Keystone 3 firmware

This commit fixes a memory-freeing mismatch in the Keystone 3 hardware wallet firmware. The code was freeing a memory block using the wrong allocator (EXT_FREE instead of SRAM_FREE). Such mismatches can corrupt memory and cause the device to crash or behave unpredictably. The commit title says 'fix crash,' but no further details are provided, and there is no independent evidence that this is exploitable for security harm rather than just a stability bug.

This commit fixes a Rust build error in the Zcash module and, as a side effect, changes how sensitive seed data is handled. It switches from a read-only 'extract_array!' macro to a mutable 'extract_array_mut!' macro so the code can explicitly wipe (zeroize) the seed memory after use in one function. The other changed lines simply add 'mut' to satisfy the new macro's requirements. The commit does not add zeroize calls to the other three functions that now also receive mutable seed buffers, so the cleanup is partial.

This commit reviews and hardens the fingerprint sensor subsystem in the Keystone 3 hardware wallet firmware. It removes a custom CRC implementation and several hard-coded encryption keys used for fingerprint communication, replacing them with zero-initialized keys that are later populated at runtime. It also refactors command timeout/retry logic and removes a direct fingerprint sensor system-reset command. The changes reduce the risk that an attacker could exploit predictable keys or a weak checksum to interfere with fingerprint enrollment, recognition, or deletion, but the patch is only partial: the code still calls a removed CRC function in one place and the overall security impact depends on how runtime keys are generated.

This commit removes test-only commands for the NEAR cryptocurrency from the Keystone 3 hardware wallet firmware. These commands were used during development and testing, not in normal wallet operation. Removing them reduces the amount of test code that could accidentally be left active in production, but the commit itself does not fix a known exploitable vulnerability.

This commit improves how the Keystone hardware wallet handles the secret Monero seed when creating key images and signing transactions. Previously, the seed was stored in a local variable inside a loop and its memory was cleared only if the operation succeeded. Now the seed buffer is declared outside the loop, its memory is always wiped with a secure zeroing function, and errors from fetching the seed are checked. This reduces the risk that the seed remains in memory after an error or after the operation finishes.

This commit is a large refactor of Bitcoin-related code in the Keystone 3 firmware. Most changes add unit tests, clean up formatting, and reorganize C code into smaller helper functions. There are a few small functional changes in how Taproot PSBT signing status is tracked and how seed length is obtained, but no obvious security vulnerability is introduced. The refactor also adds explicit clearing of the seed buffer after signing, which is a minor security improvement.

This commit makes two clean-up changes to Tron transaction handling in the Keystone 3 firmware. First, it avoids calling the same formatting functions twice by reusing computed values. Second, it improves how the signing code handles the wallet's secret seed: it now initializes the seed buffer to the correct size, checks whether retrieving the seed succeeded before using it, and securely wipes the seed from memory even if signing fails. These are defensive hardening improvements rather than a fix for a known active exploit, but they reduce the risk that a failed seed retrieval or leftover seed data could lead to incorrect signing or information leakage.

This commit fixes a logic bug in how Bitcoin multisig wallet policies are validated and cleans up several related code paths. The most important change corrects a flawed condition that could have allowed invalid or nonsensical multisig policies (for example, a threshold of zero or a threshold larger than the total number of signers) to be accepted. It also improves memory safety by adding proper cleanup of secret seed data and freeing a previously unfreed response object, and it removes weak-symbol function stubs that could have led to unexpected behavior when Bitcoin-only features are disabled.

This commit is a security-focused code review and hardening pass on account and secret handling in the Keystone 3 hardware wallet firmware. It replaces unsafe string and memory functions (strcpy, sprintf, memcpy) with safer bounded versions, removes debug printf leaks of sensitive data, fixes a bug where a new-password cache overwrote the password cache, adds compile-time guards against shipping test keys in production, and hardens JSON parsing against malformed flash data. These are defensive improvements that reduce the risk of buffer overflows, information leaks, and accidental weakening of secure-element protections.

This commit is purely a code-formatting cleanup. It reorders one import alphabetically and breaks several long lines into shorter ones. No logic, behavior, or security checks were changed.

This commit is a code review and cleanup of Ethereum-related code in the Keystone 3 hardware wallet firmware. It adds many unit tests, fixes a typo in a function name (sign_fee_markey_tx → sign_fee_market_tx), replaces some static variables with constants, and fixes a few minor logic issues. The most user-visible change is adding a check for an SD card before trying to load external contract data, and fixing memory leaks where global pointers could be overwritten without freeing the old data. There is no clear evidence of an active security vulnerability being patched, but the memory management and contract-data-loading changes are defensive improvements.

