fix(core): don't send disconnect notification on pairing mode entry
What the developer wrote
Authored by tychovrahe
fix(core): don't send disconnect notification on pairing mode entry
[no changelog]
(cherry picked from commit 8caad2a02f6a121faef66d52e6a2f221779410a6)
What changed, and why it matters
This commit removes a step in the Trezor hardware wallet's Bluetooth pairing flow. Previously, when entering pairing mode, the device forcibly sent a disconnect notification, waited 300 milliseconds, and then disconnected any active Bluetooth connection. The patch skips that forced disconnect. The change could matter for security because sending a disconnect notification before pairing might have leaked that the device was about to pair, or the forced disconnect could have disrupted a secure session at a sensitive moment. However, the commit message gives no security explanation, so this is mostly a functional or UX fix.
Treat as a low-confidence functional fix unless additional context shows the old disconnect behavior caused a security issue. Reviewers should confirm that removing the forced disconnect does not allow pairing mode to start while a sensitive host session is still active, and that the pairing UI cannot be triggered remotely or without user confirmation.
Security signals we found
Bluetooth pairing flow changed
Forced disconnect notification removed
Timing/delay removed before pairing
No changelog or security explanation provided
Evidence from the diff
In core/src/apps/homescreen/device_menu.py, the code that checks ble.is_connected(), sends utils.NOTIFY_DISCONNECT, sleeps 300 ms, and calls ble.disconnect() before pair_new_device() is deleted. The remaining logic proceeds straight to pair_new_device() if bond slots are available, or shows a warning if BLE_MAX_BONDS is reached. No replacement disconnect logic is added. The commit is a cherry-pick and has no changelog entry.
Changed components
core/src/apps/homescreen/device_menu.pyBluetooth LE pairing flowDevice menu / pairing mode entryInspect captured patch +0 / −5
diff --git a/core/src/apps/homescreen/device_menu.py b/core/src/apps/homescreen/device_menu.py
index ea2cbe2b4..bd3bb452d 100644
--- a/core/src/apps/homescreen/device_menu.py
+++ b/core/src/apps/homescreen/device_menu.py
@@ -211,11 +211,6 @@ async def handle_device_menu() -> None:
ble_enable(True)
try:
- if ble.is_connected():
- utils.notify_send(utils.NOTIFY_DISCONNECT)
- utime.sleep_ms(300)
- ble.disconnect()
-
if len(paired_devices) < BLE_MAX_BONDS:
await pair_new_device()
else:
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.