Align unit_tests.c output + MLKEM ct threading + drop dead MLDSA SignDigest

Widen printf format strings in tests/unit_tests.c so every Passed /
  Failed / Skipped line lands at the same column regardless of test
  name length. Pattern is inline: printf(Test TPM Wrapper: %-40s ...).
  No new header or helper; fwtpm_unit_tests.c is untouched and keeps its
  local fwtpm_pass column-alignment helper.

  Bug fixes carried alongside:
  - test_wolfTPM2_MLKEM_Encapsulate now writes ct to a caller buffer,
    test_wolfTPM2_PQC threads it into Decapsulate. Previously Decap was
    being called with an all-zero 2048-byte buffer which the server
    correctly rejected with TPM_RC_SIZE.
  - test_wolfTPM2_PQC now creates a real MLDSA-65 primary key via
    wolfTPM2_CreatePrimaryKey and a real MLKEM-768 primary before running
    the sequence / encap tests. Pure-MLDSA Sign uses one-shot at Complete
    (no SequenceUpdate) per Part 3 §17.5; Verify still uses Update per
    §20.3.
  - Removed test_wolfTPM2_MLDSA_SignDigest + test_wolfTPM2_MLDSA_Verify-
    DigestSignature: those always hit the skip path because Pure-MLDSA
    external-μ sign needs wolfCrypt's mu-direct API (static
    dilithium_sign_with_seed_mu, not WOLFSSL_API). Tracked as task #95.
    Hash-ML-DSA paths still cover SignDigest / VerifyDigestSignature
    wire format via the examples/pqc/pqc_mssim_e2e.c E2E test.

tests/unit_tests.c

@@ -146,7 +146,7 @@ static void test_wolfTPM2_Init(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tInit:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "Init:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -181,7 +181,7 @@ static void test_wolfTPM2_OpenExisting(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tOpen Existing:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "Open Existing:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -213,7 +213,7 @@ static void test_wolfTPM2_GetCapabilities(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tGet Capabilities:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "Get Capabilities:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -242,7 +242,7 @@ static void test_wolfTPM2_ReadPublicKey(void)
     AssertIntEQ(rc, 0);
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tRead Public Key:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "Read Public Key:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -264,7 +264,7 @@ static void test_wolfTPM2_ST33_FirmwareUpgrade(void)
     /* Initialize TPM */
     rc = wolfTPM2_Init(&dev, TPM2_IoCb, NULL);
     if (rc != 0) {
-        printf("Test ST33 Firmware Upgrade:\tInit:\tSkipped (TPM not available)\n");
+        printf("Test ST33 FW:     %-40s Skipped (TPM not available)\n", "Init:");
         return;
     }
 
@@ -343,7 +343,7 @@ static void test_wolfTPM2_ST33_FirmwareUpgrade(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test ST33 Firmware Upgrade:\tAPI Availability:\tPassed\n");
+    printf("Test ST33 FW:     %-40s Passed\n", "API Availability:");
 }
 #endif /* WOLFTPM_ST33 || WOLFTPM_AUTODETECT */
 #endif /* WOLFTPM_FIRMWARE_UPGRADE */
@@ -371,7 +371,7 @@ static void test_wolfTPM2_GetRandom(void)
     AssertIntEQ(rc, 0);
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tGet Random:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "Get Random:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -437,7 +437,7 @@ static void test_TPM2_PCRSel(void)
     }
     AssertIntEQ(rc, 0);
 
-    printf("Test TPM Wrapper:\tPCR Select Array:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "PCR Select Array:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -456,7 +456,7 @@ static void test_TPM2_Policy_NULL_Args(void)
     rc = TPM2_PolicyPassword(NULL);
     AssertIntEQ(rc, BAD_FUNC_ARG);
 
-    printf("Test TPM2:\t\tPolicy NULL Args:\tPassed\n");
+    printf("Test TPM2:        %-40s Passed\n", "Policy NULL Args:");
 }
 
 static void test_wolfTPM2_PolicyAuthValue_AuthOffset(void)
@@ -504,7 +504,7 @@ static void test_wolfTPM2_PolicyAuthValue_AuthOffset(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tPolicyAuthValue Offset:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "PolicyAuthValue Offset:");
 #endif
 }
 
@@ -581,7 +581,7 @@ static void test_wolfTPM2_SetAuthHandle_PolicyAuthOffset(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tSetAuthHandle PolicyAuth:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "SetAuthHandle PolicyAuth:");
 #endif
 }
 
@@ -664,9 +664,9 @@ static void test_wolfTPM2_PolicyHash(void)
     AssertIntNE(XMEMCMP(digest0, digest, digestSz), 0);
     AssertIntNE(XMEMCMP(digestFirst, digest, digestSz), 0);
 
-    printf("Test TPM Wrapper:\tPolicyHash:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "PolicyHash:");
 #else
-    printf("Test TPM Wrapper:\tPolicyHash:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "PolicyHash:");
 #endif
 }
 
