I ran into an odd issue today that I was quite surprised to see. I have a field that is a type 'radio' and my default wasn't working. The default value I was trying to use was 'Hash_HMAC'

        $cmb_cpt->add_field( array(
            'name'    => __( 'Hash Method', 'pritect-api' ),
            'desc'    => 'Only for Hashed API Key',
            'id'      => $prefix . 'hash_method',
            'type'    => 'radio',
            'default' => 'Hash_HMAC',
            'options' => array(
                'Hash_HMAC' => 'HMAC',
                'Hash' => 'Simple Hash',
            )
        ) );

After walking through the code I discovered that CMB2_Field:get_param_callback_result() runs maybe_callback( $param ) which in turn calls the php function is_callable().

For some reason in php function names are case-insensitive. So is_callable( 'Hash_HMAC' ) was returning true because hash_hmac() is a real function.

I can work around this in my code, but I'm sure this issue will come up again sometime. Maybe the maybe_callback should only be called if actually requested by the key having a '_cb' suffix or something.