diff --git a/examples/attestation/make_credential.c b/examples/attestation/make_credential.c
index a7db449db..7e52969ea 100644
--- a/examples/attestation/make_credential.c
+++ b/examples/attestation/make_credential.c
@@ -153,8 +153,13 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[])
     XMEMSET(&makeCredIn, 0, sizeof(makeCredIn));
     XMEMSET(&makeCredOut, 0, sizeof(makeCredOut));
     makeCredIn.credential.size = CRED_SECRET_SIZE;
-    wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer,
+    rc = wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer,
                              makeCredIn.credential.size);
+    if (rc != TPM_RC_SUCCESS) {
+        printf("wolfTPM2_GetRandom failed 0x%x: %s\n", rc,
+            TPM2_GetRCString(rc));
+        goto exit;
+    }
     /* Set the object name */
     if (name.size > sizeof(makeCredIn.objectName.name)) {
         printf("Name size %d exceeds buffer\n", name.size);
@@ -180,14 +185,23 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[])
 
 #if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
     fp = XFOPEN(output, "wb");
-    if (fp != XBADFILE) {
-        dataSize = (int)XFWRITE((BYTE*)&makeCredOut.credentialBlob, 1,
-                                 sizeof(makeCredOut.credentialBlob), fp);
-        if (dataSize > 0) {
-            dataSize += (int)XFWRITE((BYTE*)&makeCredOut.secret, 1,
-                                      sizeof(makeCredOut.secret), fp);
-        }
-        XFCLOSE(fp);
+    if (fp == XBADFILE) {
+        printf("Failed to open %s for writing\n", output);
+        rc = BAD_FUNC_ARG;
+        goto exit;
+    }
+    dataSize = (int)XFWRITE((BYTE*)&makeCredOut.credentialBlob, 1,
+                             sizeof(makeCredOut.credentialBlob), fp);
+    if (dataSize == (int)sizeof(makeCredOut.credentialBlob)) {
+        dataSize += (int)XFWRITE((BYTE*)&makeCredOut.secret, 1,
+                                  sizeof(makeCredOut.secret), fp);
+    }
+    XFCLOSE(fp);
+    if (dataSize != (int)(sizeof(makeCredOut.credentialBlob) +
+                          sizeof(makeCredOut.secret))) {
+        printf("Failed to write credential blob and secret to %s\n", output);
+        rc = BAD_FUNC_ARG;
+        goto exit;
     }
     printf("Wrote credential blob and secret to %s, %d bytes\n",
         output, dataSize);
diff --git a/examples/pcr/extend.c b/examples/pcr/extend.c
index 608e1c972..f9a5138b2 100644
--- a/examples/pcr/extend.c
+++ b/examples/pcr/extend.c
@@ -75,6 +75,11 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
     enum wc_HashType hashType;
     wc_HashAlg dig;
     int hashInitialized = 0;
+#elif !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) && \
+    defined(WOLFTPM2_NO_WOLFCRYPT)
+    XFILE fp = NULL;
+    size_t len;
+    BYTE extra;
 #endif
 