@@ -733,9 +733,9 @@ static void test_wolfTPM2_SensitiveToPrivate(void)
     AssertIntEQ(priv.size, (int)sizeof(expected));
     AssertIntEQ(XMEMCMP(priv.buffer, expected, sizeof(expected)), 0);
 
-    printf("Test TPM Wrapper:\tSensitiveToPrivate:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "SensitiveToPrivate:");
 #else
-    printf("Test TPM Wrapper:\tSensitiveToPrivate:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "SensitiveToPrivate:");
 #endif
 }
 
@@ -803,9 +803,9 @@ static void test_TPM2_KDFa_SessionLabels(void)
         AssertIntEQ(XMEMCMP(key, expDUPLICATE, sizeof(expDUPLICATE)), 0);
     }
 
-    printf("Test TPM Wrapper:\tKDFa Session Labels:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "KDFa Session Labels:");
 #else
-    printf("Test TPM Wrapper:\tKDFa Session Labels:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "KDFa Session Labels:");
 #endif
 }
 
@@ -842,7 +842,7 @@ static void test_wolfTPM2_EncryptSecret(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tEncryptSecret:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "EncryptSecret:",
         rc == BAD_FUNC_ARG ? "Passed" : "Failed");
 }
 
@@ -877,7 +877,7 @@ static void test_wolfTPM2_Cleanup(void)
     AssertIntEQ(rc, TPM_RC_SUCCESS);
 #endif
 
-    printf("Test TPM Wrapper:\tCleanup:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "Cleanup:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -917,7 +917,7 @@ static void test_TPM2_KDFa(void)
     AssertIntEQ(XMEMCMP(key, keyExp, sizeof(keyExp)), 0);
 #endif
 
-    printf("Test TPM Wrapper:\tKDFa:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "KDFa:",
         rc >= 0 ? "Passed" : "Failed");
 }
 
@@ -954,7 +954,7 @@ static void test_TPM2_KDFe(void)
     AssertIntEQ(0, XMEMCMP(key, key2, sizeof(key)));
 #endif
 
-    printf("Test TPM Wrapper:\tKDFe:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "KDFe:",
         rc >= 0 ? "Passed" : "Failed");
 }
 
@@ -996,9 +996,9 @@ static void test_TPM2_HmacCompute(void)
         digest, digestSz);
     AssertIntEQ(TPM_RC_INTEGRITY, rc);
 
-    printf("Test TPM Wrapper:\tHmacCompute:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "HmacCompute:");
 #else
-    printf("Test TPM Wrapper:\tHmacCompute:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "HmacCompute:");
 #endif
 }
 
@@ -1022,9 +1022,9 @@ static void test_TPM2_HashCompute(void)
     AssertIntEQ(32, (int)digestSz);
     AssertIntEQ(XMEMCMP(digest, hashExp, sizeof(hashExp)), 0);
 
-    printf("Test TPM Wrapper:\tHashCompute:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "HashCompute:");
 #else
-    printf("Test TPM Wrapper:\tHashCompute:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "HashCompute:");
 #endif
 }
 
@@ -1047,7 +1047,7 @@ static void test_TPM2_ConstantCompare(void)
     /* Zero length must return 0 (no bytes to compare) */
     AssertIntEQ(0, TPM2_ConstantCompare(a, d, 0));
 
-    printf("Test TPM Wrapper:\tConstantCompare:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ConstantCompare:");
 }
 
 static void test_TPM2_AesCfbRoundtrip(void)
@@ -1093,9 +1093,9 @@ static void test_TPM2_AesCfbRoundtrip(void)
     rc = TPM2_AesCfbDecrypt(key, 15, iv, ct, sizeof(ct));
     AssertIntNE(0, rc);
 
-    printf("Test TPM Wrapper:\tAesCfbRoundtrip:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "AesCfbRoundtrip:");
 #else
-    printf("Test TPM Wrapper:\tAesCfbRoundtrip:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "AesCfbRoundtrip:");
 #endif
 }
 
@@ -1141,9 +1141,9 @@ static void test_TPM2_KDFa_MultiHash(void)
         }
     }
 
-    printf("Test TPM Wrapper:\tKDFa multi-hash:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "KDFa multi-hash:");
 #else
-    printf("Test TPM Wrapper:\tKDFa multi-hash:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "KDFa multi-hash:");
 #endif
 }
 
@@ -1187,9 +1187,9 @@ static void test_TPM2_KDFe_MultiHash(void)
         }
     }
 
-    printf("Test TPM Wrapper:\tKDFe multi-hash:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "KDFe multi-hash:");
 #else
-    printf("Test TPM Wrapper:\tKDFe multi-hash:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "KDFe multi-hash:");
 #endif
 }
 
@@ -1241,9 +1241,9 @@ static void test_TPM2_HmacCompute_MultiHash(void)
         AssertIntEQ(0, XMEMCMP(d_split, d_full, splitSz));
     }
 
-    printf("Test TPM Wrapper:\tHmacCompute multi-hash:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "HmacCompute multi-hash:");
 #else
-    printf("Test TPM Wrapper:\tHmacCompute multi-hash:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "HmacCompute multi-hash:");
 #endif
 }
 
