Function kmac128_xof 

pub fn kmac128_xof(key: &[u8], data: &[u8], custom: &[u8], out: &mut [u8])

KMAC128 in XOF mode (KMACXOF128, NIST SP 800-185 §4).

XOF variant: binds right_encode(0) instead of the output length, so out.len() does not affect earlier bytes. NIST SP 800-185 §4.3.1.