The procedure (§3.2) seeds HMAC with the private key and the hash reduced modulo the group order (int2octets(x) ‖ bits2octets(h1)), runs the HMAC-DRBG update steps and draws candidates until one falls in 1…q−1. The same key and message always give the same k, and therefore the same signature byte for byte. Verifiers cannot tell the difference: the output is an ordinary ECDSA or DSA signature.
FIPS 186-5 approves the method as "deterministic ECDSA" (§6.3.2, Appendix A.3.3). It removes the bad-RNG failure behind the PlayStation 3 and many wallet key leaks, and makes test vectors reproducible: RFC 6979 Appendix A.2 has vectors for DSA, the NIST P-curves and the K- and B-curves.
The trade-off is fault and side-channel exposure: signing the same message twice with an induced fault can leak the key, so hedged variants mix extra randomness into the same derivation (§3.6 allows additional data). Library switches: OpenSSL 3.2 and later -pkeyopt nonce-type:1; Python cryptography ec.ECDSA(hashes.SHA256(), deterministic_signing=True); @noble/curves signs deterministically by default with an extraEntropy option for hedging.