     union {
@@ -157,11 +162,19 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
         rc = wc_HashInit(&dig, hashType);
         if (rc == 0)
             hashInitialized = 1;
-        while (rc == 0 && !XFEOF(fp)) {
+        while (rc == 0) {
             len = XFREAD(dataBuffer, 1, sizeof(dataBuffer), fp);
             if (len > 0) {
                 rc = wc_HashUpdate(&dig, hashType, dataBuffer, (int)len);
             }
+            if (len < sizeof(dataBuffer)) {
+                /* Short read: end of file, or an input error to report */
+                if (!XFEOF(fp)) {
+                    printf("Error reading file %s\n", filename);
+                    rc = BAD_FUNC_ARG;
+                }
+                break;
+            }
         }
         XFCLOSE(fp);
         if (rc == 0)
@@ -177,7 +190,26 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
                 hash, hashSz);
     }
     else
-#endif /* !WOLFTPM2_NO_WOLFCRYPT && !NO_FILESYSTEM */
+#elif !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) && \
+    defined(WOLFTPM2_NO_WOLFCRYPT)
+    /* Crypto disabled: the file must contain a precomputed digest */
+    fp = XFOPEN(filename, "rb");
+    if (fp != XBADFILE) {
+        len = XFREAD(cmdIn.pcrExtend.digests.digests[0].digest.H, 1,
+            hashSz, fp);
+        if ((int)len == hashSz && XFREAD(&extra, 1, 1, fp) != 0) {
+            len = 0; /* trailing bytes mean this is not a bare digest */
+        }
+        XFCLOSE(fp);
+        if ((int)len != hashSz) {
+            printf("Expected exactly %d digest bytes in %s\n",
+                hashSz, filename);
+            rc = BAD_FUNC_ARG;
+            goto exit;
+        }
+    }
+    else
+#endif /* !NO_FILESYSTEM */
     {
         printf("Error loading file %s, using test data\n", filename);
         for (i=0; i<hashSz; i++) {
diff --git a/examples/pcr/quote.c b/examples/pcr/quote.c
index 9e199a34f..ad0e5565a 100644
--- a/examples/pcr/quote.c
+++ b/examples/pcr/quote.c
@@ -300,9 +300,17 @@ int TPM2_PCR_Quote_Test(void* userCtx, int argc, char *argv[])
     dataSz = cmdOut.quoteResult.quoted.size;
 #if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
     f = XFOPEN(outputFile, "wb");
-    if (f != XBADFILE) {
-        dataSz = (int)XFWRITE(data, 1, dataSz, f);
-        XFCLOSE(f);
+    if (f == XBADFILE) {
+        printf("Failed to open %s for writing\n", outputFile);
+        rc = BAD_FUNC_ARG;
+        goto exit;
+    }
+    dataSz = (int)XFWRITE(data, 1, dataSz, f);
+    XFCLOSE(f);
+    if (dataSz != (int)cmdOut.quoteResult.quoted.size) {
+        printf("Failed to write quote to %s\n", outputFile);
+        rc = BAD_FUNC_ARG;
+        goto exit;
     }
     printf("Wrote %d bytes to %s\n", dataSz, outputFile);
 #else
diff --git a/examples/pkcs7/pkcs7.c b/examples/pkcs7/pkcs7.c
index 3bdc248b9..721c8beab 100644
--- a/examples/pkcs7/pkcs7.c
+++ b/examples/pkcs7/pkcs7.c
@@ -221,6 +221,10 @@ static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId,
 
         XFCLOSE(pemFile);
     }
+    else {
+        printf("Failed to open %s for writing\n", outFile);
+        rc = -1; goto exit;
+    }
 #else
     (void)outFile;
 #endif
@@ -306,6 +310,10 @@ static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId,
             rc = -1; goto exit;
         }
     }
+    else {
+        printf("Failed to open %s for writing\n", outFile);
+        rc = -1; goto exit;
+    }
 #else
     (void)outFile;
 #endif
diff --git a/examples/run_examples.sh b/examples/run_examples.sh
index 6aa70f912..d40f70756 100755
--- a/examples/run_examples.sh
+++ b/examples/run_examples.sh
@@ -652,9 +652,18 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi
     generate_port
     READY_FILE="/tmp/wolftpm_tls_ready_$$"
     rm -f "$READY_FILE"
+    # The TPM client verifies the peer, so the wolfSSL server presents a cert
+    # for this key type and the client trusts the CA that issued it
+    if [ "$1" = "ecc" ]; then
+        PEER_CERT_ARGS="-c ./certs/server-ecc.pem -k ./certs/ecc-key.pem"
+        PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-ecc-cert.pem"
+    else
+        PEER_CERT_ARGS="-c ./certs/server-cert.pem -k ./certs/server-key.pem"
+        PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-cert.pem"
+    fi
     pushd $WOLFSSL_PATH >> $TPMPWD/run.out 2>&1
-    echo -e "./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem -R $READY_FILE"
-    ./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem -R "$READY_FILE" >> $TPMPWD/run.out 2>&1 &
+    echo -e "./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS -R $READY_FILE"
+    ./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS -R "$READY_FILE" >> $TPMPWD/run.out 2>&1 &
     SERVER_PID=$!
     popd >> $TPMPWD/run.out 2>&1
     if ! wait_for_ready "$READY_FILE" 500; then
@@ -665,8 +674,8 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi
     fi
     rm -f "$READY_FILE"
 
-    echo -e "./examples/tls/tls_client -p=$port -$1 $2"
-    ./examples/tls/tls_client -p=$port -$1 $2 >> $TPMPWD/run.out 2>&1
+    echo -e "./examples/tls/tls_client -p=$port -A=$PEER_CA_FILE -$1 $2"
+    ./examples/tls/tls_client -p=$port "-A=$PEER_CA_FILE" -$1 $2 >> $TPMPWD/run.out 2>&1
     RESULT=$?
     [ $RESULT -ne 0 ] && echo -e "tpm tls client $1 $2 failed! $RESULT" && exit 1
 }
@@ -674,9 +683,18 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi
 run_tpm_tls_server() { # Usage: run_tpm_tls_server [ecc/rsa] [tpmargs] [tlsversion] [extraargs]
     echo -e "TLS test (TPM as server) $1 $2 $3"
     generate_port
+    # The TPM server verifies the peer, so the wolfSSL client presents a
+    # client-auth cert for this key type and the server trusts its issuer
+    if [ "$1" = "ecc" ]; then
+        PEER_CERT_ARGS="-c ./certs/client-ecc-ca-cert.pem -k ./certs/ecc-client-key.pem"
+        PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-ecc-cert.pem"
+    else
+        PEER_CERT_ARGS="-c ./certs/client-ca-cert.pem -k ./certs/client-key.pem"
+        PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-cert.pem"
+    fi
 
