To be absolutely clear @public means this call to `CMAC_CTX_free` should be via `ffi.gc` and done right after asserting the ctx exists.