feat(core): Move SECRET_LOCK_SLOT_OFFSET to end of sector.
What the developer wrote
Authored by Andrew Kozlik
feat(core): Move SECRET_LOCK_SLOT_OFFSET to end of sector.
[no changelog]
What changed, and why it matters
This commit moves a small 16-byte 'lock slot' region from the middle of a storage sector to the very end of that sector in the T3W1 hardware model's secret memory layout. The change is a single offset value. It is likely a defensive hardening measure to prevent the lock slot from being accidentally overwritten by other data placed earlier in the same sector, but the commit message gives no explicit security rationale.
Treat as a low-risk hardening/layout fix. Review whether the old offset caused any actual overlap or write hazard with adjacent secret regions, and confirm the new offset aligns with the sector erase block size. No urgent action is indicated absent additional disclosure or regression evidence.
Security signals we found
Memory layout change for secret storage region
Relocation of lock slot to sector boundary
Potential overlap/alignment concern in previous layout
No changelog entry provided
Evidence from the diff
In core/embed/models/T3W1/secret_layout.h, SECRET_LOCK_SLOT_OFFSET is changed from 0xC70 to 0x1FF0 while SECRET_LOCK_SLOT_LEN remains 0x10. The surrounding offsets (SECRET_MCU_DEVICE_CERT_OFFSET at 0x870 with size 0x400) show that the old lock slot at 0xC70 sat immediately after the MCU device certificate region (0x870 + 0x400 = 0xC70). The new offset 0x1FF0 places the 16-byte slot at the end of a 0x2000-byte (8 KiB) sector. This avoids overlap and reserves the lock slot at the sector boundary, which is a common layout hardening pattern.
Changed components
core/embed/models/T3W1/secret_layout.hTrezor T3W1 secure storage layoutSECRET_LOCK_SLOT regionInspect captured patch +1 / −1
diff --git a/core/embed/models/T3W1/secret_layout.h b/core/embed/models/T3W1/secret_layout.h
index 8e27a97bd..601a7a6b4 100644
--- a/core/embed/models/T3W1/secret_layout.h
+++ b/core/embed/models/T3W1/secret_layout.h
@@ -47,7 +47,7 @@
#define SECRET_MCU_DEVICE_CERT_OFFSET 0x870
#define SECRET_MCU_DEVICE_CERT_SIZE 0x400
-#define SECRET_LOCK_SLOT_OFFSET 0xC70
+#define SECRET_LOCK_SLOT_OFFSET 0x1FF0
#define SECRET_LOCK_SLOT_LEN 0x10
// second page: refreshed on wallet wipe
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.