INVALID_DEVID is always needed as default argument value.

This makes it also no longer necessary to use the hard-coded
magic value -2 as default argument for various cases where it was
already required.

.github/workflows/python-app.yml

@@ -40,10 +40,6 @@ jobs:
         uv run --no-sync pytest tests
 
   build-no-pqc:
-    # Regression coverage for issue #2659: INVALID_DEVID is only declared
-    # in the CFFI cdef when ML_KEM or ML_DSA is enabled, so a wolfSSL build
-    # without those features must still import wolfcrypt.random successfully.
-
     runs-on: ubuntu-latest
     env:
       USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install
@@ -93,7 +89,5 @@ jobs:
       run: |
         uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'"
         uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'"
-    - name: Import smoke (regression for INVALID_DEVID)
-      run: uv run --no-sync python -c "from wolfcrypt.random import Random; Random()"
     - name: Run tests
       run: uv run --no-sync pytest tests

scripts/build_ffi.py

@@ -567,6 +567,8 @@ def build_ffi(local_wolfssl, features):
         extern int HASHDRBG_ENABLED;
         extern int CRYPTO_CB_ENABLED;
 
+        static const int INVALID_DEVID;
+
         typedef unsigned char byte;
         typedef unsigned int word32;
 
@@ -1314,11 +1316,6 @@ def build_ffi(local_wolfssl, features):
         int wolfCrypt_GetPrivateKeyReadEnable_fips(enum wc_KeyType);
         """
 
-    if features["ML_KEM"] or features["ML_DSA"] or features["CRYPTO_CB"]:
-        cdef += """
-        static const int INVALID_DEVID;
-        """
-
     if features["ML_KEM"]:
         cdef += """
         static const int WC_ML_KEM_512;

wolfcrypt/ciphers.py

@@ -460,7 +460,7 @@ if _lib.AESGCM_STREAM_ENABLED:
                 raise ValueError(f"key must be {self._key_sizes} in length, not {len(key)}")
             self._init_done = False
             self._native_object = _ffi.new(self._native_type)
-            ret = _lib.wc_AesInit(self._native_object, _ffi.NULL, -2)
+            ret = _lib.wc_AesInit(self._native_object, _ffi.NULL, _lib.INVALID_DEVID)
             if ret < 0:
                 raise WolfCryptApiError("AES init error", ret)
             self._init_done = True

wolfcrypt/hashes.py

@@ -504,7 +504,7 @@ if _lib.HMAC_ENABLED:
         def _type(self) -> int: ...
 
         def _hmac_init(self, hmac: int, key: bytes) -> int:
-            ret = _lib.wc_HmacInit(self._native_object, _ffi.NULL, -2)
+            ret = _lib.wc_HmacInit(self._native_object, _ffi.NULL, _lib.INVALID_DEVID)
             if ret < 0:
                 raise WolfCryptApiError("wc_HmacInit error", ret)
             # If the key isn't set, don't call wc_HmacSetKey. This can happen,

wolfcrypt/random.py

@@ -33,7 +33,7 @@ class Random:
     A Cryptographically Secure Pseudo Random Number Generator - CSPRNG
     """
 
-    def __init__(self, nonce: __builtins__.bytes = b"", device_id: int = -2) -> None:
+    def __init__(self, nonce: __builtins__.bytes = b"", device_id: int = _lib.INVALID_DEVID) -> None:
         self._native_object: _lib.RNG | None = None
         self._native_object = _ffi.new("WC_RNG *")