Use OpenSSL_MAC and OpenSSL_MAC_CTX wrappers together with OPENSSL_TRY to replace manual EVP_MAC resource management in KMAC::sign(). This eliminates manual EVP_MAC_free/EVP_MAC_CTX_free calls in every error path.