@@ -1278,9 +1278,9 @@ static void test_TPM2_HashCompute_MultiHash(void)
         AssertIntEQ(0, XMEMCMP(d1, d2, sz1));
     }
 
-    printf("Test TPM Wrapper:\tHashCompute multi-hash:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "HashCompute multi-hash:");
 #else
-    printf("Test TPM Wrapper:\tHashCompute multi-hash:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "HashCompute multi-hash:");
 #endif
 }
 
@@ -1318,9 +1318,9 @@ static void test_TPM2_KDF_Errors(void)
         NULL, 0, NULL, 0, key, sizeof(key));
     AssertIntEQ(NOT_COMPILED_IN, rc);
 
-    printf("Test TPM Wrapper:\tKDF error paths:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "KDF error paths:");
 #else
-    printf("Test TPM Wrapper:\tKDF error paths:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "KDF error paths:");
 #endif
 }
 
@@ -1356,9 +1356,9 @@ static void test_TPM2_GetTpmHashType(void)
     /* Unknown wolfCrypt hash type returns TPM_ALG_ERROR */
     AssertIntEQ(TPM_ALG_ERROR, TPM2_GetTpmHashType(0xFFFF));
 
-    printf("Test TPM Wrapper:\tGetTpmHashType:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "GetTpmHashType:");
 #else
-    printf("Test TPM Wrapper:\tGetTpmHashType:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "GetTpmHashType:");
 #endif
 }
 
@@ -1404,7 +1404,7 @@ static void test_TPM2_ResponseHmacVerification(void)
     AssertIntNE(0, TPM2_ConstantCompare(hmac1.buffer, hmac2.buffer,
         hmac1.size));
 
-    printf("Test TPM Wrapper:\tResponseHmacVerification:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ResponseHmacVerification:");
 #endif
 }
 
@@ -1446,7 +1446,7 @@ static void test_TPM2_CalcHmac(void)
     /* Reversed nonces MUST produce different HMAC */
     AssertIntNE(0, XMEMCMP(hmac1.buffer, hmac2.buffer, hmac1.size));
 
-    printf("Test TPM Wrapper:\tCalcHmac:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "CalcHmac:");
 #endif
 }
 
@@ -1490,7 +1490,7 @@ static void test_TPM2_ParamEnc_XOR_Vector(void)
     /* Must match original */
     AssertIntEQ(0, XMEMCMP(data, original, sizeof(original)));
 
-    printf("Test TPM Wrapper:\tParamEnc_XOR:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ParamEnc_XOR:");
 #endif
 }
 
@@ -1537,7 +1537,7 @@ static void test_TPM2_ParamEnc_AESCFB_Vector(void)
     /* Must match original */
     AssertIntEQ(0, XMEMCMP(data, original, sizeof(original)));
 
-    printf("Test TPM Wrapper:\tParamEnc_AESCFB:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ParamEnc_AESCFB:");
 #endif
 }
 
@@ -1582,7 +1582,7 @@ static void test_TPM2_ParamDec_XOR_Roundtrip(void)
     /* Must match original */
     AssertIntEQ(0, XMEMCMP(data, original, sizeof(original)));
 
-    printf("Test TPM Wrapper:\tParamDec_XOR_Roundtrip:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ParamDec_XOR_Roundtrip:");
 #endif
 }
 
@@ -1629,7 +1629,7 @@ static void test_TPM2_ParamDec_AESCFB_Roundtrip(void)
     /* Must match original */
     AssertIntEQ(0, XMEMCMP(data, original, sizeof(original)));
 
-    printf("Test TPM Wrapper:\tParamDec_AESCFB_Roundtrip:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ParamDec_AESCFB_Roundtrip:");
 #endif
 }
 
@@ -1697,9 +1697,9 @@ static void test_TPM2_ParamEncDec_Dispatch_Roundtrip(void)
     AssertIntEQ(TPM_RC_SUCCESS, rc);
     AssertIntEQ(0, XMEMCMP(data, original, sizeof(original)));
 
-    printf("Test TPM Wrapper:\tParamEncDec_Dispatch:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ParamEncDec_Dispatch:");
 #else
-    printf("Test TPM Wrapper:\tParamEncDec_Dispatch:\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "ParamEncDec_Dispatch:");
 #endif
 }
 
@@ -1742,9 +1742,9 @@ static void test_TPM2_HashNvPublic(void)
     rc = TPM2_HashNvPublic(&nvPublic, nameBuffer, NULL);
     AssertIntEQ(rc, BAD_FUNC_ARG);
 
-    printf("Test TPM Wrapper:\tHashNvPublic:\t\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "HashNvPublic:");
 #else
-    printf("Test TPM Wrapper:\tHashNvPublic:\t\tSkipped\n");
+    printf("Test TPM Wrapper: %-40s Skipped\n", "HashNvPublic:");
 #endif
 }
 
@@ -1799,7 +1799,7 @@ static void test_wolfTPM2_ComputeName(void)
     AssertIntEQ(rc, TPM_RC_SUCCESS);
     AssertIntEQ(name.size, 0);
 
