Trezor firmware

This commit reorganizes how a test-only random number generator and certain Bitcoin-related cryptographic error handlers are wired up in the Trezor firmware's Rust crypto code. It moves an insecure PRNG used only in unit tests into its own module and exports it under a detectable name so test builds can find it. It also moves default error callbacks for the secp256k1-zkp library from the Python module layer into the core crypto crate so all users of the crate share them. The change removes a Python ValueError raise for illegal library arguments, replacing it with a system error shutdown. There is no direct evidence in the commit of a vulnerability being fixed; it reads as a refactoring to support testing and a new cryptographic feature (zero-knowledge proofs).

This commit is a code-quality refactor in the Trezor firmware's Rust layer. It introduces a new mutable-slice helper (CSliceMut) and changes the existing CSlice so that empty/NULL slices return an empty Rust slice instead of an optional value that callers had to unwrap. The change is described by the developer as fixing 'obscure provenance bugs' and aligning safety properties. There is no direct evidence in the commit of an exploitable vulnerability; it reads as defensive hardening of the boundary between C and Rust code.

This commit simply adds a new digital signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. It is a routine metadata update with no code changes and no apparent security relevance.

This commit only adds documentation comments to a C header file. No program code was changed, so it cannot introduce or fix a security bug by itself. The comments describe how the storage API is already supposed to behave, including rules about which pointer arguments may be NULL.

This commit tightens a safety check in the Trezor hardware wallet's user-interface code. It makes sure that a small on-screen menu component can hold at least as many items as the firmware might ever ask it to display, preventing a capacity mismatch that could crash the device when a user is choosing recovery-seed word counts or similar options. There is no direct evidence in the commit that this crash was exploitable to steal funds or bypass security.

This commit is a straightforward internal code cleanup. It moves two configuration constants between header files to remove a circular include dependency between the flash and storage modules. There is no user-facing change, no bug fix, and no security-sensitive behavior change.

This commit fixes a capacity mismatch in the Trezor hardware wallet's on-screen menus. A global limit allowed up to 6 menu entries, but the internal storage for two menu layouts only held 5. When a 6-item menu was built, the code would panic (crash) instead of showing the menu. The patch raises both storage capacities to 6 and adds compile-time checks so the bug cannot silently recur if the global limit is changed again. The crash is a denial-of-service issue for the device UI, not a direct theft-of-funds vulnerability.

This commit simply advertises that Trezor Model T / Core devices support a new Ethereum feature called EIP-7702 when a host asks the device for its capabilities. It does not change how transactions are signed, authorized, or validated. There is no security-relevant behavior change.

This commit fixes a bug in the Trezor firmware's translation system where looking up a special 'sentinel' (end-marker) value could cause the device to crash (panic). The fix changes the code to safely check whether the next entry exists before reading it, returning 'not found' instead of crashing. A test was added to confirm the sentinel lookup no longer panics.

This commit is a routine housekeeping change that swaps the Python code-formatting tools used in the project from `black` and `isort` to `ruff`. It updates configuration files, build scripts, and reformats many source files to match the new tool's style. There is no change to what the software actually does, no new features, and no indication of any security problem or fix.

This commit is a code cleanup in the Trezor firmware's user-interface layer. It moves a small 'menu item intent' type to a better location, fixes a minor error-handling inconsistency, and reorders some on-screen menu entries so the cancel option appears first. There is no direct evidence this fixes an exploitable security vulnerability, but the reordering could be a defensive usability improvement to prevent accidental destructive actions.

This commit fixes a bug in the Trezor emulator's Bluetooth-over-UDP code. Previously, if a caller asked to read a Bluetooth packet into a buffer smaller than a full packet, the emulator would silently throw away the leftover data. Now it refuses short reads up front, matching a fix already made in the real hardware driver. The commit message says no real callers were affected because all normal callers use full-size buffers.

This commit fixes a bug in the Bluetooth code of Trezor hardware wallets. When a program asked to read a Bluetooth packet using a buffer that was too small, the code would first remove the packet from the receive queue and only then realize the buffer was too small. Because the removed packet was not put back, it was silently lost. The fix checks the buffer size before removing the packet, so an undersized read now simply reports 'nothing available' instead of destroying data. The commit notes that the only realistic way to trigger this is an applet making a direct system call with a too-small buffer, which would cause that applet to lose packets meant for it.

