Add tests for get_merkleized_map and get_merkleized_map_value

diff --git a/unit-tests/CMakeLists.txt b/unit-tests/CMakeLists.txt
index 1ad143f..2e457db 100644
--- a/unit-tests/CMakeLists.txt
+++ b/unit-tests/CMakeLists.txt
@@ -64,6 +64,8 @@ add_executable(test_get_merkle_leaf_index test_get_merkle_leaf_index.c)
 add_executable(test_stream_preimage test_stream_preimage.c)
 add_executable(test_stream_merkle_leaf_element test_stream_merkle_leaf_element.c)
 add_executable(test_stream_merkleized_map_value test_stream_merkleized_map_value.c)
+add_executable(test_get_merkleized_map test_get_merkleized_map.c)
+add_executable(test_get_merkleized_map_value test_get_merkleized_map_value.c)
 
 # add_executable(test_crypto test_crypto.c)
 
@@ -91,6 +93,8 @@ add_library(merkle SHARED ../src/common/merkle.c)
 add_library(stream_merkle_leaf_element SHARED ../src/handler/lib/stream_merkle_leaf_element.c)
 add_library(stream_preimage SHARED ../src/handler/lib/stream_preimage.c)
 add_library(stream_merkleized_map_value SHARED ../src/handler/lib/stream_merkleized_map_value.c)
+add_library(get_merkleized_map SHARED ../src/handler/lib/get_merkleized_map.c)
+add_library(get_merkleized_map_value SHARED ../src/handler/lib/get_merkleized_map_value.c)
 add_library(parser SHARED ../src/common/parser_ext.c)
 add_library(read SHARED $ENV{BOLOS_SDK}/lib_standard_app/read.c)
 add_library(script SHARED ../src/common/script.c)
@@ -108,6 +112,8 @@ target_include_directories(mock_dispatcher PRIVATE ../src/handler ../src/handler
 target_include_directories(stream_merkle_leaf_element PRIVATE ../src/handler ../src/handler/lib ../src/common)
 target_include_directories(stream_preimage PRIVATE ../src/handler ../src/handler/lib)
 target_include_directories(stream_merkleized_map_value PRIVATE ../src/handler ../src/handler/lib ../src/common)
+target_include_directories(get_merkleized_map PRIVATE ../src/handler ../src/handler/lib ../src/common)
+target_include_directories(get_merkleized_map_value PRIVATE ../src/handler ../src/handler/lib ../src/common)
 target_include_directories(test_extract_bip32_derivation PRIVATE ../src/handler ../src/handler/lib ../src/handler/sign_psbt ../src/common)
 target_include_directories(get_merkle_leaf_element PRIVATE ../src/handler ../src/handler/lib ../src/common)
 target_include_directories(get_merkle_preimage PRIVATE ../src/handler ../src/handler/lib ../src/common)
@@ -123,6 +129,8 @@ target_include_directories(test_get_merkle_leaf_index PRIVATE ../src/handler ../
 target_include_directories(test_stream_preimage PRIVATE ../src/handler ../src/handler/lib ../src/common)
 target_include_directories(test_stream_merkle_leaf_element PRIVATE ../src/handler ../src/handler/lib ../src/common)
 target_include_directories(test_stream_merkleized_map_value PRIVATE ../src/handler ../src/handler/lib ../src/common)
+target_include_directories(test_get_merkleized_map PRIVATE ../src/handler ../src/handler/lib ../src/common)
