feat(core): enable -Wsign-compare

### core/embed/io/ble/inc/io/ble.h
@@ -33,7 +33,7 @@
 #define BLE_RX_PACKET_SIZE 244
 #define BLE_TX_PACKET_SIZE 244
 
-#define BLE_ADV_NAME_LEN 20
+#define BLE_ADV_NAME_LEN 20U
 #define BLE_PAIRING_CODE_LEN 6
 
 #define BLE_MAX_BONDS 8

### core/embed/io/ble/unix/ble.c
@@ -296,7 +296,7 @@ bool ble_get_event(ble_event_t *event) {
   ssize_t r = sock_recvfrom(&drv->event_sock, buf, sizeof(buf));
   if (r <= 0) {
     return false;
-  } else if (r > sizeof(ble_event_t)) {
+  } else if ((size_t)r > sizeof(ble_event_t)) {
     LOG_ERR("event packet too long: %zd", r);
     return false;
   }

### core/embed/io/gfx/jpegdec/unix/jpegdec.c
@@ -298,8 +298,9 @@ bool jpegdec_get_slice_rgba8888(uint32_t *rgba8888, jpegdec_slice_t *slice) {
 
   slice->x = dec->slice_x;
   slice->y = dec->slice_y;
-  slice->width = MIN(dec->image.width - dec->slice_x, MAX_SLICE_WIDTH);
-  slice->height = MIN(dec->image.height - dec->slice_y, MAX_SLICE_HEIGHT);
+  slice->width = MIN(dec->image.width - dec->slice_x, (int16_t)MAX_SLICE_WIDTH);
+  slice->height =
+      MIN(dec->image.height - dec->slice_y, (int16_t)MAX_SLICE_HEIGHT);
 
   for (int y = 0; y < slice->height; y++) {
     void *src = &((uint32_t *)dec->slice_buffer[y])[slice->x];
@@ -323,8 +324,9 @@ bool jpegdec_get_slice_mono8(uint32_t *mono8, jpegdec_slice_t *slice) {
 
   slice->x = dec->slice_x;
   slice->y = dec->slice_y;
-  slice->width = MIN(dec->image.width - dec->slice_x, MAX_SLICE_WIDTH);
-  slice->height = MIN(dec->image.height - dec->slice_y, MAX_SLICE_HEIGHT);
+  slice->width = MIN(dec->image.width - dec->slice_x, (int16_t)MAX_SLICE_WIDTH);
+  slice->height =
+      MIN(dec->image.height - dec->slice_y, (int16_t)MAX_SLICE_HEIGHT);
 
   uint8_t *dst = (uint8_t *)mono8;
 

### core/embed/io/power_manager/npm1300/npm1300.c
@@ -353,7 +353,7 @@ static bool npm1300_initialize(i2c_bus_t* bus, uint16_t i_charge,
       // TODO automatic temp measurement during charging
   };
 
-  for (int i = 0; i < sizeof(table) / sizeof(table[0]); i++) {
+  for (size_t i = 0; i < sizeof(table) / sizeof(table[0]); i++) {
     if (!npm1300_set_reg(bus, table[i].addr, table[i].value)) {
       return false;
     }

### core/embed/io/power_manager/stwlc38/stwlc38_patching.c
@@ -324,7 +324,6 @@ static i2c_status_t stwlc38_nvm_write_sector(i2c_bus_t *i2c_bus,
                                              const uint8_t *data, size_t size,
                                              uint8_t sec_idx) {
   int32_t ret;
-  int32_t i;
   int32_t timeout = 1;
   uint8_t reg;
 
@@ -374,7 +373,7 @@ static i2c_status_t stwlc38_nvm_write_sector(i2c_bus_t *i2c_bus,
     return ret;
   }
 
-  for (i = 0; i < STWLC38_NVM_WRITE_TIMEOUT; i++) {
+  for (size_t i = 0; i < STWLC38_NVM_WRITE_TIMEOUT; i++) {
     systick_delay_ms(STWLC38_NVM_WRITE_INTERVAL_MS);
 
     ret = stwlc38_read_fw_register(i2c_bus, STWLC38_FWREG_SYS_CMD_REG, &reg);

### core/embed/io/touch/ft3168/ft3168.c
@@ -314,7 +314,7 @@ static secbool ft3168_configure(i2c_bus_t* i2c_bus) {
 
   _Static_assert(sizeof(config) % 2 == 0);
 
-  for (int i = 0; i < sizeof(config); i += 2) {
+  for (size_t i = 0; i < sizeof(config); i += 2) {
     uint8_t reg = config[i];
     uint8_t value = config[i + 1];
 

### core/embed/io/touch/ft6x36/ft6x36.c
@@ -239,7 +239,7 @@ static secbool ft6x36_configure(i2c_bus_t* i2c_bus) {
 
   _Static_assert(sizeof(config) % 2 == 0);
 
-  for (int i = 0; i < sizeof(config); i += 2) {
+  for (size_t i = 0; i < sizeof(config); i += 2) {
     uint8_t reg = config[i];
     uint8_t value = config[i + 1];
 

### core/embed/io/touch/sitronix/sitronix.c
@@ -6,6 +6,8 @@
 #include <sys/i2c_bus.h>
 #include <sys/irq.h>
 
+#include "sitronix.h"
+
 /** @addtogroup STM32U5x9J_DISCOVERY
  * @{
  */
@@ -659,8 +661,6 @@ SITRONIX_DetectTouch(SITRONIX_Object_t *pObj) {
   ******************************************************************************
   */
 
-#include "sitronix.h"
-
 /* TS instances */
 #define TS_INSTANCES_NBR 1U
 #define TS_TOUCH_NBR 10U

### core/embed/io/touch/unix/touch.c
@@ -58,7 +58,7 @@ typedef struct {
   int swipe_start_y;
   int swipe_end_x;
   int swipe_end_y;
-  int swipe_key;
+  SDL_Keycode swipe_key;
 
   // Last event not yet read
   uint32_t last_event;

### core/embed/io/usb/unix/sock.c
@@ -57,7 +57,7 @@ ssize_t sock_sendto(emu_sock_t *sock, const void *data, size_t len) {
   if (sock->slen > 0) {
     ssize_t r = sendto(sock->sock, data, len, 0,
                        (const struct sockaddr *)&(sock->si_other), sock->slen);
-    if (r != len) {
+    if (r < 0 || (size_t)r != len) {
       return -1;
     }
     return r;

### core/embed/io/usb/unix/usb.c
@@ -178,9 +178,9 @@ static secbool usb_emulated_poll_write(usb_iface_t *iface) {
   return sectrue * sock_can_send(&iface->sock);
 }
 
-static int usb_emulated_read(usb_iface_t *iface, uint8_t *buf, uint32_t len) {
+static int usb_emulated_read(usb_iface_t *iface, uint8_t *buf, size_t len) {
   if (iface->msg_len > 0) {
-    if (iface->msg_len < len) {
+    if ((size_t)iface->msg_len < len) {
       len = iface->msg_len;
     }
     memcpy(buf, iface->msg, len);

### core/embed/models/build.rs
@@ -49,7 +49,6 @@ fn main() -> Result<()> {
             "-Wuninitialized",
             "-Wpointer-arith",
             "-Wno-unused-parameter",
-            "-Wno-sign-compare",
             "-Wno-type-limits",
             "-Wfloat-conversion",
             "-Wdouble-promotion",

### core/embed/projects/boardloader/sd_update.c
@@ -76,7 +76,7 @@ static uint32_t check_sdcard(void) {
       return 0;
     }
 
-    for (int i = IMAGE_HASH_DIGEST_LENGTH; i < sizeof(hdr->hashes); i++) {
+    for (size_t i = IMAGE_HASH_DIGEST_LENGTH; i < sizeof(hdr->hashes); i++) {
       if (hdr->hashes[i] != 0) {
         return 0;
       }

