[aidangarske]

• 847da6f2e9 added a second wc_ForceZero() (or ForceZero() with WOLFSSL_NO_FORCE_ZERO) prototype in wc_compat.h
  for the FIPS AES-GCM compat shims.
• Whichever of memory.h and wc_compat.h is parsed second redeclares it, so any application built with -Wredundant-decls -Werror against a FIPS v2 build fails to compile, in either include order.
• This currently blocks wolfEngine: its FIPSv2 Jenkins jobs fail in test/test_aestag.c, so Fix fenrir issues across wolfEngine wolfEngine#257 cannot
  go green until this lands.
• Both headers now declare the zeroizer only when WC_FORCE_ZERO_DECLARED is not yet defined, and define it after
  declaring, so exactly one prototype is emitted.
• No API or ABI change; the declarations and the wc_ForceZero to ForceZero alias are unchanged.
• fix forcezero linking on every build #10935 also removes the duplicate, as part of moving wc_ForceZero() into wc_port.c. This is the minimal fix to unblock
  downstream now; it can be dropped when fix forcezero linking on every build #10935 merges.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the change preventing duplicate zeroizer declarations.

No open issues 🎉

What changed in this PR

This PR prevents duplicate zeroizer declarations across memory.h and wc_compat.h, addressing FIPS v2 compilation failures for consumers using -Wredundant-decls -Werror, including wolfEngine.

Changes:

• Adds a shared WC_FORCE_ZERO_DECLARED guard so either header can declare the zeroizer first without redeclaration.
• Preserves the existing prototypes and WOLFSSL_NO_FORCE_ZERO alias without changing the API or ABI.

File	Description
wolfssl/​wolfcrypt/​wc_compat.h	Guards the zeroizer declaration needed by the FIPS compatibility shims.
wolfssl/​wolfcrypt/​memory.h	Uses the same guard to avoid redeclaring the zeroizer.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,664 B (+0.6%, 284,112 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12069

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[padelsbach]

jenkins retest this please