Trezor firmware

This commit changes how Trezor firmware passes empty data buffers from Rust code to C code. Previously, an empty Rust slice could produce a pointer that looks like a memory address but points to nothing valid. The patch forces such empty slices to become a standard NULL pointer, which C code is more likely to treat safely. The change is defensive and appears aimed at preventing future bugs or crashes during Rust-to-C communication, rather than fixing an active exploit.

This commit adds safety checks during wallet creation to make sure the randomness used to generate the recovery seed is long enough and not obviously broken. It also aborts the setup process cleanly if something arrives at the wrong time. These are defensive hardening changes rather than a fix for a known active attack.

This commit improves the on-screen display for certain Stellar smart-contract token operations. It lets a connected wallet tell the Trezor device that a contract call is actually a well-known token transfer or approval, so the user sees a friendlier 'Send' or 'Approve' screen instead of raw technical data. The device independently recalculates the token contract address from the hint and only uses the friendly screen if the address matches; a wrong hint falls back to the raw display. The change is a user-experience enhancement, not a fix for a known security flaw.

This commit fixes a user-interface bug in Trezor hardware wallets where the subtitle line on the Stellar cryptocurrency transaction confirmation screen was accidentally dropped. The fix joins the title and subtitle into a single line so users see both pieces of context before signing. It is a UI clarity issue, not a cryptographic or code-execution vulnerability.

This commit fixes a bug in the Trezor hardware wallet's custom transport protocol (THP). Previously, when the device received an incorrect or out-of-order acknowledgment (ACK), it would not advance its internal send state but would still log a generic warning. The fix makes the protocol explicitly reject bad ACK bits and only mark a message as delivered when the ACK bit matches what the device expects. Without the fix, a malformed or replayed ACK could leave the sending side stuck or desynchronized, potentially disrupting communication between the wallet and a host computer.

This commit fixes a bug in the Trezor hardware wallet's THP (Trezor Host Protocol) Rust code. Previously, the device could start retransmitting a message before it had finished sending all the fragments (pieces) of the current message. The fix makes the device wait until the whole message is sent before it retransmits. This could prevent protocol confusion or errors during communication between the Trezor device and a host computer, especially when retries happen due to network or transport issues.

This commit fixes a bug in how the Trezor hardware wallet handles sending data over its USB-like wire protocol. Previously, a single outgoing packet could wait forever for the host to accept it, potentially freezing the device and preventing it from handling other communication channels. The fix adds a 5-second timeout so the device can recover and continue operating. This is a reliability and denial-of-service improvement rather than a fix for theft of funds or keys.

This commit fixes how a Trezor hardware wallet's Rust code handles incoming USB-like packets. Previously, the code resized its receive buffer based on a size value returned after a packet was already accepted, which could lead to incorrect buffer sizing or missed edge cases around packet length. The new code parses the packet's control byte and channel length up front, and only resizes the buffer if the incoming data needs more space. The change is defensive and appears to prevent memory or protocol-handling bugs, but the commit message gives no explicit security claim and no external advisory is supplied.

This commit only adds a new automated test for the Trezor hardware protocol (THP) channel code. It checks that retransmitting a partially sent message does not cause duplicate or extra packets. There is no change to production code, no bug fix, and no security-relevant behavior change in the firmware itself.

This commit adds safety guards to prevent a deliberately weak random-number generator from being included in production firmware builds, and stops emulator builds from being labeled as production builds. It does not by itself fix a vulnerability in shipped code; it is a build-time hardening measure against accidental misconfiguration.

This is a large internal refactor of how Trezor's Rust crypto code handles sensitive memory. It replaces an older pinning-based mechanism with a new 'copy hazard' framework designed to prevent Rust from accidentally duplicating secret data in memory. The change itself is defensive and does not appear to introduce a new vulnerability; rather, it is a hardening measure. However, because it touches low-level cryptographic state handling across many files, any mistake in the new abstraction could theoretically affect how secrets are cleared from memory.

This commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There is no indication in the commit that this fixes a security bug; it appears to be a feature addition enabling BLE functionality on a new device variant.

This commit fixes the firmware build scripts for Trezor's Nordic Bluetooth chip variant so the correct cryptographic hash algorithm (SHA-256) is used when validating firmware images. Previously, the nRF54L-based boards could end up using SHA-512 for the image hash, which would not match the hash algorithm expected by the rest of the Trezor firmware validation chain. That mismatch could prevent the device from accepting legitimate firmware updates or, in a worst-case scenario, create a security inconsistency in how firmware authenticity is checked. The fix moves a hash-algorithm override into a board-specific configuration file and explicitly enables SHA-256 in the bootloader configuration.

This commit is a housekeeping change that reorganizes the feature sections inside 14 Cargo.toml build configuration files. It reorders, renames, and groups feature flags (such as MCU selection, privilege mode, build options, and selectable components) without changing the actual feature names, their meanings, or the underlying source code. There is no indication this affects device behavior or security.

This commit is a large but straightforward internal refactoring: the cryptographic code is moved from one Rust crate (`rtl`) into a new dedicated crate (`crypto`), and all project dependencies are updated to point to the new crate. The actual cryptographic algorithms, build flags, and source files remain the same. There is no indication of a security bug fix or a vulnerability being introduced.

This commit is a code cleanup that moves how Trezor firmware handles fatal errors and shutdowns between its internal software layers. It does not add new user-facing features or change security protections. The main risk is that reorganizing low-level error paths could accidentally introduce a bug, but the diff itself does not show a vulnerability being fixed or introduced.

This is a build-system maintenance change. It ensures an empty Rust bindings file is created even when no bindings are requested, and refactors how generated files are compared and written. There is no user-facing or security-relevant behavior change.

This commit is a routine internal code reorganization. It moves the syslog (system logging) functionality from one Rust module into a new shared 'sys' crate and updates the callers to use the new location. There is no user-facing change, no bug fix, and no security-related behavior change visible in the diff.

This commit removes internal debug-only printing helpers from the Trezor firmware's Rust code. It is a cleanup change with no security relevance: the removed macros were only active when a special 'debug' build feature was enabled, and they were not used in production code paths.

This change is purely about how automated tests are run in the project's build system. It switches Rust unit tests to run through a helper tool called xtask and, as noted by the developer, temporarily disables those Rust unit tests in CI until a later update. There is no change to the actual wallet firmware code that users rely on, and no security vulnerability is introduced by this commit itself.

This commit updates the minimum supported firmware version numbers for four Trezor hardware wallet models in the Python client library. The old values were generic placeholders (2.3.0), and the new values reflect the actual earliest firmware version each device model shipped with. This is a housekeeping change that helps the software correctly identify and handle older or mismatched firmware, but it does not by itself fix a security flaw in the firmware.

This is a code cleanup (refactor) in the Python trezorlib library. It moves Trezor hardware model definitions (names, USB IDs, firmware verification keys, hash settings, UI layout, BLE capability) from several scattered files into one shared module. The actual data values appear unchanged; only the organization of the code changed. There is no indication this fixes a security bug or introduces a vulnerability.

This commit fixes a simple typo in a Python project configuration file. The date for an exception allowing a newer Stellar SDK package had an extra '1' in the day ('2026-07-051'), which is not a valid date. The change corrects it to '2026-07-05'. There is no security issue here—just a formatting fix that lets the build dependency rule work as intended.

This commit fixes a missing constant in Trezor's Python library that talks to hardware wallets over USB HID. The change adds CHUNK_SIZE = 64, which likely restores normal communication with devices. There is no direct evidence in the commit that this is a security vulnerability, and no exploit path is visible from the diff alone.

This commit is purely a documentation update that generates the changelog for version 0.20.2 of the Trezor Python library. It deletes individual changelog fragment files and adds their contents to the main CHANGELOG.md file. No source code, firmware logic, or security behavior is changed.