COLDCARD firmware

This change fixes a potential bug in how COLDCARD's 'trick PIN' feature removes special unlock PINs. Before deleting those PINs, the code now reloads the trick PIN data from storage. Without the reload, the function might operate on stale in-memory data and fail to delete some trick PINs that should have been removed. That could leave behind an unintended bypass PIN after a feature is turned off, which is a security-relevant state.

This is a small bug fix in the COLDCARD hardware wallet's 'trick PIN' feature. Trick PINs let users set up special PINs that do things like wipe the device or unlock specific spending policies. The fix makes the device refresh its trick-PIN list before looking for a PIN that unlocks a spending policy. Without the refresh, the device might fail to find a newly added or changed unlock-policy PIN, which could leave a legitimate user unexpectedly unable to access funds or use a protective feature as intended. There is no direct evidence in the commit that this is exploitable by an attacker.

This commit tightens access to the 'Type Passwords' feature on COLDCARD devices when operating in a restricted 'semi-seedless' mode (SSSP). Previously, the feature was available whenever the device was in emulator mode; now it also requires that SSSP-related keys are present. Without this change, a user in this restricted mode might have been able to type out stored passwords even when other seed-dependent features were intentionally disabled. The fix is a one-line guard that aligns the password-typing feature with the same key-presence check used for related features.

This is a tiny user-interface label fix. It changes the warning label shown when a spending policy requires web-based two-factor authentication from the generic text 'CCC' to the specific policy key name. There is no security vulnerability here.

This commit updates a single configuration number in the COLDCARD firmware that tells the device the earliest Bitcoin block height at which a certain feature (likely related to 'ccc' or CoinJoin-style coordination) should be considered active. It is a routine date/height bump, not a code change that fixes a vulnerability. By itself it does not appear to introduce or patch a security flaw.

This commit only changes a test file (testing/test_multisig.py). It fixes a test helper called ms_sign_simple by adding proper derivation path handling and adjusting how xpubs are included in test multisig wallets. There is no change to the actual COLDCARD firmware code that users run, so it cannot directly affect real device security.

This commit only changes one word in a documentation file. It rephrases a sentence about how COLDCARD handles PSBT warnings under a policy rule. There is no code change, no behavior change, and no security fix or vulnerability introduced.

This commit only updates test files in the COLDCARD firmware repository. It adjusts test cases to use new internal constants, skips some secure-notes/password checks on non-Q1 hardware, replaces a slow wallet-creation helper with a faster import helper, updates menu navigation labels in a test, and adds a missing assertion for a classic P2PKH address format. There are no changes to firmware source code, no security fixes, and no disclosed vulnerability.

This commit is titled 'ckcc bump' and changes one line in one file: external/ckcc-protocol. No diff content is available, and no verified references were supplied. There is no visible information about what was changed, why it was changed, or whether it has any security relevance.

This commit only edits a documentation file (docs/limitations.md). It updates descriptions of product limitations, such as noting that a previously reserved PIN code is now available, explaining backup file timestamps, adding a note about unsupported pay-to-pubkey transactions, and renaming a feature section. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.

This commit only adds explanatory comments to two source files and makes a tiny, non-functional cleanup in a USB error handler (removing an unused exception variable). It also adds one line to the changelog noting a separate multisig address-format bugfix. The code changes themselves do not alter program behavior or fix any security issue.

This commit only changes test code for the COLDCARD firmware. It adjusts how a test sets up a 'hobbled' Teleport signing scenario by importing wallet data before hobbled mode is enabled, and removes an unused test parameter. There is no change to the actual firmware or wallet behavior, and no security issue is present in the diff.

This commit fixes how COLDCARD handles different Bitcoin address formats in multisig transactions. Previously, the wallet could be tricked into treating inputs or change outputs as belonging to the wrong address type (for example, treating a classic P2SH multisig input as if it were a wrapped SegWit P2SH-P2WSH input, or vice versa). The patch makes the device strictly check that the script type matches the wallet's configured address format and verifies that the script in the transaction actually produces the expected on-chain scriptPubKey. This prevents attackers from deceiving the device about which coins are being spent or where change is going.

