Trezor firmware

This commit fixes a bug in the Trezor emulator's Bluetooth-over-UDP code. Previously, if a caller asked to read a Bluetooth packet into a buffer smaller than a full packet, the emulator would silently throw away the leftover data. Now it refuses short reads up front, matching a fix already made in the real hardware driver. The commit message says no real callers were affected because all normal callers use full-size buffers.

This commit fixes a bug in the Bluetooth code of Trezor hardware wallets. When a program asked to read a Bluetooth packet using a buffer that was too small, the code would first remove the packet from the receive queue and only then realize the buffer was too small. Because the removed packet was not put back, it was silently lost. The fix checks the buffer size before removing the packet, so an undersized read now simply reports 'nothing available' instead of destroying data. The commit notes that the only realistic way to trigger this is an applet making a direct system call with a too-small buffer, which would cause that applet to lose packets meant for it.

This commit fixes a potential buffer overflow in the Bluetooth Low Energy (BLE) read function of the Trezor hardware wallet firmware. Previously, the function trusted the caller's claim about how large the buffer was, which could allow more data to be written into a smaller memory area than intended. The fix makes the function use the actual buffer size instead, removing that trust relationship and preventing a possible overflow.

This commit fixes a bug in the Trezor hardware wallet's code that talks to the nRF wireless chip over SPI. The code read the first byte of a received message to decide what kind of response it was, without first checking whether any bytes had actually been received. For two important response types—device info and authentication data—it then marked the data as 'valid' before copying it. A zero-length or truncated message could therefore make the device believe it had received valid authentication data when it had not. The device 'fails closed' (it does not unlock anything from bad data), but the bug could still let an empty or truncated frame influence the boot-time authentication check, which is not a safe design. The fix requires the full expected payload length before marking anything valid and moves the 'valid' flag to after the copy.

This commit changes how the Trezor hardware wallet handles FIDO2/WebAuthn 'silent authentication' attempts. When a website asks for authentication without user confirmation (user presence=false), Trezor now returns a fake signature and a fixed counter value of 0, instead of advancing the real signature counter. Previously, the code advanced the real counter even when returning a fake signature. The change prevents the real counter from leaking or being consumed during silent authentication attempts, which is a minor privacy and state-consistency improvement.

This commit fixes a bug in the Trezor hardware wallet's firmware update code for the nRF wireless chip. The code reads update image headers from an untrusted source and calculates where to look for a SHA-256 hash inside the image. Before the fix, the calculation used a signed offset type and did not check whether the claimed image size was larger than the actual buffer. A malicious or malformed update image could make the offset wrap around (become a small number due to integer overflow), bypassing later safety checks and potentially causing the device to read memory outside the intended buffer. The fix rejects images whose claimed size exceeds the buffer and uses an unsigned type for the offset calculation.

This commit is a user-interface polish change for the Trezor hardware wallet. It replaces a static text label on the device homescreen with a scrolling 'marquee' label so that longer text (such as a wallet name) can be read even if it does not fit in the available space. There is no security-relevant change here.

This commit is purely a code-style cleanup. It replaces older Python type-hint syntax (t.Dict, t.Tuple, typing.Iterable) with newer built-in equivalents (dict, tuple, collections.abc.Iterable). No behavior, logic, or security properties of the code were changed.

This update fixes a validation gap in the Trezor hardware wallet's Advanced Shamir backup setup. Previously, the device could accept malformed backup settings (such as too many groups or invalid member counts) and end up stuck in a 'Backup failed' state. The fix adds earlier checks so bad settings are rejected before the device commits to the backup process.

This commit adds a new build-time feature flag called 'miniscript' to the Trezor firmware. It does not implement any actual Miniscript functionality yet; it only creates the scaffolding (a new MicroPython module placeholder, build options, and CI test configurations) so future Miniscript work can be developed without affecting production firmware builds. There is no security-relevant code change here.

This commit only changes automated test code for Trezor hardware wallets. It updates passphrase tests to use the widest keyboard character ('W' instead of 'a') and adds a step to reveal the hidden passphrase during testing. There is no change to the actual wallet firmware or production code, so it does not create a security vulnerability or fix one in shipped software.