+target_include_directories(test_get_merkleized_map_value PRIVATE ../src/handler ../src/handler/lib ../src/common)
 
 # Mock libraries
 target_link_libraries(crypto_mocks PUBLIC sha256)
@@ -147,6 +155,8 @@ target_link_libraries(test_get_merkle_leaf_index PUBLIC cmocka gcov mock_dispatc
 target_link_libraries(test_stream_preimage PUBLIC cmocka gcov mock_dispatcher cx_hash_mock sha256 buffer buffer_ext varint read write bip32 merkle stream_preimage psbt_parse)
 target_link_libraries(test_stream_merkle_leaf_element PUBLIC cmocka gcov mock_dispatcher cx_hash_mock sha256 buffer buffer_ext varint read write bip32 merkle stream_merkle_leaf_element get_merkle_leaf_hash stream_preimage psbt_parse)
 target_link_libraries(test_stream_merkleized_map_value PUBLIC cmocka gcov mock_dispatcher cx_hash_mock sha256 buffer buffer_ext varint read write bip32 merkle stream_merkleized_map_value stream_merkle_leaf_element get_merkle_leaf_hash get_merkle_leaf_index stream_preimage psbt_parse)
+target_link_libraries(test_get_merkleized_map PUBLIC cmocka gcov mock_dispatcher cx_hash_mock sha256 buffer buffer_ext varint read write bip32 merkle get_merkleized_map check_merkle_tree_sorted get_merkle_leaf_element get_merkle_leaf_hash get_merkle_preimage stream_preimage psbt_parse)
+target_link_libraries(test_get_merkleized_map_value PUBLIC cmocka gcov mock_dispatcher cx_hash_mock sha256 buffer buffer_ext varint read write bip32 merkle get_merkleized_map_value get_merkle_leaf_element get_merkle_leaf_hash get_merkle_leaf_index get_merkle_preimage stream_preimage psbt_parse)
 
 # target_link_libraries(test_crypto PUBLIC cmocka gcov crypto)
 add_test(test_bitvector test_bitvector)
@@ -166,5 +176,7 @@ add_test(test_get_merkle_leaf_index test_get_merkle_leaf_index)
 add_test(test_stream_preimage test_stream_preimage)
 add_test(test_stream_merkle_leaf_element test_stream_merkle_leaf_element)
 add_test(test_stream_merkleized_map_value test_stream_merkleized_map_value)
+add_test(test_get_merkleized_map test_get_merkleized_map)
+add_test(test_get_merkleized_map_value test_get_merkleized_map_value)
 
 # add_test(test_crypto test_crypto)
diff --git a/unit-tests/test_get_merkleized_map.c b/unit-tests/test_get_merkleized_map.c
new file mode 100644
index 0000000..77938a5
--- /dev/null
+++ b/unit-tests/test_get_merkleized_map.c
@@ -0,0 +1,479 @@
+/**
+ * Unit tests for call_get_merkleized_map_with_callback (and the
+ * call_get_merkleized_map convenience wrapper) using the mock dispatcher.
+ *
+ * Tests verify that the function correctly:
+ *  - Fetches the index-th element of a tree of serialized map commitments,
+ *    decodes it into a merkleized_map_commitment_t, and validates that the
+ *    inner keys tree is sorted.
+ *  - Invokes the optional element callback once per key when validating.
+ *  - Propagates errors from the underlying merkle leaf retrieval, the
+ *    deserialization of the commitment, and the sorted-keys check.