This commit hides the 'Spending Policy' menu item when the COLDCARD wallet does not actually have a real secret key loaded. Previously, the menu item was always shown, even though it would be empty or non-functional without a real secret. This is a minor UI cleanup rather than a serious security fix.

This commit fixes a user-interface bug on the COLDCARD MK4 that occurred when restoring a wallet backup over USB. After a USB restore, the device was supposed to let the user enter the backup password as a series of seed words, but the on-screen word-entry menu did not work correctly because the device was not coming from the normal menu flow. The fix detects the USB case and uses a simpler, direct word-entry path instead. There is no direct evidence this is a security vulnerability; it appears to be a usability/functional bug fix.

This is a tiny test-only change. It removes an unused function argument (`only_q1`) from a test and adds a short delay (`time.sleep(0.1)`) during a test that simulates user button presses. There is no change to the actual COLDCARD firmware code that users run, and nothing here affects security.

This commit fixes a security policy bug in the COLDCARD hardware wallet. In 'hobbled mode'—a restricted operating mode meant to limit what secrets can leave or be combined—the device was incorrectly allowing users to include the wallet's master seed as one of the parts when restoring a seed via XOR. The patch removes that option when hobbled, so a locked-down COLDCARD can no longer be tricked or misused into mixing its master seed into an externally reconstructed secret.

This is a tiny cleanup commit. It fixes a wording error in the changelog ('after 13 PIN failures, when device is bricked' becomes 'after 13 PIN failures or when device is bricked') and removes an unused local import inside a calculator feature. There is no security-relevant code change.

This update changes what happens on the COLDCARD Q hardware wallet after someone enters the wrong PIN 13 times and the device becomes permanently locked ("bricked"). Instead of showing only a useless "I Am Brick!" screen, the Q model now turns into a simple calculator. The change also lets the calculator's login prompt check whether PIN attempts remain before trying to log in, and adds simulator options so developers can test bricked devices. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads as a usability enhancement for a device that is already considered lost.

This commit reorganizes how a COLDCARD device decides it is 'bricked' and what it does next. It moves the brick check from the main boot code into the PIN-handling code, and slightly cleans up a calculator/login helper. The change appears intended to make bricked devices stop earlier in boot and still offer a calculator-only recovery screen on QWERTY models. There is no clear vulnerability being fixed; it reads more like a defensive hardening or refactor.

This commit changes what a COLDCARD Q device does when its secure element (SE) is 'bricked'—a state where the hardware security chip is no longer usable. Previously, the device immediately entered DFU (device firmware update) mode and stopped. After this change, the device first opens a calculator-like text interface that can run forever, and only then enters DFU mode. The commit title 'Q: brick into forever calculator' suggests this is intentional behavior for bricked devices, not a vulnerability. The change also removes the ability to enter a PIN from within that calculator when reached through this bricked path, so it does not appear to provide a way to bypass authentication.

This commit adds a new menu option called 'Restore Seed XOR' to the Temporary Seed menu on a COLDCARD device. It simply exposes an existing feature (restoring a seed from XOR-encoded parts) in a new place where users can reach it more easily. There is no code change to how seeds are stored, processed, or protected.

This commit fixes a security bug in the COLDCARD firmware where the 'SSSP' (a spending-limit / hobbled mode feature) settings were being saved under the current temporary seed instead of the master seed. That meant switching to a different temporary seed could bypass or corrupt the spending policy. The patch forces SSSP settings to be read from and written to the master seed only, and hides the 'Destroy Seed' menu item when only a temporary seed is loaded.

This commit updates a linked external component (ckcc-protocol) to its latest master version. No actual code changes are shown, and no security-related description is provided. There is not enough information to assess whether this update fixes or introduces any security issue.

This commit only adjusts test files and removes a couple of unused imports from production code. There is no security fix or vulnerability being patched.