fix(core): increase `MAX_SUBSCREENS` a bit
What the developer wrote
Authored by Roman Zeyde
fix(core): increase `MAX_SUBSCREENS` a bit
Otherwise, entering the menu when there is
a connected BLE device results in a RSOD.
[no changelog]
What changed, and why it matters
This commit fixes a bug where opening the device menu on a Trezor hardware wallet would crash with a red screen of death (RSOD) if a Bluetooth device was connected. The fix simply increases the maximum number of subscreens the menu system can handle from 8 to 10, because the Bluetooth menu entries push the count over the previous limit. There is no evidence this is exploitable by an attacker.
Treat as a reliability/UX bug fix rather than a security vulnerability. Verify the new limit covers all expected menu states, including future BLE-related entries, and consider adding a runtime assertion or graceful fallback instead of relying on a hardcoded constant.
Security signals we found
Denial-of-service-like crash condition (RSOD) triggered by normal UI state
Buffer/capacity limit (`heapless::Vec`) increased to prevent overflow
Crash tied to specific runtime condition: connected BLE device
Evidence from the diff
The change increases the MAX_SUBSCREENS constant in device_menu_screen.rs from 8 to 10. The menu uses a heapless::Vec bounded by this constant to hold nested subscreens. When a BLE device is connected, the menu contains additional entries (e.g., disconnect option), causing the number of subscreens to exceed 8 and trigger an out-of-capacity panic/RSOD. The patch is a straightforward capacity bump with no logic changes.
Changed components
core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rsTrezor Safe 5 / Eckhart layout firmware UIDevice menu screen renderingInspect captured patch +1 / −1
diff --git a/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs b/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs
index 09ff624f..e5f54505 100644
--- a/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs
+++ b/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs
@@ -33,7 +33,7 @@ use super::{
use heapless::Vec;
const MAX_DEPTH: usize = 3;
-const MAX_SUBSCREENS: usize = 8;
+const MAX_SUBSCREENS: usize = 10;
const MAX_SUBMENUS: usize = MAX_SUBSCREENS - 2 /* (about and device screen) */;
const DISCONNECT_DEVICE_MENU_INDEX: usize = 1;
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.