-    echo -e "./examples/tls/tls_server -p=$port -$1 $2"
-    ./examples/tls/tls_server -p=$port -$1 $2 >> $TPMPWD/run.out 2>&1 &
+    echo -e "./examples/tls/tls_server -p=$port -A=$PEER_CA_FILE -$1 $2"
+    ./examples/tls/tls_server -p=$port "-A=$PEER_CA_FILE" -$1 $2 >> $TPMPWD/run.out 2>&1 &
     SERVER_PID=$!
     if ! wait_for_port "$port" 500; then
         echo -e "TPM TLS server failed to start on port $port for $1 $2"
@@ -685,8 +703,8 @@ run_tpm_tls_server() { # Usage: run_tpm_tls_server [ecc/rsa] [tpmargs] [tlsversi
     fi
     pushd $WOLFSSL_PATH >> $TPMPWD/run.out 2>&1
 
-    echo -e "./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $4"
-    ./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $4 >> $TPMPWD/run.out 2>&1
+    echo -e "./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS $4"
+    ./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS $4 >> $TPMPWD/run.out 2>&1
     RESULT=$?
     [ $RESULT -ne 0 ] && echo -e "tls client $1 $2 failed! $RESULT" && exit 1
     popd >> $TPMPWD/run.out 2>&1
@@ -877,8 +895,15 @@ echo -e "PCR Quote tests"
 ./examples/pcr/reset 16 >> $TPMPWD/run.out 2>&1
 RESULT=$?
 [ $RESULT -ne 0 ] && echo -e "pcr reset failed! $RESULT" && exit 1
-./examples/pcr/extend 16 /usr/bin/zip >> $TPMPWD/run.out 2>&1
+PCR_EXTEND_FILE=/usr/bin/zip
+if [ $WOLFCRYPT_ENABLE -eq 0 ]; then
+    # Without wolfCrypt, extend expects a raw, precomputed SHA-256 digest.
+    PCR_EXTEND_FILE="$TPMPWD/pcr-extend.digest"
+    printf '%s' '0123456789abcdef0123456789abcdef' > "$PCR_EXTEND_FILE"
+fi
+./examples/pcr/extend 16 "$PCR_EXTEND_FILE" >> $TPMPWD/run.out 2>&1
 RESULT=$?
+[ $WOLFCRYPT_ENABLE -eq 0 ] && rm -f "$PCR_EXTEND_FILE"
 [ $RESULT -ne 0 ] && echo -e "pcr extend file failed! $RESULT" && exit 1
 ./examples/pcr/quote 16 zip.quote >> $TPMPWD/run.out 2>&1
 RESULT=$?
diff --git a/examples/timestamp/clock_set.c b/examples/timestamp/clock_set.c
index f1186ff21..eaca888b2 100644
--- a/examples/timestamp/clock_set.c
+++ b/examples/timestamp/clock_set.c
@@ -112,8 +112,14 @@ int TPM2_ClockSet_Test(void* userCtx, int argc, char *argv[])
 
