart_count at file scope so
  the debug knob links, and drop the mid-function extern (C89 decl-at-top).
- falcon_native_check_key: reduce h*ft with falcon_barrett instead of a hardware
  '%', matching the verify path -- division-free and constant-time on ft (the NTT
  image of secret f).

The Falcon workflow only built --enable-falcon (default integer fpr). Add a
falcon_backends matrix that builds and runs testwolfcrypt for asm, double, avx2,
small-mem and avx2+small-mem on ubuntu-latest, and neon on the free ubuntu-24.04-arm
runner -- the SIMD/asm backends are the highest-risk code and now execute in CI.
verify-only is a build/link-only leg (its self-test needs signing). An AVX2 leg
guards on /proc/cpuinfo since backend dispatch is compile-time.