+ */
+
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <cmocka.h>
+
+/* SDK mock stubs */
+unsigned int pic(unsigned int linked_address) {
+    return linked_address;
+}
+#undef PIC
+#define PIC(x) (x)
+
+#include "mock_dispatcher.h"
+#include "cx_hash_mock.h"
+#include "sha-256.h"
+
+#include "buffer.h"
+#include "varint.h"
+#include "client_commands.h"
+#include "common/merkle.h"
+#include "handler/lib/get_merkleized_map.h"
+
+/* ---------- Helpers ---------- */
+
+/**
+ * Serialize a merkleized map commitment to the canonical byte layout
+ *   varint(size) || keys_root[32] || values_root[32]
+ */
+static size_t serialize_commitment(const merkleized_map_commitment_t *c, uint8_t *out) {
+    int vlen = varint_write(out, 0, c->size);
+    memcpy(out + vlen, c->keys_root, 32);
+    memcpy(out + vlen + 32, c->values_root, 32);
+    return (size_t) vlen + 64;
+}
+
+/* ---------- Callback tracking ---------- */
+
+#define MAX_CALLBACK_CALLS 32
+
+typedef struct {
+    size_t n_calls;
+    int indices[MAX_CALLBACK_CALLS];
+    uint8_t elements[MAX_CALLBACK_CALLS][64];
+    size_t element_lens[MAX_CALLBACK_CALLS];
+    const merkleized_map_commitment_t *received_commitment;
+} callback_tracker_t;
+
+static void tracking_callback(dispatcher_context_t *dc,
+                              void *state,
+                              const merkleized_map_commitment_t *map_commitment,
+                              int index,
+                              buffer_t *buf) {
+    (void) dc;
+
+    callback_tracker_t *tracker = (callback_tracker_t *) state;
+    assert_true(tracker->n_calls < MAX_CALLBACK_CALLS);
+
+    tracker->received_commitment = map_commitment;
+    size_t i = tracker->n_calls++;
+    tracker->indices[i] = index;
+    size_t len = buf->size - buf->offset;
+    assert_true(len <= sizeof(tracker->elements[0]));
+    memcpy(tracker->elements[i], buf->ptr + buf->offset, len);
+    tracker->element_lens[i] = len;
+}
+
+/* ---------- Test cases ---------- */
+
+/**
+ * Happy path: a single map with one key-value pair, registered as the
+ * only element of an outer "tree-of-maps".
+ */
+static void test_get_map_single_outer_single_inner(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01};
+    const uint8_t value[] = {0xAA, 0xBB};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t inner;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &inner);
+
+    /* Build the tree of (one) serialized commitment. */
+    uint8_t commitment_buf[1 + 64];
+    size_t commitment_len = serialize_commitment(&inner, commitment_buf);
+    const uint8_t *outer_elems[] = {commitment_buf};
+    const size_t outer_lens[] = {commitment_len};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map(dc, outer_root, 1, 0, &got);
+
+    assert_int_equal(result, 0);
+    assert_int_equal((int) got.size, 1);
+    assert_memory_equal(got.keys_root, inner.keys_root, 32);
+    assert_memory_equal(got.values_root, inner.values_root, 32);
+}
+
+/**
+ * Happy path: a tree of three maps, fetch each by index and verify the
+ * decoded commitment matches the inner map registered with the mock.
+ */
+static void test_get_map_multiple_outer(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    /* Build three distinct inner maps. */
+    merkleized_map_commitment_t inners[3];
+    for (size_t i = 0; i < 3; i++) {
+        uint8_t k[2] = {(uint8_t) i, 0x00};
+        uint8_t v[2] = {(uint8_t) (0x10 + i), 0x01};
+        const uint8_t *ks[] = {k};
+        const size_t kls[] = {sizeof(k)};
+        const uint8_t *vs[] = {v};
+        const size_t vls[] = {sizeof(v)};
+        mock_dispatcher_add_map(mock, ks, kls, vs, vls, 1, &inners[i]);
+    }
+
+    /* Serialize commitments and register them as the outer list. */
+    uint8_t bufs[3][1 + 64];
+    size_t lens[3];
+    const uint8_t *ptrs[3];
+    for (size_t i = 0; i < 3; i++) {
+        lens[i] = serialize_commitment(&inners[i], bufs[i]);
+        ptrs[i] = bufs[i];
+    }
+    mock_dispatcher_add_list(mock, ptrs, lens, 3);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+
+    for (size_t i = 0; i < 3; i++) {
+        merkleized_map_commitment_t got;
+        int result = call_get_merkleized_map(dc, outer_root, 3, (int) i, &got);
+        assert_int_equal(result, 0);
+        assert_int_equal((int) got.size, 1);
+        assert_memory_equal(got.keys_root, inners[i].keys_root, 32);
+        assert_memory_equal(got.values_root, inners[i].values_root, 32);
+    }
+}
+
+/**
+ * Happy path: an inner map with multiple sorted keys, fetched with a
+ * callback. The callback must be invoked once per key, in order.