### core/embed/projects/bootloader/wire/codec_v1.c
@@ -151,7 +151,7 @@ static void read_retry(wire_iface_t *iface, uint8_t *buf) {
 
   for (int retry = 0;; retry++) {
     int r = iface->read(buf, packet_size);
-    if (r != packet_size) {  // reading failed
+    if (r < 0 || (size_t)r != packet_size) {  // reading failed
       if (r == 0 && retry < 10) {
         // only timeout => let's try again
         continue;

### core/embed/projects/bootloader/wire/debug_iface_usb.c
@@ -40,7 +40,7 @@ static bool usb_write(uint8_t* data, size_t size) {
   ssize_t r =
       syshandle_write_blocking(SYSHANDLE_USB_DEBUG, data, size, USB_TIMEOUT);
 
-  return r == size;
+  return (r >= 0) && ((size_t)r == size);
 }
 
 static int usb_read(uint8_t* buffer, size_t buffer_size) {

### core/embed/projects/bootloader/wire/wire_iface_usb.c
@@ -40,7 +40,7 @@ static bool usb_write(uint8_t* data, size_t size) {
   ssize_t r =
       syshandle_write_blocking(SYSHANDLE_USB_WIRE, data, size, USB_TIMEOUT);
 
-  return r == size;
+  return (r >= 0) && (size_t)r == size;
 }
 
 static int usb_read(uint8_t* buffer, size_t buffer_size) {

### core/embed/projects/bootloader_ci/messages.c
@@ -622,7 +622,7 @@ int process_msg_FirmwareUpload(uint8_t iface_num, uint32_t msg_size,
   const uint32_t *const src = (const uint32_t *const)chunk_buffer;
 
   ensure((chunk_size % FLASH_BLOCK_SIZE == 0) * sectrue, NULL);
-  for (int i = 0; i < chunk_size / FLASH_BLOCK_SIZE; i++) {
+  for (size_t i = 0; i < chunk_size / FLASH_BLOCK_SIZE; i++) {
     ensure(flash_area_write_block(
                &FIRMWARE_AREA,
                firmware_block * IMAGE_CHUNK_SIZE + i * FLASH_BLOCK_SIZE,

### core/embed/projects/prodtest/cmd/prodtest_backup_ram.c
@@ -117,7 +117,7 @@ static void prodtest_backup_ram_read(cli_t* cli) {
 
   size_t offset = 0;
   while (offset < data_size) {
-    size_t block_size = MIN(16, data_size - offset);
+    size_t block_size = MIN(16U, data_size - offset);
     char block_hex[16 * 2 + 1];
     if (!cstr_encode_hex(block_hex, sizeof(block_hex), &data[offset],
                          block_size)) {

### core/embed/projects/prodtest/cmd/prodtest_help.c
@@ -39,7 +39,7 @@ static void prodtest_help(cli_t* cli) {
   }
 
   const cli_command_t* cmd = commands_get_ptr();
-  for (int i = 0; i < commands_count(); i++) {
+  for (size_t i = 0; i < commands_count(); i++) {
     if (cmd->name[0] != '$' && strncmp(cmd->name, prefix, prefix_len) == 0) {
       cli_trace(cli, " %s - %s", cmd->name, cmd->info);
     }

### core/embed/projects/prodtest/cmd/prodtest_manufacturing_lock.c
@@ -52,7 +52,7 @@ static void prodtest_manufacturing_lock_write(cli_t* cli) {
   bool dry_run = true;
 #endif
 
-  int arg_idx = 0;
+  size_t arg_idx = 0;
   while (arg_idx < cli_arg_count(cli)) {
     const char* arg = cli_nth_arg(cli, arg_idx++);
     if (strcmp(arg, "--execute") == 0) {

### core/embed/projects/prodtest/cmd/prodtest_otp_variant.c
@@ -83,7 +83,7 @@ static void prodtest_otp_variant_read(cli_t* cli) {
 
   // Make a list of integers separated by spaces
   char* dst = block_text;
-  for (int i = 0; i < sizeof(block); i++) {
+  for (size_t i = 0; i < sizeof(block); i++) {
     if (i != 0) {
       *dst++ = ' ';
     }
@@ -105,8 +105,8 @@ static void prodtest_otp_variant_write(cli_t* cli) {
 #endif
   bool rework = false;
 
-  int arg_idx = 0;
-  int val_count = 0;
+  size_t arg_idx = 0;
+  size_t val_count = 0;
 
   block[val_count++] = 0x01;  // Always 1
 

### core/embed/projects/prodtest/cmd/prodtest_sdcard.c
@@ -68,7 +68,7 @@ static void prodtest_sdcard_test(cli_t* cli) {
   for (int j = 1; j <= 2; j++) {
     cli_trace(cli, "Writing data to the SD card (attempt #%d)...", j);
 
-    for (int i = 0; i < BLOCK_SIZE / sizeof(uint32_t); i++) {
+    for (size_t i = 0; i < BLOCK_SIZE / sizeof(uint32_t); i++) {
       buf1[i] ^= 0xFFFFFFFF;
     }
 

### core/embed/projects/prodtest/cmd/prodtest_tropic.c
@@ -1707,14 +1707,14 @@ static void prodtest_tropic_stress_init(cli_t* cli) {
     return;
   }
 
-  for (int i = 0; i < iterations; i++) {
+  for (uint32_t i = 0; i < iterations; i++) {
     tropic_deinit();
     // Simulate a delay between suspend and wake-up.
     systick_delay_ms(delay_ms);
     lt_ret_t ret = tropic_init(cli);
     if (ret != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_INIT,
-                "Call #%d of `tropic_init()` failed with error '%s'", i + 1,
+                "Call #%u of `tropic_init()` failed with error '%s'", i + 1,
                 lt_ret_verbose(ret));
       return;
     }
@@ -1740,20 +1740,20 @@ static void prodtest_tropic_stress_session(cli_t* cli) {
     return;
   }
 
-  for (int i = 0; i < iterations; i++) {
+  for (uint32_t i = 0; i < iterations; i++) {
     lt_ret_t res = tropic_session_invalidate();
     if (res != LT_OK) {
       cli_error(
           cli, PRODTEST_ERR_TROPIC_STRESS_SESSION_INVALIDATE,
-          "Call #%d of `tropic_session_invalidate()` failed with error '%s'",
+          "Call #%u of `tropic_session_invalidate()` failed with error '%s'",
           i + 1, lt_ret_verbose(res));
       return;
     }
     res = tropic_custom_session_start(cli, pairing_key_index);
     if (res != LT_OK) {
       cli_error(
           cli, PRODTEST_ERR_TROPIC_STRESS_SESSION_START,
-          "Call #%d of `tropic_custom_session_start()` failed with error '%s'",
+          "Call #%u of `tropic_custom_session_start()` failed with error '%s'",
           i + 1, lt_ret_verbose(res));
       return;
     }
@@ -1800,15 +1800,15 @@ static void prodtest_tropic_stress_mac_and_destroy(cli_t* cli) {
     return;
   }
 
-  for (int s = 0; s < slot_count; s++) {
+  for (uint32_t s = 0; s < slot_count; s++) {
     lt_mac_and_destroy_slot_t slot = slots[s];
-    for (int i = 0; i < iterations; i++) {
+    for (uint32_t i = 0; i < iterations; i++) {
       uint8_t buffer[TROPIC_MAC_AND_DESTROY_SIZE] = {0};
       rng_fill_buffer(buffer, sizeof(buffer));
       lt_ret_t res = lt_mac_and_destroy(h, slot, buffer, buffer);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_MAC_AND_DESTROY,
-                  "Call #%d of `lt_mac_and_destroy()` for slot %d failed with "
+                  "Call #%u of `lt_mac_and_destroy()` for slot %d failed with "
                   "error '%s'",
                   i + 1, slot, lt_ret_verbose(res));
         return;
@@ -1865,7 +1865,7 @@ static void prodtest_tropic_test_mac_and_destroy(cli_t* cli) {
     return;
   }
 
