diff --git a/wolfcrypt/src/port/arm/cryptoCell.c b/wolfcrypt/src/port/arm/cryptoCell.c
index a170470a5b..e5b0bb0c7c 100644
--- a/wolfcrypt/src/port/arm/cryptoCell.c
+++ b/wolfcrypt/src/port/arm/cryptoCell.c
@@ -142,39 +142,72 @@ CRYS_ECPKI_DomainID_t cc310_mapCurve(int curve_id)
 #ifndef NO_RSA
 CRYS_RSA_HASH_OpMode_t cc310_hashModeRSA(enum wc_HashType hash_type, int isHashed)
 {
+    /* Every case assigns and breaks - a compiled-out algorithm gives the
+     * not-known mode rather than falling through. */
+    CRYS_RSA_HASH_OpMode_t hash_mode;
+
     switch(hash_type)
     {
         case WC_HASH_TYPE_MD5:
         #ifndef NO_MD5
-            return isHashed? CRYS_RSA_After_MD5_mode : CRYS_RSA_HASH_MD5_mode;
+            hash_mode = isHashed? CRYS_RSA_After_MD5_mode :
+                                  CRYS_RSA_HASH_MD5_mode;
+        #else
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
         #endif
+            break;
         case WC_HASH_TYPE_SHA:
         #ifndef NO_SHA
-            return isHashed? CRYS_RSA_After_SHA1_mode : CRYS_RSA_HASH_SHA1_mode;
+            hash_mode = isHashed? CRYS_RSA_After_SHA1_mode :
+                                  CRYS_RSA_HASH_SHA1_mode;
+        #else
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
         #endif
+            break;
         case WC_HASH_TYPE_SHA224:
         #ifdef WOLFSSL_SHA224
-            return isHashed? CRYS_RSA_After_SHA224_mode : CRYS_RSA_HASH_SHA224_mode;
+            hash_mode = isHashed? CRYS_RSA_After_SHA224_mode :
+                                  CRYS_RSA_HASH_SHA224_mode;
+        #else
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
         #endif
+            break;
         case WC_HASH_TYPE_SHA256:
         #ifndef NO_SHA256
-            return isHashed? CRYS_RSA_After_SHA256_mode : CRYS_RSA_HASH_SHA256_mode;
+            hash_mode = isHashed? CRYS_RSA_After_SHA256_mode :
+                                  CRYS_RSA_HASH_SHA256_mode;
+        #else
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
         #endif
+            break;
         case WC_HASH_TYPE_SHA384:
         #ifdef WOLFSSL_SHA384
-            return isHashed? CRYS_RSA_After_SHA384_mode : CRYS_RSA_HASH_SHA384_mode;
+            hash_mode = isHashed? CRYS_RSA_After_SHA384_mode :
+                                  CRYS_RSA_HASH_SHA384_mode;
+        #else
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
         #endif
+            break;
         case WC_HASH_TYPE_SHA512:
         #ifdef WOLFSSL_SHA512
-            return isHashed? CRYS_RSA_After_SHA512_mode : CRYS_RSA_HASH_SHA512_mode;
+            hash_mode = isHashed? CRYS_RSA_After_SHA512_mode :
+                                  CRYS_RSA_HASH_SHA512_mode;
+        #else
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
         #endif
+            break;
         case WC_HASH_TYPE_NONE:
             /* default to SHA256 */
-            return isHashed? CRYS_RSA_After_SHA256_mode : CRYS_RSA_HASH_SHA256_mode;
+            hash_mode = isHashed? CRYS_RSA_After_SHA256_mode :
+                                  CRYS_RSA_HASH_SHA256_mode;
+            break;
         default:
-            return CRYS_RSA_After_HASH_NOT_KNOWN_mode;
+            hash_mode = CRYS_RSA_After_HASH_NOT_KNOWN_mode;
+            break;
     }
+    return hash_mode;
 }
+
 #endif /* !NO_RSA */
 
 #ifdef HAVE_ECC