     /* Set the TPM clock forward */
     cmdIn.clockSet.auth = TPM_RH_OWNER;
-    if (newClock)
-        cmdIn.clockSet.newTime = newClock;
+    if (newClock) {
+        if (newClock > (UINT64)0xFFFFFFFFFFFFFFFFULL - oldClock) {
+            printf("Clock increment out of range\n");
+            rc = BAD_FUNC_ARG;
+            goto exit;
+        }
+        cmdIn.clockSet.newTime = oldClock + newClock;
+    }
     else
         cmdIn.clockSet.newTime = oldClock + 50000;
     rc = TPM2_ClockSet(&cmdIn.clockSet);
diff --git a/examples/tls/tls_client.c b/examples/tls/tls_client.c
index 925ea571e..e3f84399e 100644
--- a/examples/tls/tls_client.c
+++ b/examples/tls/tls_client.c
@@ -101,6 +101,9 @@ static void usage(void)
     printf("* -aes/xor: Use Parameter Encryption\n");
     printf("* -h=host: Server hostname (default %s)\n", TLS_HOST);
     printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT);
+#ifndef NO_FILESYSTEM
+    printf("* -A=file: CA certificate file to trust\n");
+#endif
 #if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS)
     printf("* -pk: Use PK callbacks, not crypto callbacks\n");
 #endif
@@ -142,6 +145,9 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[])
 #endif
     const char* host = TLS_HOST;
     int hostGiven = 0;
+#ifndef NO_FILESYSTEM
+    const char* caFile = NULL;
+#endif
     int useECC = 0;
     int usePK = 0;
 #ifdef WOLFTPM_TLS_PQC
@@ -226,6 +232,11 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[])
             const char* portStr = argv[argc-1] + XSTRLEN("-p=");
             port = (word32)XATOI(portStr);
         }
+    #ifndef NO_FILESYSTEM
+        else if (XSTRNCMP(argv[argc-1], "-A=", XSTRLEN("-A=")) == 0) {
+            caFile = argv[argc-1] + XSTRLEN("-A=");
+        }
+    #endif
         else {
             printf("Warning: Unrecognized option: %s\n", argv[argc-1]);
         }
@@ -479,7 +490,15 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[])
     }
 #else
     /* Load CA Certificates */
-    if (!useECC) {
+    if (caFile != NULL) {
+        if (wolfSSL_CTX_load_verify_locations(ctx, caFile,
+                                              0) != WOLFSSL_SUCCESS) {
+            printf("Error loading %s cert\n", caFile);
+            rc = -1;
+            goto exit;
+        }
+    }
+    else if (!useECC) {
     #ifndef NO_RSA
         if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/ca-rsa-cert.pem",
                                               0) != WOLFSSL_SUCCESS) {
diff --git a/examples/tls/tls_common.h b/examples/tls/tls_common.h
index 26e8916de..dfc03e175 100644
--- a/examples/tls/tls_common.h
+++ b/examples/tls/tls_common.h
@@ -479,16 +479,12 @@ static inline int myVerify(int preverify, WOLFSSL_X509_STORE_CTX* store)
     printf("\tSubject's domain name at %d is %s\n",
         store->error_depth, store->domain);
 
-    (void)preverify;
-
-    /* If error indicate we are overriding it for testing purposes */
     if (store->error != 0) {
-        printf("\tAllowing failed certificate check, testing only "
-            "(shouldn't do this in production)\n");
+        printf("\tCertificate verification failed\n");
     }
 
-    /* A non-zero return code indicates failure override */
-    return 1;
+    /* Honor the verification result instead of overriding failures */
+    return preverify;
 }
 
 #ifndef NO_DH
diff --git a/examples/tls/tls_server.c b/examples/tls/tls_server.c
index 196a95dc7..08d5c10dc 100644
--- a/examples/tls/tls_server.c
+++ b/examples/tls/tls_server.c
@@ -122,6 +122,9 @@ static void usage(void)
 #endif
     printf("* -aes/xor: Use Parameter Encryption\n");
     printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT);
+#ifndef NO_FILESYSTEM
+    printf("* -A=file: CA certificate file to trust\n");
+#endif
 #if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS)
     printf("* -pk: Use PK callbacks, not crypto callbacks\n");
 #endif
@@ -177,6 +180,9 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
     int usePK = 0;
     int runLoop = 0;
     int useSelfSign = 0;
+#ifndef NO_FILESYSTEM
+    const char* caFile = NULL;
+#endif
 #ifdef WOLFTPM_TLS_PQC
     int useMLDSA = 0;
     TPMI_MLDSA_PARAMETER_SET mldsaSet = TPM_MLDSA_65;
@@ -262,6 +268,11 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
             const char* portStr = argv[argc-1] + XSTRLEN("-p=");
             port = (word32)XATOI(portStr);
         }
+    #ifndef NO_FILESYSTEM
+        else if (XSTRNCMP(argv[argc-1], "-A=", XSTRLEN("-A=")) == 0) {
+            caFile = argv[argc-1] + XSTRLEN("-A=");
+        }
+    #endif
         else {
             printf("Warning: Unrecognized option: %s\n", argv[argc-1]);
         }
@@ -526,7 +537,15 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
     #endif
 #else
     /* Load CA Certificates */
-    if (!useECC) {
+    if (caFile != NULL) {
+        if (wolfSSL_CTX_load_verify_locations(ctx, caFile,
+                                              0) != WOLFSSL_SUCCESS) {
+            printf("Error loading %s cert\n", caFile);
+            rc = -1;
+            goto exit;
+        }
+    }
+    else if (!useECC) {
     #ifndef NO_RSA
         if (wolfSSL_CTX_load_verify_locations(ctx, CA_RSA_CERT_PATH,
                                               0) != WOLFSSL_SUCCESS) {