-  for (int s = 0; s < slot_count; s++) {
+  for (uint32_t s = 0; s < slot_count; s++) {
     lt_mac_and_destroy_slot_t slot = slots[s];
 
     uint8_t reset_key[TROPIC_MAC_AND_DESTROY_SIZE] = {0};
@@ -1894,13 +1894,13 @@ static void prodtest_tropic_test_mac_and_destroy(cli_t* cli) {
       return;
     }
 
-    for (int i = 0; i < iterations; i++) {
+    for (uint32_t i = 0; i < iterations; i++) {
       // Reset: M&D(reset_key)
       res = lt_mac_and_destroy(h, slot, reset_key, output);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_MAC_AND_DESTROY,
                   "`lt_mac_and_destroy()` reset for slot %d failed at "
-                  "iteration #%d with error '%s'",
+                  "iteration #%u with error '%s'",
                   slot, i + 1, lt_ret_verbose(res));
         return;
       }
@@ -1909,13 +1909,13 @@ static void prodtest_tropic_test_mac_and_destroy(cli_t* cli) {
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_MAC_AND_DESTROY,
                   "`lt_mac_and_destroy()` re-measurement for slot %d failed at "
-                  "iteration #%d with error '%s'",
+                  "iteration #%u with error '%s'",
                   slot, i + 1, lt_ret_verbose(res));
         return;
       }
       if (memcmp(output, output_0, sizeof(output_0)) != 0) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_MAC_AND_DESTROY_MISMATCH,
-                  "MAC-and-destroy inconsistent on slot %d at iteration #%d",
+                  "MAC-and-destroy inconsistent on slot %d at iteration #%u",
                   slot, i + 1);
         return;
       }
@@ -1976,20 +1976,20 @@ static void prodtest_tropic_test_sign(cli_t* cli) {
     goto cleanup_error;
   }
 
-  for (int i = 0; i < iterations; i++) {
+  for (uint32_t i = 0; i < iterations; i++) {
     rng_fill_buffer(message, sizeof(message));
     res = lt_ecc_eddsa_sign(h, ecc_slot, message, sizeof(message), signature);
     if (res != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_EDDSA_SIGN,
-                "Call #%d of `lt_ecc_eddsa_sign()` for slot %d failed with "
+                "Call #%u of `lt_ecc_eddsa_sign()` for slot %d failed with "
                 "error '%s'",
                 i + 1, ecc_slot, lt_ret_verbose(res));
       goto cleanup_error;
     }
     if (ed25519_sign_open(message, sizeof(message), public_key, signature) !=
         0) {
       cli_error(cli, PRODTEST_ERR_TROPIC_TEST_SIGN_VERIFY,
-                "Signature #%d for slot %d failed verification", i + 1,
+                "Signature #%u for slot %d failed verification", i + 1,
                 ecc_slot);
       goto cleanup_error;
     }
@@ -2049,7 +2049,7 @@ static void prodtest_tropic_test_counter(cli_t* cli) {
     return;
   }
 
-  for (int s = 0; s < slot_count; s++) {
+  for (uint32_t s = 0; s < slot_count; s++) {
     lt_mcounter_index_t idx = slots[s];
 
     lt_ret_t res = lt_mcounter_init(h, idx, iterations);
@@ -2070,32 +2070,32 @@ static void prodtest_tropic_test_counter(cli_t* cli) {
     }
     if (value != iterations) {
       cli_error(cli, PRODTEST_ERR_TROPIC_TEST_COUNTER_INIT_MISMATCH,
-                "Counter %d read %d after init, expected %d", idx, value,
+                "Counter %d read %u after init, expected %u", idx, value,
                 iterations);
       return;
     }
 
-    for (int i = 0; i < iterations; i++) {
+    for (uint32_t i = 0; i < iterations; i++) {
       res = lt_mcounter_update(h, idx);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_COUNTER_UPDATE,
                   "`lt_mcounter_update()` for counter %d failed at iteration "
-                  "#%d with error '%s'",
+                  "#%u with error '%s'",
                   idx, i + 1, lt_ret_verbose(res));
         return;
       }
       res = lt_mcounter_get(h, idx, &value);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_COUNTER_GET,
-                  "`lt_mcounter_get()` for counter %d failed at iteration #%d "
+                  "`lt_mcounter_get()` for counter %d failed at iteration #%u "
                   "with error '%s'",
                   idx, i + 1, lt_ret_verbose(res));
         return;
       }
       uint32_t expected = iterations - i - 1;
       if (value != expected) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_COUNTER_MISMATCH,
-                  "Counter %d read %d after %d decrements, expected %d", idx,
+                  "Counter %d read %u after %u decrements, expected %u", idx,
                   value, i + 1, expected);
         return;
       }
@@ -2153,9 +2153,9 @@ static void prodtest_tropic_test_rmem(cli_t* cli) {
     return;
   }
 
-  for (int s = 0; s < slot_count; s++) {
+  for (uint32_t s = 0; s < slot_count; s++) {
     uint16_t slot = slots[s];
-    for (int i = 0; i < iterations; i++) {
+    for (uint32_t i = 0; i < iterations; i++) {
       uint8_t write_data[TROPIC_RMEM_TEST_DATA_SIZE] = {0};
       uint8_t read_data[TROPIC_RMEM_TEST_DATA_SIZE] = {0};
       rng_fill_buffer(write_data, sizeof(write_data));
@@ -2165,15 +2165,15 @@ static void prodtest_tropic_test_rmem(cli_t* cli) {
       lt_ret_t res = lt_r_mem_data_erase(h, slot);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_RMEM_ERASE,
-                  "`lt_r_mem_data_erase()` for slot %d failed at iteration #%d "
+                  "`lt_r_mem_data_erase()` for slot %d failed at iteration #%u "
                   "with error '%s'",
                   slot, i + 1, lt_ret_verbose(res));
         return;
       }
       res = lt_r_mem_data_write(h, slot, write_data, sizeof(write_data));
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_RMEM_WRITE,
-                  "`lt_r_mem_data_write()` for slot %d failed at iteration #%d "
+                  "`lt_r_mem_data_write()` for slot %d failed at iteration #%u "
                   "with error '%s'",
                   slot, i + 1, lt_ret_verbose(res));
         lt_r_mem_data_erase(h, slot);
@@ -2184,7 +2184,7 @@ static void prodtest_tropic_test_rmem(cli_t* cli) {
           lt_r_mem_data_read(h, slot, read_data, sizeof(read_data), &read_size);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_RMEM_READ,
-                  "`lt_r_mem_data_read()` for slot %d failed at iteration #%d "
+                  "`lt_r_mem_data_read()` for slot %d failed at iteration #%u "
                   "with error '%s'",
                   slot, i + 1, lt_ret_verbose(res));
         lt_r_mem_data_erase(h, slot);
@@ -2193,7 +2193,7 @@ static void prodtest_tropic_test_rmem(cli_t* cli) {
       if (read_size != sizeof(write_data) ||
           memcmp(read_data, write_data, sizeof(write_data)) != 0) {
         cli_error(cli, PRODTEST_ERR_TROPIC_TEST_RMEM_MISMATCH,
-                  "R-memory slot %d read-back mismatch at iteration #%d", slot,
+                  "R-memory slot %d read-back mismatch at iteration #%u", slot,
                   i + 1);
         lt_r_mem_data_erase(h, slot);
         return;
@@ -2232,12 +2232,12 @@ static void prodtest_tropic_test_rng(cli_t* cli) {
   }
 
   uint8_t previous[32] = {0};
-  for (int i = 0; i < iterations; i++) {
+  for (uint32_t i = 0; i < iterations; i++) {
     uint8_t value[32] = {0};
     lt_ret_t res = lt_random_value_get(h, value, sizeof(value));
     if (res != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_RANDOM_GET,
-                "Call #%d of `lt_random_value_get()` failed with error '%s'",
+                "Call #%u of `lt_random_value_get()` failed with error '%s'",
                 i + 1, lt_ret_verbose(res));
       return;
     }
@@ -2251,12 +2251,12 @@ static void prodtest_tropic_test_rng(cli_t* cli) {
     }
     if (all_zero) {
       cli_error(cli, PRODTEST_ERR_TROPIC_TEST_RNG_ZERO,
-                "RNG returned an all-zero value at iteration #%d", i + 1);
+                "RNG returned an all-zero value at iteration #%u", i + 1);
       return;
     }
     if (i > 0 && memcmp(value, previous, sizeof(value)) == 0) {
       cli_error(cli, PRODTEST_ERR_TROPIC_TEST_RNG_REPEAT,
-                "RNG returned a repeated value at iteration #%d", i + 1);
+                "RNG returned a repeated value at iteration #%u", i + 1);
       return;
     }
     memcpy(previous, value, sizeof(value));
@@ -2376,13 +2376,13 @@ static void prodtest_tropic_stress_test(cli_t* cli) {
     }
   }
 
