Why does NIST SP 800 `KDF in Counter Mode' specification require a PRF rather than a PRP?
The basic goal—not really explicated by the standard—of these KDF constructions is to turn an unstructured-input short-output PRF $f$ into a structured-input long-output PRF $\operatorname{KDF-}\!f$, whose PRF-advantage has some standard reduction to the PRF-advantage of $f$.

If the label, context, counter, etc., are all short enough, you could instantiate it with a PRP instead of a PRF for $f$, and you would incur the standard PRP-for-PRF cost on security bounds.  It is likely that with CMAC, you don't pay that cost—though I haven't done the analysis to be sure.