-    printf("Test TPM Wrapper:\tComputeName:\t\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ComputeName:");
 }
 #endif
 
@@ -1862,7 +1862,7 @@ static void test_TPM2_SchemeSerialize(void)
     AssertIntEQ(rsaSchemeOut.scheme, TPM_ALG_RSAES);
 #endif
 
-    printf("Test TPM Wrapper:\tSchemeSerialize:\t\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "SchemeSerialize:");
 }
 
 /* Exercise the parse sequence used by TPM2_ECC_Parameters response: sign
@@ -2683,7 +2683,7 @@ static void test_KeySealTemplate(void)
     /* Template must include userWithAuth so password-based unseal works */
     AssertIntNE(tmpl.objectAttributes & TPMA_OBJECT_userWithAuth, 0);
 
-    printf("Test TPM Wrapper:\tKeySealTemplate:\t\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "KeySealTemplate:");
 }
 
 /* Test boundary validation for seal size and keyed hash key size.
@@ -2741,7 +2741,7 @@ static void test_SealAndKeyedHash_Boundaries(void)
         TPM_ALG_SHA256, NULL, MAX_SYM_DATA, NULL, 0);
     AssertIntEQ(rc, BAD_FUNC_ARG);
 
-    printf("Test TPM Wrapper:\tSealKeyedHash Boundary:\t\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "SealKeyedHash Boundary:");
 }
 
 static void test_GetAlgId(void)
@@ -2778,7 +2778,7 @@ static void test_wolfTPM2_CSR(void)
 
     wolfTPM2_FreeCSR(csr);
 
-    printf("Test TPM Wrapper:\tCSR Subject:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "CSR Subject:",
         rc == 0 ? "Passed" : "Failed");
 #endif
 }
@@ -2805,6 +2805,7 @@ static void test_wolfTPM2_EccSignVerifyDig(WOLFTPM2_DEV* dev,
     ecc_key wolfKey;
     int curveSize = TPM2_GetCurveSize(curve);
     int tpmDevId = INVALID_DEVID;
+    char nameBuf[48];
 #ifdef WOLF_CRYPTO_CB
     TpmCryptoDevCtx tpmCtx;
 
@@ -2931,11 +2932,10 @@ static void test_wolfTPM2_EccSignVerifyDig(WOLFTPM2_DEV* dev,
     wc_ecc_free(&wolfKey);
     wolfTPM2_UnloadHandle(dev, &eccKey.handle);
 
-    printf("Test TPM Wrapper:\t"
-        "Sign/Verify (DigSz=%d, CurveSz=%d, Hash=%s, Flags=%s):"
-        "\t%s\n",
+    XSNPRINTF(nameBuf, sizeof(nameBuf), "Sign/Verify Dig=%d Curve=%d %s%s:",
         digestSz, TPM2_GetCurveSize(curve), TPM2_GetAlgName(hashAlg),
-        (flags & FLAGS_USE_CRYPTO_CB) ? "Crypto CB" : "",
+        (flags & FLAGS_USE_CRYPTO_CB) ? " CCB" : "");
+    printf("Test TPM Wrapper: %-40s %s\n", nameBuf,
         rc == 0 ? "Passed" : "Failed");
 
 #ifdef WOLF_CRYPTO_CB
@@ -3140,9 +3140,9 @@ static void* test_wolfTPM2_thread_local_storage_work_thread(void* args)
     /* ctx should be what was set in init, not set by other thread */
     if (secondRunner == 1) {
         if (TPM2_GetActiveCtx() != &tpm2Ctx)
-            printf("Test TPM Wrapper:\tThread Local Storage\tFailed\n");
+            printf("Test TPM Wrapper: %-40s Failed\n", "Thread Local Storage:");
         else
-            printf("Test TPM Wrapper:\tThread Local Storage\tPassed\n");
+            printf("Test TPM Wrapper: %-40s Passed\n", "Thread Local Storage:");
     }
 
     /* set the active ctx, should not impact the other thread */
@@ -3191,12 +3191,11 @@ static void test_wolfTPM2_SPDM_Functions(void)
     WOLFSPDM_NATIONS_STATUS nStatus;
 #endif
 
-    printf("Test TPM Wrapper:\tSPDM Functions:\t");
-
     /* Initialize device */
     rc = wolfTPM2_Init(&dev, TPM2_IoCb, NULL);
     if (rc != 0) {
-        printf("Failed (Init failed: 0x%x)\n", rc);
+        printf("Test TPM Wrapper: %-40s Failed (Init 0x%x)\n",
+            "SPDM Functions:", rc);
         return;
     }
 
@@ -3312,7 +3311,7 @@ static void test_wolfTPM2_SPDM_Functions(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Passed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "SPDM Functions:");
 }
 #endif /* WOLFTPM_SPDM */
 
@@ -3328,6 +3327,7 @@ static void test_wolfTPM2_KeyBlob(TPM_ALG_ID alg)
     byte blob[MAX_CONTEXT_SIZE];
     TPMT_PUBLIC publicTemplate;
     word32 privBufferSz, pubBufferSz;
+    char nameBuf[32];
 