-  cli_trace(cli, "Initialization iterations: %d", init_iterations);
-  cli_trace(cli, "Start-session iterations: %d", start_session_iterations);
-  cli_trace(cli, "MAC-and-destroy slot count: %d", mac_and_destroy_slot_count);
-  cli_trace(cli, "MAC-and-destroy iterations per slot: %d",
+  cli_trace(cli, "Initialization iterations: %u", init_iterations);
+  cli_trace(cli, "Start-session iterations: %u", start_session_iterations);
+  cli_trace(cli, "MAC-and-destroy slot count: %u", mac_and_destroy_slot_count);
+  cli_trace(cli, "MAC-and-destroy iterations per slot: %u",
             mac_and_destroy_per_slot_iterations);
-  cli_trace(cli, "Signing iterations: %d", signing_iterations);
-  cli_trace(cli, "RNG iterations: %d", rng_iterations);
+  cli_trace(cli, "Signing iterations: %u", signing_iterations);
+  cli_trace(cli, "RNG iterations: %u", rng_iterations);
 
   g_tropic_handshake_state = TROPIC_HANDSHAKE_STATE_0;
 
@@ -2393,12 +2393,12 @@ static void prodtest_tropic_stress_test(cli_t* cli) {
   }
 
   // test Tropic gets initialized
-  for (int i = 0; i < init_iterations; i++) {
+  for (uint32_t i = 0; i < init_iterations; i++) {
     tropic_deinit();
     lt_ret_t res = tropic_init(cli);
     if (res != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_INIT,
-                "Call #%d of `tropic_init()` failed with error '%s'", i + 1,
+                "Call #%u of `tropic_init()` failed with error '%s'", i + 1,
                 lt_ret_verbose(res));
       return;
     }
@@ -2413,38 +2413,38 @@ static void prodtest_tropic_stress_test(cli_t* cli) {
   cli_trace(cli, "Established session using pairing key %d", pairing_key_index);
 
   // Test `lt_session_start()`
-  for (int i = 0; i < start_session_iterations; i++) {
+  for (uint32_t i = 0; i < start_session_iterations; i++) {
     lt_ret_t res = tropic_session_invalidate();
     if (res != LT_OK) {
       cli_error(
           cli, PRODTEST_ERR_TROPIC_STRESS_SESSION_INVALIDATE,
-          "`Call #%d of tropic_session_invalidate() failed with error '%s'",
+          "`Call #%u of tropic_session_invalidate() failed with error '%s'",
           i + 1, lt_ret_verbose(res));
       return;
     }
     res = tropic_custom_session_start(cli, pairing_key_index);
     if (res != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_SESSION_START,
-                "Call #%d of `tropic_custom_session_start()"
+                "Call #%u of `tropic_custom_session_start()"
                 "failed with error '%s'",
                 i + 1, lt_ret_verbose(res));
       return;
     }
   }
 
   // Test `lt_mac_and_destroy()`
-  for (int slot_index = TROPIC_FIRST_MAC_AND_DESTROY_SLOT_UNPRIVILEGED;
+  for (uint32_t slot_index = TROPIC_FIRST_MAC_AND_DESTROY_SLOT_UNPRIVILEGED;
        slot_index < TROPIC_FIRST_MAC_AND_DESTROY_SLOT_UNPRIVILEGED +
                         mac_and_destroy_slot_count;
        slot_index++) {
-    for (int i = 0; i < mac_and_destroy_per_slot_iterations; i++) {
+    for (uint32_t i = 0; i < mac_and_destroy_per_slot_iterations; i++) {
       uint8_t buffer[TROPIC_MAC_AND_DESTROY_SIZE] = {0};
       rng_fill_buffer(buffer, sizeof(buffer));
       lt_ret_t res =
           lt_mac_and_destroy(tropic_handle, slot_index, buffer, buffer);
       if (res != LT_OK) {
         cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_SIGN_FAILED,
-                  "Call #%d of `lt_mac_and_destroy()` for slot %d failed "
+                  "Call #%u of `lt_mac_and_destroy()` for slot %u failed "
                   "with error '%s'",
                   i + 1, slot_index, lt_ret_verbose(res));
         return;
@@ -2464,13 +2464,13 @@ static void prodtest_tropic_stress_test(cli_t* cli) {
               lt_ret_verbose(res));
     return;
   }
-  for (int i = 0; i < signing_iterations; i++) {
+  for (uint32_t i = 0; i < signing_iterations; i++) {
     rng_fill_buffer(message, sizeof(message));
     res = lt_ecc_eddsa_sign(tropic_handle, ecc_slot, message, sizeof(message),
                             signature);
     if (res != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_EDDSA_SIGN,
-                "Call #%d of `lt_ecc_eddsa_sign()` failed with error '%s'",
+                "Call #%u of `lt_ecc_eddsa_sign()` failed with error '%s'",
                 i + 1, lt_ret_verbose(res));
       lt_ecc_key_erase(tropic_handle, ecc_slot);
       return;
@@ -2485,13 +2485,13 @@ static void prodtest_tropic_stress_test(cli_t* cli) {
   }
 
   // Test lt_random_value_get()
-  for (int i = 0; i < rng_iterations; i++) {
+  for (uint32_t i = 0; i < rng_iterations; i++) {
     uint8_t random_value[32] = {0};
     lt_ret_t res =
         lt_random_value_get(tropic_handle, random_value, sizeof(random_value));
     if (res != LT_OK) {
       cli_error(cli, PRODTEST_ERR_TROPIC_STRESS_RANDOM_GET,
-                "Call #%d of `lt_random_value_get()` failed with error '%s'",
+                "Call #%u of `lt_random_value_get()` failed with error '%s'",
                 i + 1, lt_ret_verbose(res));
       return;
     }

### core/embed/projects/prodtest/main.c
@@ -135,10 +135,10 @@ static ssize_t console_read(void *context, char *buf, size_t size) {
 
 static ssize_t console_write(void *context, const char *buf, size_t size) {
   static uint32_t timeout = 2000;
-  int rc = syshandle_write_blocking(SYSHANDLE_USB_VCP, buf, size, timeout);
+  ssize_t rc = syshandle_write_blocking(SYSHANDLE_USB_VCP, buf, size, timeout);
   // Do not wait too long if the host is not connected.
   // This is a workaround that needs to be fixed properly later.
-  timeout = rc < size ? 100 : 2000;
+  timeout = (rc < 0) || ((size_t)rc < size) ? 100 : 2000;
   return rc;
 }
 