This commit fixes a bug in how Trezor hardware wallets decode Bitcoin Cash-style 'cashaddr' addresses. Previously, a malformed address could cause the device to hit an internal 'IndexError' and show a confusing message. The fix ensures the address is properly validated and returns a clear 'invalid address' error instead. There is no direct evidence in the commit that this could be used to steal funds, but it improves robustness against bad or maliciously crafted addresses.

This commit adds support for a new 'version 2' format for external definitions in Trezor firmware. The key change is that version 2 requires only one cryptographic signature to validate a definition, whereas version 1 required two. This is a deliberate design change, not a bug, but it reduces the number of independent parties that must sign off before a definition is trusted by the device. The commit does not by itself introduce an exploit, but it lowers the bar for an attacker who could compromise a single signing key or signer.

This is a UI graphics bug fix in the Trezor hardware wallet firmware. When drawing a circular progress indicator or pie-chart-like shape spanning a full 360 degrees, the code mistakenly treated it as an empty slice and drew nothing. The patch detects a full-circle span before normalizing the angles and forces it to draw all eight segments plus the center pixel. There is no direct security vulnerability here; it is a rendering correctness fix.

This commit adds a new informational field to the Trezor device's 'Features' message that tells connected software the maximum passphrase length the device supports. It does not change how passphrases are validated or stored, and it does not fix any known security bug. It is a feature addition to improve compatibility between different Trezor models and wallet software.

This commit simply raises the maximum allowed passphrase length on newer Trezor Core devices from 50 bytes to 128 bytes. It is a feature change, not a security fix or vulnerability. Older and legacy models keep the 50-byte limit. The change is accompanied by updated tests and a new device capability field so software can read the current limit.

This is a harmless user-interface wording change. It swaps the label shown beneath two backup-related menu items from a generic 'Review' translation key to a dedicated 'Review' button translation key, and adds that button text to the English translation file. There is no security relevance.

This commit simply deletes an unused helper function called confirm_amount from four different user-interface layout files. Because the function was not being called anywhere, removing it cannot change device behavior or introduce a security issue. It is a routine code cleanup.

This commit fixes a function that shuffles arrays (like recovery-seed word order or on-screen PIN layouts) in Trezor's cryptographic code. The original code could misbehave or even crash when given very short or very long inputs, and it used a signed integer type that could turn negative in unexpected ways. The patch adds a safety check, skips shuffling when there is nothing to shuffle, and uses the correct unsigned type. The practical security impact is moderate: it removes a source of non-random or buggy shuffling that could leak information or cause crashes, but the commit itself does not claim to fix an active exploit.

This change removes unused error-message text from the bootloader's copy of the nanopb library to free up about 1 kB of flash storage. The bootloader never looked at these error strings anyway, so the change is a size optimization with no security effect.

This commit only adds new automated tests and a helper script for generating test data. It does not change the firmware's random number generator, wallet operations, or any user-facing behavior. The goal is to catch future bugs where a hardware model's entropy source might accidentally be left out of the strong randomness mix.

This commit adds deterministic (predictable) fake random-number generators for Trezor's software emulator only, so automated tests can reproduce exact outputs. It removes the old insecure-prng feature flag from production build paths and gates the new mocks behind emulator-only compile checks. The change is designed to keep fake randomness out of real hardware wallets, but it still increases the amount of insecure-prng code in the repository.

This commit simply increases the maximum size of a commonly used short text buffer in the Trezor firmware from 50 bytes to 128 bytes. The stated purpose is to support longer passphrases on Trezor Core devices, while keeping the PIN length limit at 50 bytes. There is no indication in the commit that this fixes a security vulnerability or introduces a security-relevant bug.

This commit is a routine code cleanup that updates Python type annotations to follow a newer Python style guide (PEP 585). It replaces older-style imports like `List`, `Tuple`, and `Dict` from the `typing` module with built-in equivalents like `list`, `tuple`, and `dict`. It also adjusts the project's linting configuration to enforce this style. There is no change to runtime behavior, no security fix, and no vulnerability introduced.

This commit is a routine code cleanup that updates Python type annotations to a newer, recommended style (PEP 585). It does not change any program logic, security behavior, or runtime functionality. There is no security issue here.