Trezor firmware

This commit only changes debug log messages shown when a task ends. It makes the messages clearer and skips printing details when a task ended normally with no error. There is no change to how the device operates or to any security behavior.

This commit fixes how the Trezor emulator exits when running the core app. Previously, the emulator thread did not pass along the actual exit code from the finished task, and it skipped the normal cleanup path. Now it calls the standard `systask_exit()` function with the real exit code. This is a code-correctness fix that mainly affects testing and emulator behavior, not a security vulnerability in the hardware wallet itself.

This commit removes a factory-testing command called backup-ram-erase from production builds of Trezor hardware wallets. The command was previously available in both production and non-production (development/test) builds, but should only exist in development builds. It is a hardening/cleanup change rather than a fix for an active exploit, because reaching the production-test command interface already requires physical access and special tooling.

This commit simply deletes an unused helper function called maybe_call() from the Trezor firmware's internal communication code. The function had no remaining callers, so removing it cannot introduce or fix any security issue. It is a routine code cleanup with no user-visible or security-relevant change.

This commit only adds extra debug logging messages that record when a 'ButtonRequest' event is ignored by the Trezor device's user interface code. It does not change program behavior, fix a bug, or alter security logic. There is no indication this is a security patch.

This commit fixes a mismatch in Trezor's Bitcoin Cash address encoding. Previously, the encoder could create addresses with an overly long human-readable prefix (the part before the colon, like 'bitcoincash') that the decoder would later reject as invalid. The patch adds a length check so the encoder refuses to produce addresses that cannot be decoded. It also renames variables and updates comments for clarity, with no functional changes beyond the new length check.

This commit is a test-only UI fix that enables the on-screen menu during automated test runs for two wallet interface layouts. It does not change how real transactions are signed or approved; it only makes sure automated tests can navigate the confirmation screens properly. There is no indication this fixes a security vulnerability.

This commit fixes a UI flow issue in the Trezor firmware's Delizia layout. Specifically, it ensures that transaction summary menus are properly included in the device flow, allowing users to access the menu during confirmation. Without this fix, users may not have been able to view or interact with summary details as intended during transaction signing. There is no direct evidence in the commit that this is a security vulnerability, but missing UI steps in a hardware wallet could theoretically affect user verification of transaction details.

This commit only changes test helper code. It moves calls that exercise on-screen menu items so they happen on every page of a paginated screen, not just the last page. There is no change to the actual Trezor firmware or to how real user transactions are handled, so it does not create or fix a security vulnerability in the device itself.

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. There are no code changes, no bug fixes, and no security-related modifications visible in the diff. It appears to be a routine maintenance update so automated UI tests match the current device output.

This commit is a straightforward internal code cleanup in the Trezor firmware's user-interface code. It replaces a loose pair of values (a notification text string plus a separate numeric 'level') with a single structured 'Notification' type, and gives the numeric levels named constants like ALERT, WARNING, INFO, and SUCCESS. There is no change to security behavior, no bug fix, and no externally visible functional change for users.

This is a documentation-only change inside a Protocol Buffers definition file. It corrects an annotation comment describing which message logically follows DebugLinkSetLogFilter. There is no code, no behavior change, and no security impact.

This commit simply deletes an unused constant named LOCK_TIME from a test configuration file. It does not change any device firmware, wallet logic, or security behavior. There is no security issue here.

This commit is a routine version bump for Trezor firmware and related embedded components. It only changes version numbers in header files and translation metadata. There are no code changes, no bug fixes, and no security-related modifications visible in the diff.

This commit adds new factory-test (prodtest) commands for the Tropic secure chip used in some Trezor devices. It lets authorized production-line tools read and change a reversible chip setting called 'sensors configuration,' and also erase cryptographic slots or dump the whole chip configuration. The change is intended for manufacturing/testing, not normal user wallets, and requires a privileged pairing session. The code itself is not a hidden backdoor, but it does expand what a party with prodtest access can do to the secure chip.

This commit adds a new diagnostic command called optiga-metadata-read to Trezor's production-test firmware. It lets factory/test tooling read metadata from the Optiga secure chip, such as object sizes, access rules, and lifecycle state. It is a read-only debugging feature and does not change any data or access controls. There is no indication in the commit that this fixes a security bug or introduces a vulnerability.

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates Czech, German, Spanish, French, and Portuguese translations, refreshes the cryptographic signature that verifies those translations, and updates the expected screen hashes used in automated UI tests. There is no code that handles secrets, cryptography, network communication, or user authorization, and nothing in the changes suggests a security vulnerability.

This commit only updates expected test screenshots (called UI fixtures) for the Trezor hardware wallet's automated test suite. It adds hashes for two new test cases that check how the device handles invalid or missing credentials for an 'evolu' delegated identity key feature. There is no change to actual device firmware code, cryptography, or user-facing behavior, so it does not introduce or fix a security vulnerability on its own.

This commit changes how a Trezor hardware wallet verifies the computer (host) it is talking to when generating a special delegated identity key. Previously, the host had to send its own public key inside the request message, and the device used that key to check a credential. Now the device fetches the host's public key from its own secure channel cache instead. This is a defensive design improvement: it removes an opportunity for a malicious or buggy caller to supply the wrong public key and potentially trick the device into trusting a credential it shouldn't. The commit also adds tests for missing or invalid credentials.

This change removes a safety check in Trezor's Ethereum staking transaction handling. Previously, the device refused to sign staking/unstaking transactions unless a 'source' parameter was exactly 1 (Trezor's identifier). Now it accepts any source value. This is described by the vendor as a feature to allow staking calls regardless of source, but it weakens a validation gate that helped ensure the transaction was intended for Trezor's staking flow. The change is intentional and documented, but it reduces the device's ability to reject potentially mismatched or unexpected staking contract calls based on source identifier.

This commit fixes a programming bug in the Trezor hardware wallet's production-test code. The bug caused the device to call a debug/trace helper function even when no command-line interface was available, which could lead to a crash (null-pointer dereference) during production testing. The fix simply checks that the helper object exists before using it. This appears limited to internal production-test tooling and is unlikely to affect end-user wallets or real funds.

This commit only speeds up a test-support script by downloading emulator files in parallel instead of one at a time. It does not touch the Trezor firmware, wallet logic, cryptography, or any user-facing security feature. There is no security-relevant change.

This commit only edits four changelog text files. It removes two bug-fix entries that were mistakenly listed under the wrong hardware models (T2B1, T2T1, T3B1, T3T1) because they actually apply only to the T3W1 model. No source code, firmware behavior, or security logic is changed. The underlying fixes themselves are not part of this commit.

This commit simply updates a single timestamp file used for Ethereum network definitions. There is no code change, no security fix, and no user-facing behavior change. It is a routine maintenance/chore commit.

This commit is a documentation-only changelog update for Trezor firmware version 2.9.7. It lists several changes, most notably a security fix for a 'side-channel vulnerability in BIP-39 mnemonic processing.' A side-channel attack is a technique where an attacker infers secret information (like a recovery seed) by observing physical signals such as power consumption, timing, or electromagnetic emissions during cryptographic operations. Because this commit only updates changelogs and does not include the actual code fix, we cannot independently verify the vulnerability's severity or exploitation details from the diff alone. The vendor explicitly labels it as a security issue.