Nits from PR review

### src/handler/lib/check_merkle_tree_sorted.h
@@ -58,6 +58,9 @@ static inline int call_check_merkle_tree_sorted(dispatcher_context_t *dispatcher
  */
 static inline int call_check_merkleized_map_sorted(dispatcher_context_t *dispatcher_context,
                                                    merkleized_map_commitment_t *map) {
+    // The map is not yet validated; explicitly mark it as such
+    map->_keys_are_sorted = false;
+
     int ret = call_check_merkle_tree_sorted(dispatcher_context, map->keys_root, (size_t) map->size);
     if (ret >= 0) {
         map->_keys_are_sorted = true;

### src/handler/lib/map_value_status.h
@@ -1,27 +1,17 @@
 #pragma once
 
 /**
- * Outcome of reading a value by key out of a merkleized map.
+ * Outcome of the by-key merkleized map readers (call_get_merkleized_map_value[_hash],
+ * call_stream_merkleized_map_value): non-negative is success (byte count, or 0 if not meaningful),
+ * negative is one of the statuses below.
  *
- * The by-key readers (call_get_merkleized_map_value, call_get_merkleized_map_value_hash,
- * call_stream_merkleized_map_value) all share this contract:
+ * Callers applying a default for an optional field MUST branch on MAP_VALUE_ABSENT, never on
+ * `res < 0`, which would silently apply the default on errors too.
  *
- * - a non-negative return means success; where the operation has a natural length (the number of
- *   bytes read) it is returned, otherwise 0;
- * - MAP_VALUE_ABSENT means that the client responded that the key is not in the map;
- * - MAP_VALUE_ERROR means the read failed and no conclusion may be drawn about the key.
- *
- * Callers that apply a default value for an optional field MUST branch on MAP_VALUE_ABSENT
- * specifically, and never on `res < 0`: doing the latter would apply the default on failures,
- * swallowing an error condition.
- *
- * SECURITY — MAP_VALUE_ABSENT is a CLIENT ASSERTION, NOT A PROOF.
- * It reflects the client answering `found = 0` to CCMD_GET_MERKLE_LEAF_INDEX. The device requests
- * no proof of absence, so it cannot distinguish an honest omission from a key the client chose to
- * suppress. Do not treat it as evidence that the committed map lacks the key.
- * Where soundness is required, derive presence from the key enumeration performed while validating
- * the map (see input_keys_callback in sign_psbt/preprocess_inputs.c): those flags are computed by
- * walking the keys tree against the committed `keys_root`, so the client cannot lie about them.
+ * SECURITY: MAP_VALUE_ABSENT is only the client asserting `found = 0`; absence is never proved, so
+ * a malicious client can suppress any key. Where soundness matters, use the presence flags computed
+ * while validating the map against the committed `keys_root` (see input_keys_callback in
+ * sign_psbt/preprocess_inputs.c).
  */
 typedef enum {
     MAP_VALUE_ABSENT = -1,  // the key is not in the map (client assertion - see above)

### src/handler/sign_psbt/psbt_fields.h
@@ -1,6 +1,6 @@
 /*****************************************************************************
  *   Ledger App Bitcoin.
- *   (c) 2025, 2026 Ledger SAS.
+ *   (c) 2026 Ledger SAS.
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -115,8 +115,9 @@ psbt_field_status_t psbt_get_input_redeem_script(dispatcher_context_t *dc,
 
 /**
  * PSBT_IN_WITNESS_UTXO amount: reads the witness UTXO and returns its 8-byte little-endian amount.
- * Only requires the value to be at least 8 bytes; the full structural validation of the witness
- * UTXO is done elsewhere (see get_amount_scriptpubkey_from_psbt_witness).
+ * Only requires the value to be at least 8 bytes and at most 8 + 1 + MAX_PREVOUT_SCRIPTPUBKEY_LEN;
+ * the full structural validation of the witness UTXO is done elsewhere (see
+ * get_amount_scriptpubkey_from_psbt_witness).
  */
 psbt_field_status_t psbt_get_input_witness_utxo_amount(dispatcher_context_t *dc,
                                                        const merkleized_map_commitment_t *input_map,

### src/handler/sign_psbt/txhashes.c
@@ -590,7 +590,8 @@ bool __attribute__((noinline)) compute_sighash_segwitv1(
     // the first 0x00 byte is not part of SigMsg
     crypto_hash_update_u8(&sighash_context.header, 0x00);
 
-    uint8_t tmp[MAX(32, 8 + 1 + MAX_PREVOUT_SCRIPTPUBKEY_LEN)];
+    // re-used multiple times below; the largest size we need is a 32-byte hash
+    uint8_t tmp[32];
 
     // hash type
     crypto_hash_update_u8(&sighash_context.header, sighash_byte);