Blockstream Jade

This commit fixes the use of the "%zu" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage values. The commit also adds a CI check to prevent future use of "%zu". There is no direct evidence in the commit that this caused a security vulnerability such as information disclosure or memory corruption, but it is a code-quality fix that removes undefined/unsupported formatting behavior.

This commit fixes cleanup in the one-time-password (OTP) code. Previously, if setting up the cryptographic hash context failed, the code could return without freeing that context, and temporary buffers holding sensitive counter/HMAC data were not always wiped. The change ensures the context is released on failure and wipes temporary buffers before returning. It is a defensive hardening fix rather than a clear exploitable vulnerability.

This commit fixes a small but real security hygiene issue in Blockstream Jade, a hardware wallet. A temporary buffer that holds a sensitive cryptographic hash (HMAC-SHA512 output used to derive child private keys) was not marked as sensitive memory. That means the buffer could be left uncleared in RAM after use, potentially leaking key material if an attacker could read device memory. The patch marks the buffer with SENSITIVE_PUSH so it is properly wiped with SENSITIVE_POP. It is a cleanup/fix, not a full exploit chain by itself.

This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for later code to read. The fix marks the buffer as sensitive and securely clears it after use.

This commit changes how Blockstream Jade handles its PIN server settings. Previously, changing the PIN server web address (URL) also wiped the device's private PIN encryption key, forcing the device to create a fresh one. The patch keeps the existing private key when only the URL changes, while still erasing it when the PIN server's public key changes. This avoids unnecessary key rotation and reduces the risk that a legitimate URL-only update silently breaks PIN security by generating a new key.

This commit is a documentation update for the do-it-yourself (DIY) hardware section of the Blockstream Jade project. It adds descriptions and photos for additional supported circuit boards and updates image file references. There are no code changes that affect security.

This commit adds size limits to several message-handling functions in the Blockstream Jade hardware wallet firmware. It caps how many asset records, transaction inputs/outputs, multisig signers, and BIP85 RSA digests a single RPC message can contain. The change appears to be a hardening patch: without these limits, an attacker or malformed host application could send an extremely large array and potentially exhaust device memory, cause long processing delays, or trigger memory corruption during signing and multisig registration. The patch also makes the array-length check happen earlier and more consistently across the code.