This commit fixes a potential buffer overflow in the Bluetooth Low Energy (BLE) read function of the Trezor hardware wallet firmware. Previously, the function trusted the caller's claim about how large the buffer was, which could allow more data to be written into a smaller memory area than intended. The fix makes the function use the actual buffer size instead, removing that trust relationship and preventing a possible overflow.

This commit fixes a bug in the Trezor hardware wallet's code that talks to the nRF wireless chip over SPI. The code read the first byte of a received message to decide what kind of response it was, without first checking whether any bytes had actually been received. For two important response types—device info and authentication data—it then marked the data as 'valid' before copying it. A zero-length or truncated message could therefore make the device believe it had received valid authentication data when it had not. The device 'fails closed' (it does not unlock anything from bad data), but the bug could still let an empty or truncated frame influence the boot-time authentication check, which is not a safe design. The fix requires the full expected payload length before marking anything valid and moves the 'valid' flag to after the copy.

This commit changes how the Trezor hardware wallet handles FIDO2/WebAuthn 'silent authentication' attempts. When a website asks for authentication without user confirmation (user presence=false), Trezor now returns a fake signature and a fixed counter value of 0, instead of advancing the real signature counter. Previously, the code advanced the real counter even when returning a fake signature. The change prevents the real counter from leaking or being consumed during silent authentication attempts, which is a minor privacy and state-consistency improvement.

This commit fixes a bug in the Trezor hardware wallet's firmware update code for the nRF wireless chip. The code reads update image headers from an untrusted source and calculates where to look for a SHA-256 hash inside the image. Before the fix, the calculation used a signed offset type and did not check whether the claimed image size was larger than the actual buffer. A malicious or malformed update image could make the offset wrap around (become a small number due to integer overflow), bypassing later safety checks and potentially causing the device to read memory outside the intended buffer. The fix rejects images whose claimed size exceeds the buffer and uses an unsigned type for the offset calculation.

This commit is a user-interface polish change for the Trezor hardware wallet. It replaces a static text label on the device homescreen with a scrolling 'marquee' label so that longer text (such as a wallet name) can be read even if it does not fit in the available space. There is no security-relevant change here.

This commit rewrites the handling of externally downloaded coin/network definitions from Python into Rust. It moves parsing, signature verification, and protobuf decoding into a new Rust module. The change is described by the vendor as a non-security refactor ('RIIR' = 'Rewrite It In Rust') with no changelog entry. The diff itself does not introduce obvious new vulnerabilities, but it is a partial refactor: the Python side now delegates most validation to Rust, and some safety comments rely on assumptions about MicroPython not mutating buffers. There is no vendor statement that this is a security fix or that it addresses a reported vulnerability.

This commit is purely a code-style cleanup. It replaces older Python type-hint syntax (t.Dict, t.Tuple, typing.Iterable) with newer built-in equivalents (dict, tuple, collections.abc.Iterable). No behavior, logic, or security properties of the code were changed.

This update fixes a validation gap in the Trezor hardware wallet's Advanced Shamir backup setup. Previously, the device could accept malformed backup settings (such as too many groups or invalid member counts) and end up stuck in a 'Backup failed' state. The fix adds earlier checks so bad settings are rejected before the device commits to the backup process.

This commit adds a new build-time feature flag called 'miniscript' to the Trezor firmware. It does not implement any actual Miniscript functionality yet; it only creates the scaffolding (a new MicroPython module placeholder, build options, and CI test configurations) so future Miniscript work can be developed without affecting production firmware builds. There is no security-relevant code change here.

This commit only changes automated test code for Trezor hardware wallets. It updates passphrase tests to use the widest keyboard character ('W' instead of 'a') and adds a step to reveal the hidden passphrase during testing. There is no change to the actual wallet firmware or production code, so it does not create a security vulnerability or fix one in shipped software.

This commit only changes the wording of one on-screen message in the Trezor firmware. For the 'Eckhart' design theme, the text 'Cancel sign.' is changed to 'Cancel sign?' (and equivalent changes in Czech, German, Spanish, French, and Portuguese). It is a cosmetic localization tweak with no security effect.

This commit fixes a bug in how Trezor hardware wallets decode Bitcoin Cash-style 'cashaddr' addresses. Previously, a malformed address could cause the device to hit an internal 'IndexError' and show a confusing message. The fix ensures the address is properly validated and returns a clear 'invalid address' error instead. There is no direct evidence in the commit that this could be used to steal funds, but it improves robustness against bad or maliciously crafted addresses.