Fenrir fixes 2026 07 02 - #814

Merged

dgarske merged 23 commits into

wolfSSL:masterfrom

danielinux:fenrir-fixes-2026-07-02

Jul 2, 2026

Commits on Jul 2, 2026

F-6407: zeroize static cached_sector after each flash commit in psa_store
danielinux
committed
228c9d6
F-6402: add negative tests pinning wolfBoot_check_rot digest comparison
danielinux
committed
60acdc2
F-6129: zeroize disk-unlock secret before the state-mismatch panic in sata_unlock_disk
danielinux
committed
20f11ae
F-5968: zeroize disk-unlock passphrase from static ATA command buffer
danielinux
committed
cd4e4be
F-5965: skip wb_diff match candidates whose offset MSB collides with ESC
danielinux
committed
9ce750f
F-5963: fix over-advance of address/len in unaligned hal_flash_write (kinetis.c, mcxa.c, mcxw.c)
danielinux
committed
fea97c5
F-6408: zeroize UDS from OTP keystore generator's heap and stack buffers
danielinux
committed
8df9689
F-6403: add successful-boot test coverage for HW-swap wolfBoot_start
danielinux
committed
f20a1e1
F-6401: emit build-time warning for FPGA_NONFATAL=1
danielinux
committed
e09074a
F-6399: fix imx_rt DCACHE invalidation to include down-alignment offset
danielinux
committed
32e41f0
F-6398: fix OOB write in bmpatch when reconstructed image grows past source size
danielinux
committed
e38296c
F-6130: clear disk_encrypt_key/nonce before panic paths that skip the final cleanup
danielinux
committed
dd0712e
F-6127: fix custom-TLV 8-byte value saturation in arg2num
danielinux
committed
9a25fae
F-6126: add mutation-pinning test coverage for wolfBoot_check_flash_image_elf
danielinux
committed
72186fa
F-6124: emit build-time warning for SIGN=NONE / WOLFBOOT_NO_SIGN
danielinux
committed
eb5574f
F-5964: fix stale in-word offset in hal_flash_write byte-wise path (samr21/same51)
danielinux
committed
102ddc3
F-6405: pin partition-fit accept boundary in wolfBoot_open_image_address/open_self_address
danielinux
committed
dd16ccb
F-6131: enforce full-transfer bounds check in spi_flash_read/spi_flash_write (QSPI)
danielinux
committed
c4e853e
Added new tests to .gitignore
danielinux
committed
0955a42
hal: advance source index in aligned flash-write fast path
danielinux
committed
aecf904
hal/mcxw: fix truncated empty-word sentinel
danielinux
committed
d977baa
tools/delta: check pwrite result in bmpatch
danielinux
committed
103eec9
unit-tests: build otp-keystore-gen test without generated keystore.c
danielinux
committed
d383fc1

Navigation Menu

Uh oh!

Fenrir fixes 2026 07 02 - #814

Fenrir fixes 2026 07 02#814
dgarske merged 23 commits into
wolfSSL:masterfrom
danielinux:fenrir-fixes-2026-07-02

Commits on Jul 2, 2026

F-6407: zeroize static cached_sector after each flash commit in psa_store

F-6402: add negative tests pinning wolfBoot_check_rot digest comparison

F-6129: zeroize disk-unlock secret before the state-mismatch panic in sata_unlock_disk

F-5968: zeroize disk-unlock passphrase from static ATA command buffer

F-5965: skip wb_diff match candidates whose offset MSB collides with ESC

F-5963: fix over-advance of address/len in unaligned hal_flash_write (kinetis.c, mcxa.c, mcxw.c)

F-6408: zeroize UDS from OTP keystore generator's heap and stack buffers

F-6403: add successful-boot test coverage for HW-swap wolfBoot_start

F-6401: emit build-time warning for FPGA_NONFATAL=1

F-6399: fix imx_rt DCACHE invalidation to include down-alignment offset

F-6398: fix OOB write in bmpatch when reconstructed image grows past source size

F-6130: clear disk_encrypt_key/nonce before panic paths that skip the final cleanup

F-6127: fix custom-TLV 8-byte value saturation in arg2num

F-6126: add mutation-pinning test coverage for wolfBoot_check_flash_image_elf

F-6124: emit build-time warning for SIGN=NONE / WOLFBOOT_NO_SIGN

F-5964: fix stale in-word offset in hal_flash_write byte-wise path (samr21/same51)

F-6405: pin partition-fit accept boundary in wolfBoot_open_image_address/open_self_address

F-6131: enforce full-transfer bounds check in spi_flash_read/spi_flash_write (QSPI)

Added new tests to .gitignore

hal: advance source index in aligned flash-write fast path

hal/mcxw: fix truncated empty-word sentinel

tools/delta: check pwrite result in bmpatch

unit-tests: build otp-keystore-gen test without generated keystore.c