BoringSSL has KATs for ML-KEM 768 here: https://boringssl.googlesource.com/boringssl/+/refs/heads/master/crypto/mlkem These include test vectors (inputs and expected outputs) for ML-KEM 768 keygen, encap, and decap Related to https://github.com/openssl/project/issues/1015