Keystone 3 firmware

This commit adds code that clears the optional passphrase text from the screen and resets its visibility to hidden (password mode) whenever the user navigates back from passphrase entry during wallet creation, import, or settings. It also refactors how the 'show/hide' eye icon is controlled. The change looks like a cleanup fix to prevent a sensitive passphrase from lingering on screen or staying visible after a user leaves the page, which could reduce the risk of shoulder-surfing or accidental disclosure.

This commit adds one line that turns off a 'quick access' toggle for the passphrase feature whenever the passphrase text is cleared. Without this fix, the toggle could stay enabled unexpectedly, potentially causing the device to remember or expose passphrase-related settings in a state the user did not intend. The change is defensive and improves safety, but the diff alone does not prove an exploitable vulnerability exists.

This commit only adds release notes for firmware version 2.2.16. It does not change any executable code, configuration, or security logic. The changelog describes two new user-facing features—an optional PIN shuffle toggle and the ability to set up a passphrase wallet during initial wallet creation or import—but these are product announcements, not a security patch or vulnerability fix.

This commit only fixes a formatting issue in the Chinese changelog by replacing a stray backslash with a blank line. No code, firmware logic, or security behavior was changed.

This commit only changes a single number in a version header file, bumping the build version from 14 to 16. There is no code change that affects security, functionality, or behavior of the firmware.

This is a large code-cleanup commit titled 'fix: run fmt and rust fix'. It applies Rust formatting, clippy lint fixes, and removes unstable nightly feature flags across many Rust files in the Keystone 3 firmware. The changes are mostly stylistic or idiomatic (e.g., replacing manual loops with while-let, using OsRng instead of deterministic seeds for Monero bulletproofs/CLSAG signatures, changing pointer-safety annotations to unsafe, and removing unused imports). There is no explicit vendor statement that this fixes a security vulnerability, and the diff does not show a clear, exploitable bug fix. However, the Monero RNG change is a meaningful functional change that could affect cryptographic security if the prior deterministic seeding was flawed, and the broad unsafe FFI annotation changes could hide or expose memory-safety issues. Overall the commit appears to be a routine refactor/tooling fix rather than a targeted security patch.

This commit removes unused variables, unused function declarations, and unused local arrays across several firmware source files, and adds a couple of missing header includes. It also changes a few function signatures from `char *` to `const char *` for string parameters that are not modified. The stated purpose is simply to 'fix warning' (compiler warnings). None of these changes alter program logic, security boundaries, or cryptographic handling.

This commit fixes a user-interface label bug. When a user has a TON (The Open Network) wallet, the device now shows the correct message explaining that TON cannot be combined with Bitcoin or Ethereum-style accounts because the seed phrase is incompatible. It only changes on-screen text and its translations; no security-sensitive code is modified.

This commit simply swaps one icon image for another in the wallet creation screen. It changes the picture shown next to the 'change entropy' menu option from a generic connection icon to a dice icon. There is no security-relevant change.

This commit adds the ability to set a BIP-39 passphrase during wallet creation and import, not just afterward in settings. Most of the change is UI flow wiring, but it also fixes a small bug in the SLIP-39 salt construction and adds a length check for passphrases. There is no clear security vulnerability introduced by the patch itself; the main risk is that passphrase handling is complex and any mistake could lock users out of funds or, in edge cases, weaken key derivation.

This commit removes a line that made a Bitcoin PSBT (Partially Signed Bitcoin Transaction) safety check always return success before doing any real verification. The title says 'add mfp check' (master fingerprint check), but the actual code change mostly re-enables an existing check that had been short-circuited. A master fingerprint check helps ensure the transaction was built for this specific hardware wallet, reducing the risk of signing a transaction meant for someone else's wallet. The commit also contains unrelated build and simulator tweaks.

This commit is a routine localization and font update. It adds one Chinese character (盘) to the Chinese font file, removes three Chinese characters from the Russian font symbol list, and updates translations for the 'Randomized PIN Pad' setting across multiple languages. There is no code behavior change, no security fix, and no vulnerability introduced.

This commit adds a user-facing option to scramble the numeric PIN keypad layout on the Keystone 3 hardware wallet. When enabled, the digits appear in a random order each time, making it harder for someone watching or filming the screen to guess the PIN from finger positions. It is a security-hardening feature, not a fix for an active vulnerability, and it is off by default.

This commit only changes one number in a version header file, bumping the build version from 10 to 14. It does not modify any actual code, features, or security behavior. There is no security issue here.

This commit adds Dogecoin support for multi-signature wallet addresses in a hardware wallet firmware. It lets the device create Dogecoin multi-sig addresses and sort public keys before building the address. There is also a trivial whitespace change in a UI file. The changes look like normal feature work, but adding new address handling always carries a small risk of address-generation mistakes that could make funds hard or impossible to spend.

This commit only changes how two internal Rust libraries are sourced in the project's build configuration. It switches from using local file paths on a developer's Windows machine (C:/3.git/...) to pulling the same libraries from a specific Git branch in the vendor's public repository. There is no code behavior change visible in this commit, and nothing in the commit message or diff indicates a security fix or vulnerability.

This commit fixes two bugs in the Bitcoin PSBT (Partially Signed Bitcoin Transaction) handling code of a hardware wallet firmware. One fix corrects the order of arguments passed between C and Rust code so they match the expected function signature. The other fix moves the array-size assignment to happen before the array is populated, ensuring all nine public keys are properly registered instead of only the first four. These are likely functional bugs that could cause transaction parsing or signing to fail or behave incorrectly, but the diff alone does not prove a direct theft-of-funds vulnerability.

This commit adds support for signing extended PSBTs for several UTXO-based coins (Litecoin, Dogecoin, Dash, Bitcoin Cash) in the Keystone 3 hardware wallet firmware. It also contains several changes that look like temporary debug or development shortcuts rather than production-hardened code: a hardcoded return value that hides the real battery percentage, disabling a boot-version mismatch warning, sending real UART output in production builds, and pointing Rust dependencies to a local path on a developer's Windows machine. These shortcuts reduce the device's defensive posture but are not, by themselves, a remote exploit.

This commit only edits wording and spacing in two changelog files. No code, configuration, or security behavior is changed. It is a documentation-only formatting cleanup.

This commit only adds a new section to the English and Chinese changelogs for firmware version 2.2.14. It describes new features (BSC transfers/swaps, randomized PIN input, IOTA Wallet support) and one bug fix (certain ADA transaction signing causing device restarts). No source code is changed, so the commit itself does not introduce, fix, or alter any security behavior.

This commit simply swaps the Petra wallet icon graphics for new versions. It changes two PNG image files and their corresponding generated C source files, plus updates a hash file used to track those assets. There is no code logic change, no security fix, and no indication this addresses a vulnerability.

This commit only increments a software build number from 13 to 14 in a version header file. There are no code changes, no bug fixes, and no security-related modifications visible in the diff.

This commit fixes minor user-interface issues for the IOTA wallet in the Keystone 3 hardware firmware. It renames the displayed label from 'IOTA' to 'IOTA Wallet', adds a tutorial entry with a help link, and moves the IOTA wallet entry to a different position in the wallet list. There is no security-relevant change visible in the code.