### core/embed/rtl/cli.c
@@ -282,7 +282,7 @@ static void cli_history_add(cli_t* cli, const char* line) {
 //
 // Returns NULL if there are no more commands
 static const char* cli_history_rev(cli_t* cli, int* idx, char* line,
-                                   int prefix) {
+                                   size_t prefix) {
   for (int i = *idx + 1; i <= CLI_HISTORY_DEPTH; i++) {
     const char* hist_line = cli->history[INDEX_ADD(cli->history_head, -i)];
     if (*hist_line == '\0') break;
@@ -301,7 +301,7 @@ static const char* cli_history_rev(cli_t* cli, int* idx, char* line,
 //
 // Returns NULL if there are no more commands
 static const char* cli_history_fwd(cli_t* cli, int* idx, char* line,
-                                   int prefix) {
+                                   size_t prefix) {
   for (int i = *idx - 1; i > 0; i--) {
     const char* hist_line = cli->history[INDEX_ADD(cli->history_head, -i)];
     if (strlen(hist_line) >= prefix && strncmp(hist_line, line, prefix) == 0) {
@@ -749,7 +749,7 @@ static int find_arg(const cli_command_t* cmd, const char* name) {
       p++;
     }
 
-    if (strlen(name) == (p - s) && strncmp(s, name, p - s) == 0) {
+    if ((ptrdiff_t)strlen(name) == (p - s) && strncmp(s, name, p - s) == 0) {
       return index;
     }
 
@@ -766,16 +766,14 @@ static int find_arg(const cli_command_t* cmd, const char* name) {
 
 size_t cli_arg_count(cli_t* cli) { return cli->args_count; }
 
-bool cli_has_nth_arg(cli_t* cli, int n) {
-  return n >= 0 && n < cli->args_count;
-}
+bool cli_has_nth_arg(cli_t* cli, size_t n) { return n < cli->args_count; }
 
 bool cli_has_arg(cli_t* cli, const char* name) {
   return cli_has_nth_arg(cli, find_arg(cli->current_cmd, name));
 }
 
-const char* cli_nth_arg(cli_t* cli, int n) {
-  if (n >= 0 && n < cli->args_count) {
+const char* cli_nth_arg(cli_t* cli, size_t n) {
+  if (n < cli->args_count) {
     return cli->args[n];
   } else {
     return "";

### core/embed/rtl/inc/rtl/cli.h
@@ -169,7 +169,7 @@ size_t cli_arg_count(cli_t* cli);
  * Indexing starts at 0, meaning the first argument is at index 0.
  * Returns an empty string if the argument is not present.
  */
-const char* cli_nth_arg(cli_t* cli, int n);
+const char* cli_nth_arg(cli_t* cli, size_t n);
 
 /**
  * Returns the argument with the given name from the command line.
@@ -179,7 +179,7 @@ const char* cli_nth_arg(cli_t* cli, int n);
 const char* cli_arg(cli_t* cli, const char* name);
 
 /** Returns true if the n-th argument is present. */
-bool cli_has_nth_arg(cli_t* cli, int n);
+bool cli_has_nth_arg(cli_t* cli, size_t n);
 
 /** Returns true if the argument with the given name is present. */
 bool cli_has_arg(cli_t* cli, const char* name);

### core/embed/sec/fwutils/fwutils.c
@@ -116,7 +116,7 @@ secbool firmware_get_vendor(char* buff, size_t buff_size) {
     return secfalse;
   }
 
-  if (buff_size < vhdr.vstr_len + 1) {
+  if (buff_size < (size_t)(vhdr.vstr_len + 1)) {
     return secfalse;
   }
 
@@ -134,7 +134,7 @@ void firmware_invalidate_header(void) {
 
   // erase start of the firmware (metadata) -> invalidate FW
   ensure(flash_unlock_write(), NULL);
-  for (int i = 0; i < (1024 / FLASH_BLOCK_SIZE); i++) {
+  for (size_t i = 0; i < (1024 / FLASH_BLOCK_SIZE); i++) {
     flash_block_t data = {0};
     ensure(flash_area_write_block(&FIRMWARE_AREA, i * FLASH_BLOCK_SIZE, data),
            NULL);

### core/embed/sec/image/boot_header.c
@@ -58,9 +58,10 @@ secbool boot_header_check_signature(const boot_header_auth_t* hdr,
 
   const boot_header_unauth_t* sig = boot_header_unauth_get(hdr);
 
-  for (int sig_idx = 0; sig_idx < ARRAY_LENGTH(sig->ec_signature); sig_idx++) {
+  for (size_t sig_idx = 0; sig_idx < ARRAY_LENGTH(sig->ec_signature);
+       sig_idx++) {
     // Get the index of the public key in the signature mask
-    int key_idx = __builtin_ctz(sigmask);
+    size_t key_idx = __builtin_ctz(sigmask);
     if (key_idx >= ARRAY_LENGTH(BOARDLOADER_PQ_KEYS)) {
       return secfalse;
     }

### core/embed/sec/monoctr/stm32u5/monoctr.c
@@ -112,7 +112,7 @@ secbool monoctr_read(monoctr_type_t type, uint8_t *value) {
 
   int counter = 0;
 
-  int i = 0;
+  size_t i = 0;
 
   for (i = 0; i < length / 16; i++) {
     secbool not_cleared = sectrue;

### core/embed/sec/optiga/inc/sec/optiga_commands.h
@@ -173,10 +173,10 @@ typedef struct {
 
 #define OPTIGA_ECC_KEY_COUNT 4
 #define OPTIGA_CERT_COUNT 4
-#define OPTIGA_MAX_METADATA_SIZE 44
-#define OPTIGA_RANDOM_MIN_SIZE 8
-#define OPTIGA_RANDOM_MAX_SIZE 256
-#define OPTIGA_MAX_CERT_SIZE 1728
+#define OPTIGA_MAX_METADATA_SIZE 44U
+#define OPTIGA_RANDOM_MIN_SIZE 8U
+#define OPTIGA_RANDOM_MAX_SIZE 256U
+#define OPTIGA_MAX_CERT_SIZE 1728U
 
 // The throttling delay when the security event counter is at its maximum.
 #define OPTIGA_T_MAX_MS 5000

### core/embed/sec/optiga/optiga_commands.c
@@ -111,7 +111,8 @@ static void operation_add_time(uint32_t *total_time_ms, uint8_t *optiga_sec,
 
 static optiga_result process_output(uint8_t **out_data, size_t *out_size) {
   // Check that there is no trailing output data in the response.
-  if (tx_size < 4 || (tx_buffer[2] << 8) + tx_buffer[3] != tx_size - 4) {
+  if (tx_size < 4 ||
+      ((size_t)(tx_buffer[2] << 8) + tx_buffer[3]) != tx_size - 4) {
     return OPTIGA_ERR_UNEXPECTED;
   }
 
@@ -217,7 +218,7 @@ optiga_result optiga_parse_metadata(const uint8_t *serialized,
   memzero(metadata, sizeof(*metadata));
 
   if (serialized_size < 2 || serialized[0] != 0x20 ||
-      serialized[1] + 2 != serialized_size) {
+      (size_t)(serialized[1] + 2) != serialized_size) {
     return OPTIGA_ERR_PARAM;
   }
 
@@ -229,7 +230,7 @@ optiga_result optiga_parse_metadata(const uint8_t *serialized,
 
     // Determine metadata type from tag.
     optiga_metadata_item *item = NULL;
-    for (int i = 0; i < METADATA_TAG_COUNT; ++i) {
+    for (size_t i = 0; i < METADATA_TAG_COUNT; ++i) {
       if (METADATA_OFFSET_TAG_MAP[i].tag == serialized[pos]) {
         item = (void *)((char *)metadata + METADATA_OFFSET_TAG_MAP[i].offset);
         break;
@@ -265,7 +266,7 @@ optiga_result optiga_serialize_metadata(const optiga_metadata *metadata,
   serialized[0] = 0x20;  // Metadata constructed TLV-Object tag.
   size_t pos = 2;        // Leave room for length byte.
 