     XMEMSET(&srk, 0, sizeof(srk));
     XMEMSET(&key, 0, sizeof(key));
@@ -3408,8 +3408,9 @@ static void test_wolfTPM2_KeyBlob(TPM_ALG_ID alg)
     wolfTPM2_UnloadHandle(&dev, &srk.handle);
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tKeyBlob %s:\t%s\n",
-        TPM2_GetAlgName(alg), rc == 0 ? "Passed" : "Failed");
+    XSNPRINTF(nameBuf, sizeof(nameBuf), "KeyBlob %s:", TPM2_GetAlgName(alg));
+    printf("Test TPM Wrapper: %-40s %s\n", nameBuf,
+        rc == 0 ? "Passed" : "Failed");
 }
 
 /* Test DecodeRsaDer/DecodeEccDer default attributes for private key imports */
@@ -3468,7 +3469,7 @@ static void test_wolfTPM2_DecodeDer_DefaultAttribs(void)
      * as DecodeEccDer — validated by the ECC test above. RSA DER key is
      * too large (1217 bytes) to embed inline for a unit test. */
 
-    printf("Test TPM Wrapper:\tDecodeDer DefaultAttribs:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "DecodeDer DefaultAttribs:");
 }
 #endif /* !WOLFTPM2_NO_WOLFCRYPT && !NO_ASN */
 
@@ -3514,7 +3515,7 @@ static void test_wolfTPM2_LoadPrivateKey_NullParent(void)
 
     wolfTPM2_Cleanup(&dev);
 
-    printf("Test TPM Wrapper:\tLoadPrivateKey NullParent:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "LoadPrivateKey NullParent:");
 }
 
 static void test_wolfTPM2_EncryptDecryptBlock(void)
@@ -3782,44 +3783,37 @@ static void test_TPM2_GetHashDigestSize_AllAlgs(void)
  * When real support is available, update tests to require success. */
 
 /* Test ML-DSA Sign Sequence (Start, Update, Complete) */
+/* Test ML-DSA Sign Sequence; writes sig to caller buffer on success. */
 static void test_wolfTPM2_MLDSA_SignSequence(WOLFTPM2_DEV* dev,
-    WOLFTPM2_KEY* mldsaKey)
+    WOLFTPM2_KEY* mldsaKey, const byte* message, int messageSz,
+    byte* sig, int* sigSz)
 {
     int rc;
     TPM_HANDLE sequenceHandle;
-    byte message[] = "Test message for ML-DSA signing";
-    int messageSz = (int)sizeof(message) - 1;
-    byte sig[5000]; /* ML-DSA signatures are large */
-    int sigSz = (int)sizeof(sig);
-    byte context[16] = {0}; /* Optional context */
+    byte context[16];
     int contextSz = 0;
 
-    /* Note: This test requires a TPM that supports ML-DSA */
-    /* The key should already be created and loaded */
+    XMEMSET(context, 0, sizeof(context));
 
-    /* Test SignSequenceStart */
     rc = wolfTPM2_SignSequenceStart(dev, mldsaKey, context, contextSz,
         &sequenceHandle);
     if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
         rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-DSA Sign Sequence:\tSkipped (not supported)\n");
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n",
+            "ML-DSA Sign Sequence:");
+        *sigSz = 0;
         return;
     }
-    /* If we get here, TPM supports it, continue testing */
     AssertIntEQ(rc, 0);
 
-    /* Test SignSequenceUpdate */
-    rc = wolfTPM2_SignSequenceUpdate(dev, sequenceHandle, message, messageSz);
+    /* Pure-MLDSA rejects SequenceUpdate (§17.5 TPM_RC_ONE_SHOT_SIGNATURE)
+     * — the message must be supplied in one shot at Complete. */
+    rc = wolfTPM2_SignSequenceComplete(dev, sequenceHandle, mldsaKey,
+        message, messageSz, sig, sigSz);
     AssertIntEQ(rc, 0);
+    AssertIntGT(*sigSz, 0);
 
-    /* Test SignSequenceComplete */
-    rc = wolfTPM2_SignSequenceComplete(dev, sequenceHandle, mldsaKey, NULL, 0,
-        sig, &sigSz);
-    AssertIntEQ(rc, 0);
-    AssertIntGT(sigSz, 0);
-
-    printf("Test TPM Wrapper:\tML-DSA Sign Sequence:\t%s\n",
-        rc == 0 ? "Passed" : "Failed");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ML-DSA Sign Sequence:");
 }
 
 /* Test ML-DSA Verify Sequence (Start, Update, Complete) */
@@ -3830,114 +3824,61 @@ static void test_wolfTPM2_MLDSA_VerifySequence(WOLFTPM2_DEV* dev,
     int rc;
     TPM_HANDLE sequenceHandle;
 