+ */
+static void test_get_map_with_callback(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t k0[] = {0x01};
+    const uint8_t k1[] = {0x02};
+    const uint8_t k2[] = {0x03};
+    const uint8_t v0[] = {0xA0};
+    const uint8_t v1[] = {0xB0};
+    const uint8_t v2[] = {0xC0};
+
+    const uint8_t *keys[] = {k0, k1, k2};
+    const size_t key_lens[] = {sizeof(k0), sizeof(k1), sizeof(k2)};
+    const uint8_t *values[] = {v0, v1, v2};
+    const size_t value_lens[] = {sizeof(v0), sizeof(v1), sizeof(v2)};
+
+    merkleized_map_commitment_t inner;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 3, &inner);
+
+    uint8_t commitment_buf[1 + 64];
+    size_t commitment_len = serialize_commitment(&inner, commitment_buf);
+    const uint8_t *outer_elems[] = {commitment_buf};
+    const size_t outer_lens[] = {commitment_len};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    callback_tracker_t tracker;
+    memset(&tracker, 0, sizeof(tracker));
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map_with_callback(dc,
+                                                       &tracker,
+                                                       outer_root,
+                                                       1,
+                                                       0,
+                                                       tracking_callback,
+                                                       &got);
+
+    assert_int_equal(result, 0);
+    assert_int_equal(tracker.n_calls, 3);
+    /* The callback must receive a pointer to the out commitment */
+    assert_ptr_equal(tracker.received_commitment, &got);
+    /* Callback receives keys in sorted order */
+    for (size_t i = 0; i < 3; i++) {
+        assert_int_equal(tracker.indices[i], (int) i);
+        assert_int_equal(tracker.element_lens[i], 1);
+    }
+    assert_int_equal(tracker.elements[0][0], 0x01);
+    assert_int_equal(tracker.elements[1][0], 0x02);
+    assert_int_equal(tracker.elements[2][0], 0x03);
+}
+
+/**
+ * Happy path: a map with size = 0 (no keys). The sorted-keys check
+ * trivially succeeds and the callback is never invoked.
+ */
+static void test_get_map_empty_inner(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    /* Build an empty commitment manually: size=0, keys_root and values_root
+     * are arbitrary (they are not consulted because size=0). */
+    merkleized_map_commitment_t inner;
+    inner.size = 0;
+    memset(inner.keys_root, 0, 32);
+    memset(inner.values_root, 0, 32);
+
+    uint8_t commitment_buf[1 + 64];
+    size_t commitment_len = serialize_commitment(&inner, commitment_buf);
+    const uint8_t *outer_elems[] = {commitment_buf};
+    const size_t outer_lens[] = {commitment_len};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    callback_tracker_t tracker;
+    memset(&tracker, 0, sizeof(tracker));
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map_with_callback(dc,
+                                                       &tracker,
+                                                       outer_root,
+                                                       1,
+                                                       0,
+                                                       tracking_callback,
+                                                       &got);
+
+    assert_int_equal(result, 0);
+    assert_int_equal((int) got.size, 0);
+    assert_int_equal(tracker.n_calls, 0);
+}
+
+/**
+ * Error: invalid outer index (out of range). The underlying
+ * call_get_merkle_leaf_element fails and the error must be propagated.
+ */
+static void test_get_map_outer_index_out_of_range(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01};
+    const uint8_t value[] = {0xAA};
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t inner;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &inner);
+
+    uint8_t commitment_buf[1 + 64];
+    size_t commitment_len = serialize_commitment(&inner, commitment_buf);
+    const uint8_t *outer_elems[] = {commitment_buf};
+    const size_t outer_lens[] = {commitment_len};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    /* Index 5 is past the end of the 1-element outer tree. */
+    int result = call_get_merkleized_map(dc, outer_root, 1, 5, &got);
+    assert_true(result < 0);
+}
+
+/**
+ * Error: the leaf element is too short to contain a valid serialized
+ * commitment (varint + 32 + 32 bytes). The mock returns a known leaf, but
+ * the test registers a leaf shorter than the minimum length, so the
+ * varint/bytes reads must fail and call_get_merkleized_map returns -1.