-  for (int i = 0; i < METADATA_TAG_COUNT; ++i) {
+  for (size_t i = 0; i < METADATA_TAG_COUNT; ++i) {
     optiga_metadata_item *item =
         (void *)((char *)metadata + METADATA_OFFSET_TAG_MAP[i].offset);
     if (item->ptr == NULL) {
@@ -297,7 +298,7 @@ optiga_result optiga_serialize_metadata(const optiga_metadata *metadata,
 // metadata may have arbitrary value in the stored metadata.
 bool optiga_compare_metadata(const optiga_metadata *expected,
                              const optiga_metadata *stored) {
-  for (int i = 0; i < METADATA_TAG_COUNT; ++i) {
+  for (size_t i = 0; i < METADATA_TAG_COUNT; ++i) {
     const optiga_metadata_item *expected_item =
         (void *)((char *)expected + METADATA_OFFSET_TAG_MAP[i].offset);
     if (expected_item->ptr == NULL) {

### core/embed/sec/optiga/optiga_transport.c
@@ -436,7 +436,7 @@ optiga_result optiga_set_data_reg_len(size_t size) {
     return ret;
   }
 
-  if ((frame_buffer[0] << 8) + frame_buffer[1] != size) {
+  if ((size_t)((frame_buffer[0] << 8) + frame_buffer[1]) != size) {
     return OPTIGA_ERR_SIZE;
   }
   return OPTIGA_SUCCESS;

### core/embed/sec/secret/stm32f4/secret.c
@@ -92,7 +92,7 @@ void secret_write_header(void) {
 secbool secret_write(const uint8_t* data, uint32_t offset, uint32_t len) {
   mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_SECRET);
   ensure(flash_unlock_write(), "secret write");
-  for (int i = 0; i < len; i++) {
+  for (uint32_t i = 0; i < len; i++) {
     if (sectrue != flash_area_write_byte(&SECRET_AREA, offset + i, data[i])) {
       ensure(flash_lock_write(), "secret write");
       mpu_restore(mpu_mode);
@@ -129,7 +129,7 @@ static secbool secret_wiped(void) {
 
   mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_SECRET);
 
-  for (int i = 0; i < size; i += 4) {
+  for (uint32_t i = 0; i < size; i += 4) {
     uint32_t* addr = (uint32_t*)flash_area_get_address(&SECRET_AREA, i, 4);
     if (addr == NULL) {
       wiped = secfalse;

### core/embed/sec/secret/stm32u5/secret.c
@@ -226,9 +226,9 @@ static secbool secret_record_present(uint32_t offset, uint32_t len) {
 
   mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_SECRET);
 
-  int secret_empty_bytes = 0;
+  uint32_t secret_empty_bytes = 0;
 
-  for (int i = 0; i < len; i++) {
+  for (uint32_t i = 0; i < len; i++) {
     // 0xFF being the default value of the flash memory (before any write)
     // 0x00 being the value of the flash memory after manual erase
     if (secret[i] == 0xFF || secret[i] == 0x00) {
@@ -269,9 +269,9 @@ secbool secret_key_writable(uint8_t slot) {
 
   mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_SECRET);
 
-  int secret_empty_bytes = 0;
+  uint32_t secret_empty_bytes = 0;
 
-  for (int i = 0; i < len; i++) {
+  for (uint32_t i = 0; i < len; i++) {
     // 0xFF being the default value of the flash memory (before any write)
     // 0x00 being the value of the flash memory after manual erase
     if (secret[i] == 0xFF) {
@@ -296,12 +296,12 @@ static void secret_key_cache(uint8_t slot) {
   volatile uint32_t *reg = &TAMP->BKP0R;
   reg += reg_offset;
   if (sectrue == ok) {
-    for (int i = 0; i < (len / sizeof(uint32_t)); i++) {
+    for (uint32_t i = 0; i < (len / sizeof(uint32_t)); i++) {
       *reg = secret[i];
       reg++;
     }
   } else {
-    for (int i = 0; i < (len / sizeof(uint32_t)); i++) {
+    for (uint32_t i = 0; i < (len / sizeof(uint32_t)); i++) {
       *reg = 0;
       reg++;
     }
@@ -351,7 +351,7 @@ secbool secret_key_get(uint8_t slot, uint8_t *dest, size_t len) {
 
   bool all_zero = true;
   volatile uint32_t *reg = &TAMP->BKP0R;
-  for (int i = 0; i < (len / sizeof(uint32_t)); i++) {
+  for (size_t i = 0; i < (len / sizeof(uint32_t)); i++) {
     secret[i] = reg[i + reg_offset];
 
     if (secret[i] != 0) {
@@ -376,7 +376,7 @@ __attribute__((unused)) static void secret_key_uncache(uint8_t slot) {
   uint32_t slot_len = secret_get_slot_len(slot);
 
   volatile uint32_t *reg = &TAMP->BKP0R;
-  for (int i = 0; i < slot_len / sizeof(uint32_t); i++) {
+  for (uint32_t i = 0; i < slot_len / sizeof(uint32_t); i++) {
     reg[i + reg_offset] = 0;
   }
 }
@@ -409,12 +409,12 @@ static void secret_bhk_load(void) {
 
   volatile uint32_t *reg1 = &TAMP->BKP0R;
   if (sectrue == ok) {
-    for (int i = 0; i < (SECRET_BHK_LEN / sizeof(uint32_t)); i++) {
+    for (size_t i = 0; i < (SECRET_BHK_LEN / sizeof(uint32_t)); i++) {
       *reg1 = ((uint32_t *)secret)[i];
       reg1++;
     }
   } else {
-    for (int i = 0; i < (SECRET_BHK_LEN / sizeof(uint32_t)); i++) {
+    for (size_t i = 0; i < (SECRET_BHK_LEN / sizeof(uint32_t)); i++) {
       *reg1 = 0;
       reg1++;
     }
@@ -429,7 +429,7 @@ void secret_bhk_regenerate(void) {
   ensure(flash_area_erase(&BHK_AREA, NULL), "Failed regenerating BHK");
   ensure(flash_unlock_write(), "Failed regenerating BHK");
   uint32_t val[8] = {0};
-  for (int j = 0; j < ARRAY_LENGTH(val); j++) {
+  for (size_t j = 0; j < ARRAY_LENGTH(val); j++) {
     val[j] = rng_get();
   }
   secbool res = flash_area_write_data(&BHK_AREA, 0, val, sizeof(val));

### core/embed/sec/secure_aes/stm32u5/secure_aes_unpriv.c
@@ -88,7 +88,7 @@ __attribute((no_stack_protector)) void saes_unpriv_callback(void) {
     SET_BIT(SAES->ICR, CRYP_CLEAR_CCF);
 
     /* Read the output block from the output FIFO */
-    for (int i = 0U; i < 4U; i++) {
+    for (size_t i = 0U; i < 4U; i++) {
       saes_unpriv_output[j * 4 + i] = SAES->DOUTR;
     }
   }

### core/embed/sec/trustzone/stm32u5/tz_init.c
@@ -157,7 +157,7 @@ static void tz_configure_sram(void) {
   mpcbb.AttributeConfig.MPCBB_LockConfig_array[0] = 0x00000000U;
 
   // Set all blocks secured & privileged
-  for (int index = 0; index < GTZC_MPCBB_NB_VCTR_REG_MAX; index++) {
+  for (size_t index = 0; index < GTZC_MPCBB_NB_VCTR_REG_MAX; index++) {
     mpcbb.AttributeConfig.MPCBB_SecConfig_array[index] = 0xFFFFFFFFU;
     mpcbb.AttributeConfig.MPCBB_PrivConfig_array[index] = 0xFFFFFFFFU;
   }
@@ -192,7 +192,7 @@ static void tz_configure_flash(void) {
   FLASH_BBAttributesTypeDef flash_bb = {0};
 
   // Set all blocks as secured & privileged
-  for (int index = 0; index < FLASH_BLOCKBASED_NB_REG; index++) {
+  for (size_t index = 0; index < FLASH_BLOCKBASED_NB_REG; index++) {
     flash_bb.BBAttributes_array[index] = 0xFFFFFFFF;
   }
 