-    /* Test VerifySequenceStart */
+    TPMT_TK_VERIFIED validation;
+
+    XMEMSET(&validation, 0, sizeof(validation));
+
+    if (sigSz <= 0) {
+        printf("Test TPM Wrapper: %-40s Skipped (no signature)\n",
+            "ML-DSA Verify Sequence:");
+        return;
+    }
     rc = wolfTPM2_VerifySequenceStart(dev, mldsaKey, NULL, 0, &sequenceHandle);
     if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
         rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-DSA Verify Sequence:\tSkipped (not supported)\n");
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n",
+            "ML-DSA Verify Sequence:");
         return;
     }
     AssertIntEQ(rc, 0);
 
-    /* Test VerifySequenceUpdate */
+    /* Verify sequences accept SequenceUpdate per Part 3 §20.3 */
     rc = wolfTPM2_VerifySequenceUpdate(dev, sequenceHandle, message, messageSz);
     AssertIntEQ(rc, 0);
 
-    /* Test VerifySequenceComplete */
     rc = wolfTPM2_VerifySequenceComplete(dev, sequenceHandle, mldsaKey,
-        NULL, 0, sig, sigSz, NULL);
+        NULL, 0, sig, sigSz, &validation);
     AssertIntEQ(rc, 0);
 
-    printf("Test TPM Wrapper:\tML-DSA Verify Sequence:\t%s\n",
-        rc == 0 ? "Passed" : "Failed");
-}
-
-/* Test ML-DSA Sign Digest */
-static void test_wolfTPM2_MLDSA_SignDigest(WOLFTPM2_DEV* dev,
-    WOLFTPM2_KEY* mldsaKey)
-{
-    int rc;
-    byte digest[32]; /* SHA3-256 digest */
-    int digestSz = 32;
-    byte context[16];
-    int contextSz = 16;
-    byte sig[5000];
-    int sigSz = (int)sizeof(sig);
-
-    /* Create test digest */
-    XMEMSET(digest, 0xAA, digestSz);
-    XMEMSET(context, 0xBB, contextSz);
-
-    /* Test SignDigest */
-    rc = wolfTPM2_SignDigest(dev, mldsaKey, digest, digestSz,
-        context, contextSz, sig, &sigSz);
-    if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
-        rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-DSA Sign Digest:\tSkipped (not supported)\n");
-        return;
-    }
-    AssertIntEQ(rc, 0);
-    AssertIntGT(sigSz, 0);
-
-    printf("Test TPM Wrapper:\tML-DSA Sign Digest:\t%s\n",
-        rc == 0 ? "Passed" : "Failed");
-}
-
-/* Test ML-DSA Verify Digest Signature */
-static void test_wolfTPM2_MLDSA_VerifyDigestSignature(WOLFTPM2_DEV* dev,
-    WOLFTPM2_KEY* mldsaKey, const byte* digest, int digestSz,
-    const byte* sig, int sigSz)
-{
-    int rc;
-    byte context[16];
-    int contextSz = 16;
-    TPMT_TK_VERIFIED validation;
-
-    XMEMSET(context, 0xBB, contextSz);
-
-    /* Test VerifyDigestSignature */
-    rc = wolfTPM2_VerifyDigestSignature(dev, mldsaKey, digest, digestSz,
-        sig, sigSz, context, contextSz, &validation);
-    if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
-        rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-DSA Verify Digest:\tSkipped (not supported)\n");
-        return;
-    }
-    AssertIntEQ(rc, 0);
-
-    printf("Test TPM Wrapper:\tML-DSA Verify Digest:\t%s\n",
-        rc == 0 ? "Passed" : "Failed");
+    printf("Test TPM Wrapper: %-40s Passed\n", "ML-DSA Verify Sequence:");
 }
 
 #if !defined(WOLFTPM2_NO_WOLFCRYPT) && \
     (defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_KYBER512) || \
      defined(WOLFSSL_KYBER768) || defined(WOLFSSL_KYBER1024))
-/* Test ML-KEM Encapsulate */
+/* Test ML-KEM Encapsulate; writes ct to caller buffer on success */
 static void test_wolfTPM2_MLKEM_Encapsulate(WOLFTPM2_DEV* dev,
-    WOLFTPM2_KEY* mlkemKey)
+    WOLFTPM2_KEY* mlkemKey, byte* ciphertext, int* ciphertextSz)
 {
     int rc;
-    byte ciphertext[2048]; /* ML-KEM ciphertext is variable length */
-    int ciphertextSz = (int)sizeof(ciphertext);
-    byte sharedSecret[64]; /* Shared secret */
+    byte sharedSecret[64];
     int sharedSecretSz = (int)sizeof(sharedSecret);
 
-    XMEMSET(ciphertext, 0, sizeof(ciphertext));
     XMEMSET(sharedSecret, 0, sizeof(sharedSecret));
 
-    /* Test Encapsulate */
-    rc = wolfTPM2_Encapsulate(dev, mlkemKey, ciphertext, &ciphertextSz,
+    rc = wolfTPM2_Encapsulate(dev, mlkemKey, ciphertext, ciphertextSz,
         sharedSecret, &sharedSecretSz);
     if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
         rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-KEM Encapsulate:\tSkipped (not supported)\n");
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n", "ML-KEM Encapsulate:");
+        *ciphertextSz = 0;
         return;
     }
     AssertIntEQ(rc, 0);
-    AssertIntGT(ciphertextSz, 0);
+    AssertIntGT(*ciphertextSz, 0);
     AssertIntGT(sharedSecretSz, 0);
 
