Trezor firmware

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates wording in Czech, German, Spanish, French, Portuguese, and the translation signature file. There are no code, logic, cryptographic, or security behavior changes.

This commit is a minor translation-processing fix. It changes a script that cleans translated text so it keeps a special non-breaking space before colons (':') in addition to question marks and exclamation points. This is purely a localization/punctuation formatting tweak and has no security relevance.

This commit is a routine translation update for the French language. It changes the capitalization of one word ('fragment' to 'Fragment') and removes the word 'n°' (number) from two French text strings shown on the device during SLIP39 backup/recovery flows. The accompanying files are just updated translation signatures and UI test fixture hashes. There is no code logic change and no security relevance.

This commit adds the degree symbol (°) to French font files used on Trezor hardware wallets. It is a routine translation/localization update with no security relevance. There is no code change that could be exploited or affect device security.

This commit is a routine synchronization of translated user-interface text for the Trezor hardware wallet. It updates Czech, German, Spanish, French, and Portuguese translation files, refreshes the cryptographic signature that protects those translations, and updates the expected screen hashes used by automated UI tests. There is no change to security logic, cryptography, or how the device handles private keys or transactions.

This commit changes the Trezor hardware wallet's screen-lock/suspend behavior so that during two sensitive setup tasks—creating a wallet backup and recovering a wallet—the device stays awake for at least 2 minutes instead of using the normal 40-second battery timeout. This only affects the battery-powered T3W1 model. It is a usability/usability-safety feature, not a fix for a known exploitable vulnerability.

This commit fixes a bug in the Trezor hardware wallet's low-level crash handler for STM32F4 devices. The handler decides whether a memory fault is a stack overflow by checking the wrong stack pointer due to an inverted branch condition. Before the fix, the device could fail to recognize or recover from a stack overflow on the main stack, potentially leaving it in a crashed or unresponsive state instead of resetting safely.

This commit increases the kernel's main stack size from 8 KB to 10 KB on several Trezor hardware wallet models that use STM32F4 microcontrollers. To make room, it slightly shrinks a separate auxiliary RAM region (AUX2). The change is a defensive hardening fix: a stack that is too small can overflow, which on these devices triggers a memory-protection fault and may crash or reset the device. The commit itself does not describe a specific attack, but insufficient stack space is a known reliability and security concern in embedded systems.

This commit adds support for ERC-4626 vault reward claims and changes how Trezor handles Ethereum transactions with extra trailing bytes (calldata suffix). Previously, vault transactions with any trailing bytes were rejected as errors. Now, the device accepts them but shows the extra bytes to the user as a 'Calldata suffix' screen. The change also introduces a new 'claim' function path, but the actual claim UI is stubbed out and returns None (disabled) for now. The commit is a feature addition, not a documented security fix, but it touches transaction parsing and user confirmation flows.

This commit is a routine language and translation update for the Trezor hardware wallet firmware. It changes English wording (for example, 'Input data' becomes 'Data', 'Access passphrase wallet' becomes 'Access Passphrase wallet'), removes some trailing colons from prompts, and updates the generated translation tables and test fixtures accordingly. There is no code behavior change, no security fix, and no vulnerability.

This commit is a code cleanup in the Trezor firmware's bootloader startup system. It replaces a fixed-size on-stack certificate buffer with a new 'reserve/commit/discard' API that lets the bootloader allocate space for the MCU attestation certificate directly in the shared startup-arguments buffer. There is no indication in the commit or supplied references that this fixes a security bug; it appears to be a defensive refactor to avoid large stack buffers and make the API more flexible.

This commit is a routine user-interface cleanup. It adds new translation strings for showing Ethereum transaction data size (for example, "Input data: 12 / 100 bytes") and moves the code that displays streaming data chunks so it can be shared across all Trezor firmware variants. There is no security-relevant change visible in the code.

This is a small, safe code cleanup in the user-interface layer of the Trezor firmware. It lets menu screens use a different visual layout type in the future, but does not change any existing behavior or fix a security problem. There is no indication of a vulnerability.

This commit changes a debug-only mock file for the N4W1 hardware feature in Trezor firmware. It adds a user-facing 'hold the tag' screen that waits for a simulated tap/connection event before continuing. The change is confined to a debugging helper and does not appear to alter normal wallet security logic.

This commit is a straightforward internal code reorganization. It moves the `_DisplayHandler` class and related helper functions from one file to another within the recovery device feature, without changing what the code actually does. There is no security-relevant change visible in the diff.

This commit is a simple code cleanup: it takes an existing loop that walks the user through backing up each recovery-share and moves that loop body into a new helper method named `_backup_share`. There is no change to what the code does, what data it handles, or how it interacts with the user. It is purely a structural refactor.

This is a small internal code cleanup in the Trezor firmware's user-interface layer. It changes how the 'show address' screen is wrapped so that the layout object is managed within a scoped context manager rather than passed directly to a helper function. There is no indication this fixes a security bug or changes user-visible behavior.

This is a code cleanup change in the Trezor hardware wallet's user-interface layer. It introduces a new 'LayoutContext' wrapper so that on-screen keyboards and menus are always used inside a 'with' block, ensuring their memory is released promptly. The commit itself does not claim to fix a security bug, but it references an internal issue (#6811) about lifetime management, suggesting it is a defensive step against possible UI object lifetime problems.

This is a routine automated dependency update by Dependabot, bumping the pinned Python protobuf package from version 6.32 to 6.33.5. The change only edits two version pins in project configuration files and contains no code changes. There is no indication in the commit that this fixes or introduces a security issue.

This commit is a code cleanup (refactor) that moves the handling of a device certificate stored in secure memory into dedicated helper functions. It does not change what data is stored or how it is protected; it only makes the code more maintainable. There is no indication this fixes a security bug.

This is a code-maintenance refactor, not a security fix. It moves public HSM (Hardware Security Module) and device-authenticity root keys from a C header file into a shared JSON file, then auto-generates both the C header and a Python file from that JSON. The actual key values do not change. A few related C files are updated to use a new feature flag (USE_MCU_ATTESTATION) and consistent size constants for the ML-DSA algorithm. There is no evidence in the commit of a vulnerability being patched.

This commit adds hardcoded test-only cryptographic credentials used by the Trezor emulator (software simulator) for a new ML-DSA device-attestation feature. It does not change real hardware firmware. The credentials are clearly emulator-only placeholders and are not intended for production devices.

This commit updates the mldsa-native submodule to a new beta version and adjusts the build system and source code to use the new API names and file paths. ML-DSA is a post-quantum digital signature algorithm used for device attestation in production testing. The change itself is a routine dependency/API migration, but because it touches cryptographic verification and key generation code, it warrants a security-aware review. There is no direct evidence in the commit of a vulnerability being fixed.

This commit fixes a bug in how the Trezor hardware wallet's secure chip (Optiga) handles masked digital signatures. The fix changes two things: it now uses the actual returned signature length rather than the maximum buffer size when parsing the signature, and it explicitly uses the NIST P-256 curve instead of a variable curve parameter when removing the masking. The bug could potentially cause signature parsing to fail or behave incorrectly, especially if the returned signature was shorter than the maximum expected size. There is no public statement linking this to an active security vulnerability or attack.

This commit only adds two new optional data fields to an existing device-authentication proof message used in Trezor hardware wallets. It extends the protocol definition and the matching generated code in Python, Rust, and the core firmware so that future firmware can include an MCU (microcontroller) certificate and signature alongside the already-present Optiga and Tropic proofs. The change is additive and does not by itself alter any verification logic, cryptographic checks, or access controls visible in the diff.