### core/embed/sys/bsp/build.rs
@@ -125,7 +125,6 @@ fn add_stm32f4_bsp(lib: &mut CLibrary) -> Result<()> {
             "stm32f4xx_hal_gpio.c",
             "stm32f4xx_hal_i2c.c",
             "stm32f4xx_hal_ltdc.c",
-            "stm32f4xx_hal_pcd.c",
             "stm32f4xx_hal_pcd_ex.c",
             "stm32f4xx_hal_pwr.c",
             "stm32f4xx_hal_rcc.c",
@@ -142,6 +141,12 @@ fn add_stm32f4_bsp(lib: &mut CLibrary) -> Result<()> {
         ],
     );
 
+    lib.add_sources_in_dir_with_attrs(
+        "../../vendor/micropython/lib/stm32lib/STM32F4xx_HAL_Driver/Src/",
+        ["stm32f4xx_hal_pcd.c"],
+        Some(CompileAttrs::new().with_flag("-Wno-sign-compare")),
+    );
+
     lib.add_sources_in_dir_with_attrs(
         "../../vendor/micropython/lib/stm32lib/STM32F4xx_HAL_Driver/Src/",
         ["stm32f4xx_hal_flash.c", "stm32f4xx_hal_flash_ex.c"],

### core/embed/sys/dbg/syslog.c
@@ -150,7 +150,7 @@ bool syslog_start_record(const log_source_t* source, log_level_t level) {
     irq_unlock(irq_key);
 #endif
 
-    int name_len = (int)MIN(source->name_len, INT32_MAX);
+    int name_len = (int)MIN(source->name_len, (size_t)INT32_MAX);
 
     dbg_console_printf("%s%" PRIu32 ".%03" PRIu32 " " ESC_COLOR_SOURCE
                        "%.*s" ESC_COLOR_NORMAL " %s ",

### core/embed/sys/flash/unix/flash.c
@@ -102,7 +102,7 @@ void flash_init(void) {
   if (r != 0 || sb.st_size != FLASH_SIZE) {
     int fd = open(FLASH_FILE, O_RDWR | O_CREAT | O_TRUNC, (mode_t)0600);
     ensure(sectrue * (fd >= 0), "open failed");
-    for (int i = 0; i < FLASH_SIZE / 16; i++) {
+    for (uint32_t i = 0; i < FLASH_SIZE / 16; i++) {
       ssize_t s = write(
           fd,
           "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF",

### core/embed/sys/startup/inc/sys/bootargs.h
@@ -45,7 +45,7 @@ typedef enum {
 } boot_command_t;
 
 // Maximum size boot_args array
-#define BOOT_ARGS_MAX_SIZE (256 - 8)
+#define BOOT_ARGS_MAX_SIZE ((size_t)(256 - 8))
 
 typedef union {
   uint8_t raw[BOOT_ARGS_MAX_SIZE];

### core/embed/sys/task/sysevent.c
@@ -394,7 +394,8 @@ ssize_t syshandle_write_blocking(syshandle_t handle, const void *data,
       ssize_t written = syshandle_write(handle, ptr, remaining);
 
       if (written < 0) {
-        return remaining == data_size ? written : data_size - remaining;
+        return remaining == data_size ? written
+                                      : (ssize_t)(data_size - remaining);
       }
 
       ptr += written;

### core/embed/sys/task/unix/sdl_event.c
@@ -40,7 +40,7 @@ static sdl_event_dispatcher_t g_sdl_event_dispatcher = {0};
 bool sdl_events_register(sdl_event_filter_cb_t callback, void* context) {
   sdl_event_dispatcher_t* dispatcher = &g_sdl_event_dispatcher;
 
-  for (int index = 0; index < ARRAY_LENGTH(dispatcher->filter); index++) {
+  for (size_t index = 0; index < ARRAY_LENGTH(dispatcher->filter); index++) {
     sdl_event_filter_t* filter = &dispatcher->filter[index];
     if (filter->callback == NULL) {
       filter->callback = callback;
@@ -55,7 +55,7 @@ bool sdl_events_register(sdl_event_filter_cb_t callback, void* context) {
 void sdl_events_unregister(sdl_event_filter_cb_t callback, void* context) {
   sdl_event_dispatcher_t* dispatcher = &g_sdl_event_dispatcher;
 
-  for (int index = 0; index < ARRAY_LENGTH(dispatcher->filter); index++) {
+  for (size_t index = 0; index < ARRAY_LENGTH(dispatcher->filter); index++) {
     sdl_event_filter_t* filter = &dispatcher->filter[index];
     if (filter->callback == callback && filter->context == context) {
       filter->callback = NULL;
@@ -74,7 +74,8 @@ void sdl_events_poll(void) {
 
     // Process all pending events
     while (SDL_PollEvent(&sdl_event)) {
-      for (int index = 0; index < ARRAY_LENGTH(dispatcher->filter); index++) {
+      for (size_t index = 0; index < ARRAY_LENGTH(dispatcher->filter);
+           index++) {
         sdl_event_filter_t* filter = &dispatcher->filter[index];
         if (filter->callback != NULL) {
           filter->callback(filter->context, &sdl_event);

### core/embed/sys/trustzone/stm32u5/trustzone.c
@@ -96,7 +96,7 @@ void tz_set_sram_unpriv(uint32_t start, uint32_t size, bool unpriv) {
 
   uint32_t end = start + size;
 
-  for (int idx = 0; idx < ARRAY_LENGTH(g_sram_regions); idx++) {
+  for (size_t idx = 0; idx < ARRAY_LENGTH(g_sram_regions); idx++) {
     const sram_region_t* r = &g_sram_regions[idx];
 
     if (start >= r->end) {
@@ -138,7 +138,7 @@ void tz_set_sram_unsecure(uint32_t start, uint32_t size, bool unsecure) {
   }
 #endif
 
-  for (int idx = 0; idx < ARRAY_LENGTH(g_sram_regions); idx++) {
+  for (size_t idx = 0; idx < ARRAY_LENGTH(g_sram_regions); idx++) {
     const sram_region_t* r = &g_sram_regions[idx];
 
     if (start >= r->end) {
@@ -207,7 +207,7 @@ void tz_set_flash_unpriv(uint32_t start, uint32_t size, bool unpriv) {
 
   uint32_t end = start + size;
 
-  for (int idx = 0; idx < ARRAY_LENGTH(g_flash_regions); idx++) {
+  for (size_t idx = 0; idx < ARRAY_LENGTH(g_flash_regions); idx++) {
     const flash_region_t* r = &g_flash_regions[idx];
 
     if (start >= r->end) {
@@ -249,7 +249,7 @@ void tz_set_flash_unsecure(uint32_t start, uint32_t size, bool unsecure) {
   }
 #endif
 
-  for (int idx = 0; idx < ARRAY_LENGTH(g_flash_regions); idx++) {
+  for (size_t idx = 0; idx < ARRAY_LENGTH(g_flash_regions); idx++) {
     const flash_region_t* r = &g_flash_regions[idx];
 
     if (start >= r->end) {

### core/embed/upymod/modtrezorcrypto/modtrezorcrypto-ed25519.h
@@ -184,7 +184,7 @@ static mp_obj_t mod_trezorcrypto_ed25519_cosi_combine_publickeys(
   mp_buffer_info_t buf = {0};
   ed25519_public_key pks[pklen];
   memset(pks, 0, sizeof(pks));
-  for (int i = 0; i < pklen; i++) {
+  for (size_t i = 0; i < pklen; i++) {
     mp_get_buffer_raise(pkitems[i], &buf, MP_BUFFER_READ);
     if (buf.len != 32) {
       mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of public key"));
@@ -227,7 +227,7 @@ static mp_obj_t mod_trezorcrypto_ed25519_cosi_combine_signatures(
   mp_buffer_info_t buf = {0};
   ed25519_cosi_signature sigs[siglen];
   memset(sigs, 0, sizeof(sigs));
-  for (int i = 0; i < siglen; i++) {
+  for (size_t i = 0; i < siglen; i++) {
     mp_get_buffer_raise(sigitems[i], &buf, MP_BUFFER_READ);
     if (buf.len != 32) {
       mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of COSI signature"));