-    printf("Test TPM Wrapper:\tML-KEM Encapsulate:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "ML-KEM Encapsulate:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -3956,13 +3897,13 @@ static void test_wolfTPM2_MLKEM_Decapsulate(WOLFTPM2_DEV* dev,
         sharedSecret, &sharedSecretSz);
     if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
         rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-KEM Decapsulate:\tSkipped (not supported)\n");
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n", "ML-KEM Decapsulate:");
         return;
     }
     AssertIntEQ(rc, 0);
     AssertIntGT(sharedSecretSz, 0);
 
-    printf("Test TPM Wrapper:\tML-KEM Decapsulate:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "ML-KEM Decapsulate:",
         rc == 0 ? "Passed" : "Failed");
 }
 
@@ -3986,7 +3927,7 @@ static void test_wolfTPM2_MLKEM_RoundTrip(WOLFTPM2_DEV* dev,
         sharedSecret1, &sharedSecret1Sz);
     if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
         rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
-        printf("Test TPM Wrapper:\tML-KEM Round Trip:\tSkipped (not supported)\n");
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n", "ML-KEM Round Trip:");
         return;
     }
     AssertIntEQ(rc, 0);
@@ -4003,7 +3944,7 @@ static void test_wolfTPM2_MLKEM_RoundTrip(WOLFTPM2_DEV* dev,
     AssertIntEQ(sharedSecret1Sz, sharedSecret2Sz);
     AssertIntEQ(XMEMCMP(sharedSecret1, sharedSecret2, sharedSecret1Sz), 0);
 
-    printf("Test TPM Wrapper:\tML-KEM Round Trip:\t%s\n",
+    printf("Test TPM Wrapper: %-40s %s\n", "ML-KEM Round Trip:",
         rc == 0 ? "Passed" : "Failed");
 }
 #endif /* ML-KEM support */
@@ -4015,14 +3956,18 @@ static void test_wolfTPM2_PQC(void)
     WOLFTPM2_DEV dev;
     WOLFTPM2_KEY storageKey;
     WOLFTPM2_KEY mldsaKey;
+    TPMT_PUBLIC mldsaPub;
     byte sig[5000];
     int sigSz = (int)sizeof(sig);
-    byte digest[32];
-    int digestSz = 32;
+    byte testMessage[] = "Test message for ML-DSA signing";
+    int testMessageSz = (int)sizeof(testMessage) - 1;
 #if !defined(WOLFTPM2_NO_WOLFCRYPT) && \
     (defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_KYBER512) || \
      defined(WOLFSSL_KYBER768) || defined(WOLFSSL_KYBER1024))
     WOLFTPM2_KEY mlkemKey;
+    TPMT_PUBLIC mlkemPub;
+    byte testCiphertext[2048];
+    int testCiphertextSz;
 #endif
 
     /* Initialize TPM */
@@ -4034,58 +3979,70 @@ static void test_wolfTPM2_PQC(void)
         (byte*)gStorageKeyAuth, sizeof(gStorageKeyAuth)-1);
     AssertIntEQ(rc, 0);
 
-    /* Note: ML-DSA key creation would need proper TPM 2.0 v185 support */
-    /* For now, tests will gracefully skip if not supported */
-    printf("Testing ML-DSA functions (will skip if not supported by TPM)...\n");
-    
-    /* Initialize mldsaKey - in real usage, this would be created/loaded */
+    /* Create a real ML-DSA-65 primary key so Sign/Verify sequence tests
+     * operate on an actual handle. Pure-MLDSA SignDigest is deferred
+     * until wolfCrypt exposes a mu-direct sign API (DEC-0006). */
+    printf("Testing ML-DSA functions...\n");
     XMEMSET(&mldsaKey, 0, sizeof(mldsaKey));
-    
-    /* Test Sign Sequence */
-    test_wolfTPM2_MLDSA_SignSequence(&dev, &mldsaKey);
-    
-    /* Test Sign Digest */
-    test_wolfTPM2_MLDSA_SignDigest(&dev, &mldsaKey);
-    
-    /* Test Verify Sequence - will skip if not supported */
-    /* Note: In a real test, we'd need actual message and signature */
-    {
-        byte testMessage[] = "Test message";
-        byte testSig[5000] = {0};
-        test_wolfTPM2_MLDSA_VerifySequence(&dev, &mldsaKey,
-            testMessage, (int)sizeof(testMessage) - 1,
-            testSig, (int)sizeof(testSig));
-    }
-    
-    /* If we have a signature, test verification */
-    if (sigSz > 0 && sigSz < (int)sizeof(sig)) {
-        XMEMSET(digest, 0xAA, digestSz);
-        test_wolfTPM2_MLDSA_VerifyDigestSignature(&dev, &mldsaKey,
-            digest, digestSz, sig, sigSz);
+    XMEMSET(&mldsaPub, 0, sizeof(mldsaPub));
+    rc = wolfTPM2_GetKeyTemplate_MLDSA(&mldsaPub,
+        TPMA_OBJECT_sign | TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent |
+        TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth,
+        TPM_MLDSA_65, 1 /* allowExternalMu */);
+    AssertIntEQ(rc, TPM_RC_SUCCESS);
+    rc = wolfTPM2_CreatePrimaryKey(&dev, &mldsaKey, TPM_RH_OWNER,
+        &mldsaPub, NULL, 0);
+    if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
+            rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n",
+            "ML-DSA PQC suite:");
+        goto mldsa_done;
     }
+    AssertIntEQ(rc, 0);
+
+    sigSz = (int)sizeof(sig);
+    test_wolfTPM2_MLDSA_SignSequence(&dev, &mldsaKey,
+        testMessage, testMessageSz, sig, &sigSz);
+
+    test_wolfTPM2_MLDSA_VerifySequence(&dev, &mldsaKey,
+        testMessage, testMessageSz, sig, sigSz);
+
+    wolfTPM2_UnloadHandle(&dev, &mldsaKey.handle);
+mldsa_done:
 
