When a key fails a validity check.
When the random bit source produces all zeroes.
When an unsupported ML-KEM variant was attempted to be used.