This commit is a routine code cleanup in the Ethereum module of the Keystone 3 firmware. It renames a function for clarity, changes some function signatures to accept data slices instead of owned vectors for efficiency, and replaces a few direct `.unwrap()` calls with safer `.unwrap_or_default()` handling. There is no indication this fixes a security vulnerability.

This commit fixes three small but real code-quality issues in the Keystone 3 hardware wallet firmware: a global device-settings variable was made private to one file, a memory leak was plugged in the log-reading code, and screen brightness is now capped at a safe maximum. The commit message is just a typo-filled 'reivew device setting', so the vendor did not describe these as security fixes. The changes are defensive hardening rather than an obvious exploit fix.

This commit is a large code cleanup and refactoring of the wallet connection feature in the Keystone 3 firmware. It removes many duplicated Rust modules and C functions that generated QR-code sync data for specific wallets (Aptos, Solana, Sui, XBull, Keystone companion app, etc.) and replaces them with a single generic function. It also fixes some memory leaks by adding SRAM_FREE calls and removes unused/commented-out code. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a maintenance refactor.

This commit updates Ethereum signing code in a cryptocurrency hardware wallet firmware so that the secret seed (master key) is wiped from memory immediately after use. It also replaces several 'unwrap' crash points with proper error handling. The main security improvement is reducing the window where the seed sits in memory after signing, which could lower the risk of an attacker reading it from device RAM. However, the patch is partial: it only covers three Ethereum signing functions and does not appear to add zeroize to all signing paths in the firmware.

This commit is a minor code fix to make the project compile ('fix build'). It only changes how an error value is constructed—adding a descriptive message string to an existing error type. The underlying security behavior (rejecting transaction hashes that are not exactly 32 bytes) is unchanged. There is no indication this fixes a security vulnerability.

This commit fixes several edge cases in the Stellar cryptocurrency app of the Keystone 3 hardware wallet. Previously, the code could crash or behave unpredictably when given malformed signing requests, such as data shorter than expected or missing wallet key paths. The patch adds length checks and proper error handling so the device returns controlled errors instead of panicking or reading invalid memory.

This commit is a code cleanup that removes a dedicated imToken wallet connection module and routes imToken through the existing MetaMask-style connection code. It also adds the ability to include the wallet name when generating connection data for MetaMask-compatible wallets. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit adds cleanup steps when the 'forget password' screen is closed. It now wipes a PIN buffer from memory and clears a secret cache. The change is defensive: it reduces the chance that a leftover PIN or secret remains in memory after the user leaves the password-recovery flow. The commit message does not say this fixes a specific vulnerability, and no public references were supplied.

This commit is a cleanup and hardening pass on how the Keystone 3 hardware wallet handles camera images, SD card files, and debug/test code. The most user-relevant change is that file-reading functions now refuse to load very large files from the SD card, which closes a path where an oversized file could exhaust device memory. Several debug helpers that could print sensitive file contents or cryptographic hashes over the serial port, plus a leftover firmware-copy routine, are removed. A camera preview buffer is also made safer by freeing it on re-init instead of leaking memory. The commit message is vague ('review data flow') and does not call this a security fix, so the security relevance is inferred from the code changes rather than stated by the vendor.

This commit only adds new automated tests for the Tron cryptocurrency transaction handling code in a hardware wallet firmware project. It does not change any production behavior, fix bugs, or introduce new features. There is no security-relevant change visible in the diff.

This commit only reformats whitespace in test code and updates one test's expected value for a contract-creation transaction's destination address from an empty '0x' to the zero address. It does not change any production code or fix a security issue.

This commit is a routine code-quality and test-coverage update for the TON (The Open Network) wallet code in the Keystone 3 firmware. It replaces several Rust `.unwrap()` calls with proper error handling, adds many unit tests, and improves how sensitive seed data is cleared from memory after signing. There is no direct evidence in the commit that these changes fix an active exploit; they look like defensive hardening and cleanup.

This commit temporarily disables the NEAR blockchain app from the Keystone 3 firmware build. It does not fix or introduce any security vulnerability; it is a build configuration change that removes NEAR from automated testing and the multi-coin feature list while keeping the source code present. There is no evidence this change is related to a security issue.

This commit is purely a code-formatting cleanup ("cargo fmt") on Rust files in the Avalanche app. It changes whitespace, line breaks, and import order, but does not alter any program logic, behavior, or security checks. There is no security issue here.