 #if !defined(WOLFTPM2_NO_WOLFCRYPT) && \
     (defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_KYBER512) || \
      defined(WOLFSSL_KYBER768) || defined(WOLFSSL_KYBER1024))
-    /* Note: ML-KEM key creation would need proper TPM 2.0 v185 support */
-    printf("Testing ML-KEM functions (will skip if not supported by TPM)...\n");
-    
-    /* Initialize mlkemKey - in real usage, this would be created/loaded */
+    printf("Testing ML-KEM functions...\n");
     XMEMSET(&mlkemKey, 0, sizeof(mlkemKey));
-    
-    /* Test Encapsulate */
-    test_wolfTPM2_MLKEM_Encapsulate(&dev, &mlkemKey);
-    
-    /* Test Decapsulate - will skip if not supported */
-    /* Note: In a real test, we'd need actual ciphertext from Encapsulate */
-    {
-        byte testCiphertext[2048] = {0};
-        test_wolfTPM2_MLKEM_Decapsulate(&dev, &mlkemKey,
-            testCiphertext, (int)sizeof(testCiphertext));
+    XMEMSET(&mlkemPub, 0, sizeof(mlkemPub));
+    rc = wolfTPM2_GetKeyTemplate_MLKEM(&mlkemPub,
+        TPMA_OBJECT_decrypt | TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent |
+        TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth,
+        TPM_MLKEM_768);
+    AssertIntEQ(rc, TPM_RC_SUCCESS);
+    rc = wolfTPM2_CreatePrimaryKey(&dev, &mlkemKey, TPM_RH_OWNER,
+        &mlkemPub, NULL, 0);
+    if (rc == TPM_RC_VALUE || rc == TPM_RC_SCHEME ||
+            rc == TPM_RC_COMMAND_CODE || rc == (int)(RC_VER1 + 0x043)) {
+        printf("Test TPM Wrapper: %-40s Skipped (not supported)\n",
+            "ML-KEM PQC suite:");
+        goto mlkem_done;
     }
-    
-    /* Test Encapsulate/Decapsulate round-trip */
+    AssertIntEQ(rc, 0);
+
+    XMEMSET(testCiphertext, 0, sizeof(testCiphertext));
+    testCiphertextSz = (int)sizeof(testCiphertext);
+    test_wolfTPM2_MLKEM_Encapsulate(&dev, &mlkemKey,
+        testCiphertext, &testCiphertextSz);
+    if (testCiphertextSz > 0) {
+        test_wolfTPM2_MLKEM_Decapsulate(&dev, &mlkemKey,
+            testCiphertext, testCiphertextSz);
+    }
+
     test_wolfTPM2_MLKEM_RoundTrip(&dev, &mlkemKey);
+    wolfTPM2_UnloadHandle(&dev, &mlkemKey.handle);
+mlkem_done:
 #endif
 
     wolfTPM2_UnloadHandle(&dev, &storageKey.handle);
@@ -4142,7 +4099,7 @@ static void test_wolfTPM2_PQC_KeyTemplates(void)
     rc = wolfTPM2_GetKeyTemplate_MLKEM(NULL, 0, TPM_MLKEM_512);
     AssertIntEQ(rc, BAD_FUNC_ARG);
 
-    printf("Test TPM Wrapper:\tPQC Key Templates:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "PQC Key Templates:");
 }
 
 /* Test PQC sizes sanity check */
@@ -4165,7 +4122,7 @@ static void test_wolfTPM2_PQC_Sizes(void)
     AssertIntEQ(MAX_MLKEM_PUB_SIZE, 1568);  /* ML-KEM-1024 */
     AssertIntEQ(MAX_MLKEM_PRIV_SEED_SIZE, 64);
 
-    printf("Test TPM Wrapper:\tPQC Sizes:\tPassed\n");
+    printf("Test TPM Wrapper: %-40s Passed\n", "PQC Sizes:");
 }
 #endif /* WOLFTPM_V185 */