+ */
+static void test_get_map_truncated_commitment(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    /* Only 33 bytes: varint(=1) + 32 bytes of "keys_root" but no values_root. */
+    uint8_t truncated[1 + 32];
+    truncated[0] = 0x01;
+    memset(truncated + 1, 0xAB, 32);
+
+    const uint8_t *outer_elems[] = {truncated};
+    const size_t outer_lens[] = {sizeof(truncated)};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map(dc, outer_root, 1, 0, &got);
+    assert_true(result < 0);
+}
+
+/**
+ * Error: the leaf element is empty (0 bytes), so buffer_read_varint fails
+ * on the very first byte.
+ */
+static void test_get_map_empty_commitment(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    /* A single empty leaf element. */
+    const uint8_t *outer_elems[] = {(const uint8_t *) ""};
+    const size_t outer_lens[] = {0};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map(dc, outer_root, 1, 0, &got);
+    assert_true(result < 0);
+}
+
+/**
+ * Error: the leaf element contains a valid varint but no keys_root bytes.
+ * buffer_read_bytes for keys_root fails.
+ */
+static void test_get_map_commitment_missing_keys_root(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    /* Single byte 0x05: varint size = 5, then nothing more. */
+    const uint8_t leaf[] = {0x05};
+    const uint8_t *outer_elems[] = {leaf};
+    const size_t outer_lens[] = {sizeof(leaf)};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map(dc, outer_root, 1, 0, &got);
+    assert_true(result < 0);
+}
+
+/**
+ * Error: the inner keys tree is not sorted. We craft a commitment whose
+ * keys_root points to a tree we built manually with unsorted keys, so the
+ * sorted-keys check at the end of call_get_merkleized_map_with_callback
+ * must fail.
+ */
+static void test_get_map_inner_unsorted_keys(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    /* Build a keys tree with keys in DESCENDING order. */
+    const uint8_t k0[] = {0x03};
+    const uint8_t k1[] = {0x02};
+    const uint8_t k2[] = {0x01};
+    const uint8_t *keys[] = {k0, k1, k2};
+    const size_t key_lens[] = {1, 1, 1};
+    mock_dispatcher_add_list(mock, keys, key_lens, 3);
+    uint8_t keys_root[32];
+    memcpy(keys_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    /* Build an unrelated values tree (its content is not checked). */
+    const uint8_t v0[] = {0xA0};
+    const uint8_t v1[] = {0xB0};
+    const uint8_t v2[] = {0xC0};
+    const uint8_t *values[] = {v0, v1, v2};
+    const size_t value_lens[] = {1, 1, 1};
+    mock_dispatcher_add_list(mock, values, value_lens, 3);
+    uint8_t values_root[32];
+    memcpy(values_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    merkleized_map_commitment_t inner;
+    inner.size = 3;
+    memcpy(inner.keys_root, keys_root, 32);
+    memcpy(inner.values_root, values_root, 32);
+
+    uint8_t commitment_buf[1 + 64];
+    size_t commitment_len = serialize_commitment(&inner, commitment_buf);
+    const uint8_t *outer_elems[] = {commitment_buf};
+    const size_t outer_lens[] = {commitment_len};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map(dc, outer_root, 1, 0, &got);
+    assert_true(result < 0);
+}
+
+/**
+ * Adversarial: client corrupts the leaf hash returned in the merkle proof
+ * for the outer tree-of-maps. The merkle proof verification must fail
+ * inside call_get_merkle_leaf_element, propagating an error.
