fix(core/bootloader): report the actual error from a failed wipe step
What the developer wrote
Authored by tychovrahe
fix(core/bootloader): report the actual error from a failed wipe step
`send_error_conditionally` ignored its `msg` argument and always sent
"Could not read BLE status", so a host watching a WipeDevice was told the
wrong thing whenever anything but the BLE status read failed -- an
inability to issue a BLE command, to erase bonds, or to erase flash.
[no changelog]
What changed, and why it matters
This is a minor bug fix in the Trezor bootloader. When wiping the device, if a step failed, the bootloader always reported the same generic error message ('Could not read BLE status') even when the actual failure was something else, such as failing to erase stored data or issue a Bluetooth command. The fix makes the bootloader report the correct, specific error message. It does not change whether errors happen or how they are handled; it only corrects the message sent to the host computer.
No security action required; treat as normal bug fix. Reviewers may verify that callers of send_error_conditionally pass appropriate static string literals and that the const-correct signature does not introduce new warnings.
Security signals we found
Incorrect error reporting in bootloader wipe workflow
No change to failure conditions or access control
No memory safety, cryptographic, or privilege-escalation issue evident
Evidence from the diff
In core/embed/projects/bootloader/workflow/wf_wipe_device.c, send_error_conditionally() ignored its msg parameter and hardcoded ‘Could not read BLE status’ when sending a Failure message to the host. The patch changes the function signature to accept const char* msg and passes msg to send_msg_failure(). This is a diagnostic/UX correction with no change to control flow, error handling, or security boundaries.
Changed components
core/embed/projects/bootloader/workflow/wf_wipe_device.cTrezor Core bootloader wipe-device workflowInspect captured patch +2 / −3
### core/embed/projects/bootloader/workflow/wf_wipe_device.c
@@ -42,10 +42,9 @@
#include "rust_ui_bootloader.h"
#include "workflow.h"
-static void send_error_conditionally(protob_io_t* iface, char* msg) {
+static void send_error_conditionally(protob_io_t* iface, const char* msg) {
if (iface != NULL) {
- send_msg_failure(iface, FailureType_Failure_ProcessError,
- "Could not read BLE status");
+ send_msg_failure(iface, FailureType_Failure_ProcessError, msg);
}
}
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.