Is there any vulnerability if I hmac(key,key)?
This is all useless.

The point of hashing passwords is to prevent a hacker who obtained the database with the hash to retrieve the original password.

With a short pin (assuming 4 digits) a hacker will simply calculate your hmac for all 10000 possible codes. None of your variations will make any significant difference.
A secure hash will hardly help either.