+ */
+static int tamper_corrupt_outer_proof(uint8_t *response_buf,
+                                      size_t *response_len,
+                                      uint8_t cmd,
+                                      int call_count,
+                                      void *user_data) {
+    (void) user_data;
+    (void) call_count;
+
+    if (cmd == CCMD_GET_MERKLE_LEAF_PROOF && *response_len >= 32) {
+        response_buf[5] ^= 0x01;
+    }
+    return 0;
+}
+
+static void test_get_map_corrupted_outer_proof(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01};
+    const uint8_t value[] = {0xAA};
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t inner;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &inner);
+
+    uint8_t commitment_buf[1 + 64];
+    size_t commitment_len = serialize_commitment(&inner, commitment_buf);
+    const uint8_t *outer_elems[] = {commitment_buf};
+    const size_t outer_lens[] = {commitment_len};
+    mock_dispatcher_add_list(mock, outer_elems, outer_lens, 1);
+    uint8_t outer_root[32];
+    memcpy(outer_root, mock->trees[mock->n_trees - 1].root, 32);
+
+    mock_dispatcher_set_tamper_hook(mock, tamper_corrupt_outer_proof, NULL);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    merkleized_map_commitment_t got;
+    int result = call_get_merkleized_map(dc, outer_root, 1, 0, &got);
+    assert_true(result < 0);
+}
+
+/* ---------- Main ---------- */
+
+int main(void) {
+#define T(fn) cmocka_unit_test_setup_teardown(fn, mock_dispatcher_setup, mock_dispatcher_teardown)
+    const struct CMUnitTest tests[] = {
+        T(test_get_map_single_outer_single_inner),
+        T(test_get_map_multiple_outer),
+        T(test_get_map_with_callback),
+        T(test_get_map_empty_inner),
+        T(test_get_map_outer_index_out_of_range),
+        T(test_get_map_truncated_commitment),
+        T(test_get_map_empty_commitment),
+        T(test_get_map_commitment_missing_keys_root),
+        T(test_get_map_inner_unsorted_keys),
+        T(test_get_map_corrupted_outer_proof),
+    };
+#undef T
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}
diff --git a/unit-tests/test_get_merkleized_map_value.c b/unit-tests/test_get_merkleized_map_value.c
new file mode 100644
index 0000000..f9452e6
--- /dev/null
+++ b/unit-tests/test_get_merkleized_map_value.c
@@ -0,0 +1,374 @@
+/**
+ * Unit tests for call_get_merkleized_map_value (and the
+ * call_get_merkleized_map_value_u32_le convenience wrapper) using the
+ * mock dispatcher.
+ *
+ * call_get_merkleized_map_value looks up a key in a merkleized key-value
+ * map (by finding its index via Merkle leaf index), then fetches the
+ * corresponding value into the output buffer.
+ */
+
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <cmocka.h>
+
+/* SDK mock stubs */
+unsigned int pic(unsigned int linked_address) {
+    return linked_address;
+}
+#undef PIC
+#define PIC(x) (x)
+
+#include "mock_dispatcher.h"
+#include "cx_hash_mock.h"
+#include "sha-256.h"
+
+#include "client_commands.h"
+#include "common/merkle.h"
+#include "handler/lib/get_merkleized_map_value.h"
+
+/* ---------- Test cases ---------- */
+
+/**
+ * Happy path: single key-value pair, look up by key.
+ */
+static void test_map_value_single(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01, 0x02};
+    const uint8_t value[] = {0xAA, 0xBB, 0xCC};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    uint8_t out[64];
+    memset(out, 0, sizeof(out));
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value(dc, &commitment, key, sizeof(key), out, sizeof(out));
+
+    assert_int_equal(result, (int) sizeof(value));
+    assert_memory_equal(out, value, sizeof(value));
+}
+
+/**
+ * Happy path: three key-value pairs, look up each by key.
+ */
+static void test_map_value_three_pairs(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t k0[] = {0x01};
+    const uint8_t k1[] = {0x02};
+    const uint8_t k2[] = {0x03};
+    const uint8_t v0[] = {0x10, 0x11, 0x12};
+    const uint8_t v1[] = {0x20, 0x21};
+    const uint8_t v2[] = {0x30, 0x31, 0x32, 0x33};
+
+    const uint8_t *keys[] = {k0, k1, k2};
+    const size_t key_lens[] = {sizeof(k0), sizeof(k1), sizeof(k2)};
+    const uint8_t *values[] = {v0, v1, v2};
+    const size_t value_lens[] = {sizeof(v0), sizeof(v1), sizeof(v2)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 3, &commitment);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+
+    for (size_t i = 0; i < 3; i++) {
+        uint8_t out[64];
+        memset(out, 0, sizeof(out));
+
+        int result =
+            call_get_merkleized_map_value(dc, &commitment, keys[i], key_lens[i], out, sizeof(out));
+
+        assert_int_equal(result, (int) value_lens[i]);
+        assert_memory_equal(out, values[i], value_lens[i]);
+    }
+}
+
+/**
+ * Happy path: keys provided in unsorted order are sorted by add_map; the
+ * lookup must still work for each original key.