### core/embed/upymod/modtrezorcrypto/modtrezorcrypto-monero.h
@@ -112,7 +112,7 @@ static mp_obj_t mp_obj_new_ge25519_r(mp_obj_t r) {
 static void mp_unpack_ge25519(ge25519 *r, const mp_obj_t arg, mp_int_t offset) {
   mp_buffer_info_t buff = {0};
   mp_get_buffer_raise(arg, &buff, MP_BUFFER_READ);
-  if (buff.len < 32 + offset) {
+  if (offset < 0 || buff.len < 32 + (size_t)offset) {
     mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of the EC point"));
   }
 
@@ -126,7 +126,7 @@ static void mp_unpack_scalar(bignum256modm r, const mp_obj_t arg,
                              mp_int_t offset) {
   mp_buffer_info_t buff = {0};
   mp_get_buffer_raise(arg, &buff, MP_BUFFER_READ);
-  if (buff.len < 32 + offset) {
+  if (offset < 0 || buff.len < 32 + (size_t)offset) {
     mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of secret key"));
   }
   expand256_modm(r, ((uint8_t *)buff.buf) + offset, 32);
@@ -433,7 +433,7 @@ static mp_obj_t mod_trezorcrypto_monero_encodeint_into(size_t n_args,
     mp_buffer_info_t bufm = {0};
     mp_get_buffer_raise(args[0], &bufm, MP_BUFFER_WRITE);
     const mp_int_t offset = n_args >= 3 ? mp_obj_get_int(args[2]) : 0;
-    if (bufm.len < 32 + offset) {
+    if (offset < 0 || bufm.len < 32 + (size_t)offset) {
       mp_raise_ValueError(MP_ERROR_TEXT("Buffer too small"));
     }
 
@@ -477,7 +477,7 @@ static mp_obj_t mod_trezorcrypto_monero_decodeint_into_noreduce(
 
   mp_buffer_info_t buff = {0};
   mp_get_buffer_raise(args[1], &buff, MP_BUFFER_READ);
-  if (buff.len != 32 + offset) {
+  if (offset < 0 || buff.len != 32 + (size_t)offset) {
     mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of secret key"));
   }
 
@@ -693,7 +693,7 @@ static mp_obj_t mod_trezorcrypto_monero_encodepoint_into(size_t n_args,
     mp_buffer_info_t bufm = {0};
     mp_get_buffer_raise(args[0], &bufm, MP_BUFFER_WRITE);
     const mp_int_t offset = n_args >= 3 ? mp_obj_get_int(args[2]) : 0;
-    if (bufm.len < 32 + offset) {
+    if (offset < 0 || bufm.len < 32 + (size_t)offset) {
       mp_raise_ValueError(MP_ERROR_TEXT("Buffer too small"));
     }
 
@@ -826,11 +826,12 @@ static mp_obj_t mod_trezorcrypto_monero_fast_hash_into(size_t n_args,
 
   mp_buffer_info_t data = {0};
   mp_get_buffer_raise(args[1], &data, MP_BUFFER_READ);
-  mp_int_t length = n_args >= 3 ? mp_obj_get_int(args[2]) : data.len;
+  mp_int_t length = n_args >= 3 ? mp_obj_get_int(args[2]) : (mp_int_t)data.len;
   mp_int_t offset = n_args >= 4 ? mp_obj_get_int(args[3]) : 0;
   if (length < 0) length += data.len;
   if (offset < 0) offset += data.len;
-  if (length < 0 || offset < 0 || offset + length > data.len) {
+  if (length < 0 || offset < 0 || (size_t)offset > data.len ||
+      (size_t)length > data.len - (size_t)offset) {
     mp_raise_ValueError(MP_ERROR_TEXT("Illegal offset/length"));
   }
   xmr_fast_hash(buff_use, (const char *)data.buf + offset, length);
@@ -855,11 +856,12 @@ static mp_obj_t mod_trezorcrypto_monero_hash_to_point_into(
   mp_obj_t res = mp_obj_new_ge25519_r(args[0]);
   mp_buffer_info_t data = {0};
   mp_get_buffer_raise(args[1], &data, MP_BUFFER_READ);
-  mp_int_t length = n_args >= 3 ? mp_obj_get_int(args[2]) : data.len;
+  mp_int_t length = n_args >= 3 ? mp_obj_get_int(args[2]) : (mp_int_t)data.len;
   mp_int_t offset = n_args >= 4 ? mp_obj_get_int(args[3]) : 0;
   if (length < 0) length += data.len;
   if (offset < 0) offset += data.len;
-  if (length < 0 || offset < 0 || offset + length > data.len) {
+  if (length < 0 || offset < 0 || (size_t)offset > data.len ||
+      (size_t)length > data.len - (size_t)offset) {
     mp_raise_ValueError(MP_ERROR_TEXT("Illegal offset/length"));
   }
 
@@ -885,11 +887,12 @@ static mp_obj_t mod_trezorcrypto_monero_hash_to_scalar_into(
   mp_obj_t res = mp_obj_new_scalar_r(args[0]);
   mp_buffer_info_t data = {0};
   mp_get_buffer_raise(args[1], &data, MP_BUFFER_READ);
-  mp_int_t length = n_args >= 3 ? mp_obj_get_int(args[2]) : data.len;
+  mp_int_t length = n_args >= 3 ? mp_obj_get_int(args[2]) : (mp_int_t)data.len;
   mp_int_t offset = n_args >= 4 ? mp_obj_get_int(args[3]) : 0;
   if (length < 0) length += data.len;
   if (offset < 0) offset += data.len;
-  if (length < 0 || offset < 0 || offset + length > data.len) {
+  if (length < 0 || offset < 0 || (size_t)offset > data.len ||
+      (size_t)length > data.len - (size_t)offset) {
     mp_raise_ValueError(MP_ERROR_TEXT("Illegal offset/length"));
   }
   xmr_hash_to_scalar(MP_OBJ_SCALAR(res), (const char *)data.buf + offset,

### core/embed/upymod/modtrezorcrypto/modtrezorcrypto-shamir.h
@@ -49,7 +49,7 @@ mp_obj_t mod_trezorcrypto_shamir_interpolate(mp_obj_t shares, mp_obj_t x) {
   uint8_t share_indices[SHAMIR_MAX_SHARE_COUNT] = {0};
   const uint8_t *share_values[SHAMIR_MAX_SHARE_COUNT] = {0};
   size_t value_len = 0;
-  for (int i = 0; i < share_count; ++i) {
+  for (size_t i = 0; i < share_count; ++i) {
     mp_obj_t *share = NULL;
     mp_obj_get_array_fixed_n(share_items[i], 2, &share);
     share_indices[i] = trezor_obj_get_uint8(share[0]);

### core/embed/upymod/modtrezorio/modtrezorio-usb-if.h
@@ -85,7 +85,7 @@ static mp_obj_t mod_trezorio_USBIF_write(mp_obj_t self, mp_obj_t msg) {
 
   ssize_t r = syshandle_write(o->handle, buf.buf, buf.len);
 
-  if (r != buf.len) {
+  if (r < 0 || (size_t)r != buf.len) {
     mp_raise_msg(&mp_type_OSError, MP_ERROR_TEXT("Write failed"));
   }
 
@@ -104,15 +104,15 @@ static mp_obj_t mod_trezorio_USBIF_read(size_t n_args, const mp_obj_t *args) {
   mp_get_buffer_raise(args[1], &buf, MP_BUFFER_WRITE);
 
   int offset = 0;
-  if (n_args >= 2) {
+  if (n_args >= 3) {
     offset = mp_obj_get_int(args[2]);
   }
 
   if (offset < 0) {
     mp_raise_ValueError(MP_ERROR_TEXT("Negative offset not allowed"));
   }
 
-  if (offset > buf.len) {
+  if ((size_t)offset > buf.len) {
     mp_raise_ValueError(MP_ERROR_TEXT("Offset out of bounds"));
   }