fix(core): correct BLE interface syshandle
What the developer wrote
Authored by Roman Zeyde
fix(core): correct BLE interface syshandle
[no changelog]
What changed, and why it matters
This commit fixes a hard-coded Bluetooth Low Energy (BLE) interface identifier in the Trezor hardware wallet firmware. The old code used a fixed number (8) with a comment saying it should be replaced by the proper system handle. The fix now uses the correct generated constant. Using the wrong identifier could cause the BLE communication interface to be misidentified, which might lead to communication errors or, in a worst-case security scenario, allow an attacker to confuse the device about which channel data is arriving on. The change is small and defensive, but the commit message gives no details about any actual security issue.
Treat as a low-risk correctness fix. Include in routine firmware updates. If the device uses BLE for sensitive communication, verify that interface numbering is consistent across the C and Rust BLE stacks and that channel isolation tests still pass. No urgent security response is indicated by the available evidence.
Security signals we found
Hard-coded identifier replaced with generated system constant
FIXME comment removed, indicating a known latent bug
BLE interface handle correctness fix
Potential channel/interface confusion risk
Evidence from the diff
In core/embed/rust/src/trezorhal/ble/micropython.rs, the py_iface_num MicroPython binding previously returned Obj::small_int(8) with a FIXME referencing SYSHANDLE_BLE_IFACE_0. The patch replaces the literal 8 with a conversion of the ffi::syshandle_t_SYSHANDLE_BLE_IFACE_0 constant. This aligns the Rust BLE interface number with the C-generated system handle. A mismatch could cause the wrong interface to be reported to higher-level code, potentially breaking channel isolation assumptions for BLE traffic. The patch is a one-line correctness fix; no exploit or incident details are provided in the commit or references.
Changed components
Trezor Core firmwareBLE MicroPython bindingscore/embed/rust/src/trezorhal/ble/micropython.rsInspect captured patch +1 / −1
diff --git a/core/embed/rust/src/trezorhal/ble/micropython.rs b/core/embed/rust/src/trezorhal/ble/micropython.rs
index d1fb64a67..fc4af7543 100644
--- a/core/embed/rust/src/trezorhal/ble/micropython.rs
+++ b/core/embed/rust/src/trezorhal/ble/micropython.rs
@@ -172,7 +172,7 @@ extern "C" fn py_get_bonds() -> Obj {
}
extern "C" fn py_iface_num(_self: Obj) -> Obj {
- Obj::small_int(8) // FIXME SYSHANDLE_BLE_IFACE_0
+ Obj::small_int(unwrap!(ffi::syshandle_t_SYSHANDLE_BLE_IFACE_0.try_into()))
}
extern "C" fn py_iface_write(_self: Obj, msg: Obj) -> Obj {
Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.