+ */
+static void test_map_value_unsorted_input(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t k0[] = {0x03};
+    const uint8_t k1[] = {0x01};
+    const uint8_t k2[] = {0x02};
+    const uint8_t v0[] = {0x30};
+    const uint8_t v1[] = {0x10};
+    const uint8_t v2[] = {0x20};
+
+    const uint8_t *keys[] = {k0, k1, k2};
+    const size_t key_lens[] = {sizeof(k0), sizeof(k1), sizeof(k2)};
+    const uint8_t *values[] = {v0, v1, v2};
+    const size_t value_lens[] = {sizeof(v0), sizeof(v1), sizeof(v2)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 3, &commitment);
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+
+    for (size_t i = 0; i < 3; i++) {
+        uint8_t out[64];
+        memset(out, 0, sizeof(out));
+
+        int result =
+            call_get_merkleized_map_value(dc, &commitment, keys[i], key_lens[i], out, sizeof(out));
+
+        assert_int_equal(result, (int) value_lens[i]);
+        assert_memory_equal(out, values[i], value_lens[i]);
+    }
+}
+
+/**
+ * Error: the key is not present in the map. call_get_merkle_leaf_index
+ * returns a negative value, which must be propagated as -1.
+ */
+static void test_map_value_key_not_found(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01};
+    const uint8_t value[] = {0xAA};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    const uint8_t missing_key[] = {0xFF};
+
+    uint8_t out[64];
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value(dc,
+                                               &commitment,
+                                               missing_key,
+                                               sizeof(missing_key),
+                                               out,
+                                               sizeof(out));
+    assert_int_equal(result, -1);
+}
+
+/**
+ * Error: output buffer too small to hold the value. The underlying
+ * call_get_merkle_leaf_element returns a negative value when the
+ * preimage does not fit, which must be propagated.
+ */
+static void test_map_value_out_buffer_too_small(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01};
+    const uint8_t value[] = {0x11, 0x22, 0x33, 0x44, 0x55};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    /* Provide an output buffer smaller than the value length. */
+    uint8_t out[2];
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value(dc, &commitment, key, sizeof(key), out, sizeof(out));
+    assert_true(result < 0);
+}
+
+/**
+ * Edge case: 0-byte value. The lookup must succeed and return 0.
+ */
+static void test_map_value_empty_value(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x42};
+    const uint8_t *values[] = {NULL};
+    const size_t value_lens[] = {0};
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    uint8_t out[16];
+    memset(out, 0xCD, sizeof(out));
+
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value(dc, &commitment, key, sizeof(key), out, sizeof(out));
+
+    assert_int_equal(result, 0);
+    /* Buffer must be left untouched. */
+    assert_int_equal(out[0], 0xCD);
+}
+
+/**
+ * Happy path for call_get_merkleized_map_value_u32_le: a 4-byte
+ * little-endian value is decoded into a uint32_t.
+ */
+static void test_map_value_u32_le(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x10};
+    /* 0xDEADBEEF in little-endian */
+    const uint8_t value[] = {0xEF, 0xBE, 0xAD, 0xDE};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    uint32_t got = 0;
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value_u32_le(dc, &commitment, key, sizeof(key), &got);
+
+    assert_int_equal(result, 4);
+    assert_int_equal(got, 0xDEADBEEFu);
+}
+
+/**
+ * Error path for call_get_merkleized_map_value_u32_le: the value at the
+ * key has a length different from 4. The wrapper must return -1 without
+ * writing to the output.
+ */
+static void test_map_value_u32_le_wrong_length(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x10};
+    /* Only 3 bytes — not a valid 32-bit value. */
+    const uint8_t value[] = {0x01, 0x02, 0x03};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    uint32_t got = 0xCAFEBABEu;
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value_u32_le(dc, &commitment, key, sizeof(key), &got);
+
+    assert_int_equal(result, -1);
+    /* The wrapper bails out before assigning to *out. */
+    assert_int_equal(got, 0xCAFEBABEu);
+}
+
+/**
+ * Error path for call_get_merkleized_map_value_u32_le: the key is not
+ * present in the map.
+ */
+static void test_map_value_u32_le_key_not_found(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x10};
+    const uint8_t value[] = {0x01, 0x02, 0x03, 0x04};
+
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    const uint8_t missing_key[] = {0xFF};
+
+    uint32_t got = 0;
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value_u32_le(dc,
+                                                      &commitment,
+                                                      missing_key,
+                                                      sizeof(missing_key),
+                                                      &got);
+
+    assert_int_equal(result, -1);
+}
+
+/**
+ * Adversarial: client corrupts the leaf hash in the merkle proof for the
+ * VALUES tree. After the key index is resolved correctly, the value leaf
+ * retrieval must fail because the proof no longer reconstructs the root.
+ */
+static int tamper_corrupt_value_proof(uint8_t *response_buf,
+                                      size_t *response_len,
+                                      uint8_t cmd,
+                                      int call_count,
+                                      void *user_data) {
+    (void) call_count;
+
+    /* The first CCMD_GET_MERKLE_LEAF_PROOF response is for the keys tree
+     * (issued by call_get_merkle_leaf_index). The second is for the
+     * values tree (issued by call_get_merkle_leaf_element). Corrupt
+     * only the second one so the key index resolution still succeeds. */
+    int *proof_call = (int *) user_data;
+    if (cmd == CCMD_GET_MERKLE_LEAF_PROOF) {
+        if (*proof_call == 1 && *response_len >= 32) {
+            response_buf[5] ^= 0x01;
+        }
+        (*proof_call)++;
+    }
+    return 0;
+}
+
+static void test_map_value_corrupted_value_proof(void **state) {
+    mock_dispatcher_t *mock = *state;
+
+    const uint8_t key[] = {0x01};
+    const uint8_t value[] = {0xDE, 0xAD, 0xBE, 0xEF};
+    const uint8_t *keys[] = {key};
+    const size_t key_lens[] = {sizeof(key)};
+    const uint8_t *values[] = {value};
+    const size_t value_lens[] = {sizeof(value)};
+
+    merkleized_map_commitment_t commitment;
+    mock_dispatcher_add_map(mock, keys, key_lens, values, value_lens, 1, &commitment);
+
+    int proof_call = 0;
+    mock_dispatcher_set_tamper_hook(mock, tamper_corrupt_value_proof, &proof_call);
+
+    uint8_t out[64];
+    dispatcher_context_t *dc = mock_dispatcher_get_dc(mock);
+    int result = call_get_merkleized_map_value(dc, &commitment, key, sizeof(key), out, sizeof(out));
+
+    assert_true(result < 0);
+}
+
+/* ---------- Main ---------- */
+
+int main(void) {
+#define T(fn) cmocka_unit_test_setup_teardown(fn, mock_dispatcher_setup, mock_dispatcher_teardown)
+    const struct CMUnitTest tests[] = {
+        T(test_map_value_single),
+        T(test_map_value_three_pairs),
+        T(test_map_value_unsorted_input),
+        T(test_map_value_key_not_found),
+        T(test_map_value_out_buffer_too_small),
+        T(test_map_value_empty_value),
+        T(test_map_value_u32_le),
+        T(test_map_value_u32_le_wrong_length),
+        T(test_map_value_u32_le_key_not_found),
+        T(test_map_value_corrupted_value_proof),
+    };
+#undef T
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}