Fenrir fixes 2026 08 21 - #868

Open

danielinux wants to merge 27 commits into

wolfSSL:masterfrom

danielinux:fenrir-fixes-2026-08-21

Commits on Aug 21, 2026

F-7380: make SAMA5D3 ext_flash_read byte-accurate for partial pages
danielinux
committed
f5401b0
F-7381: fail SAMA5D3 NAND write/erase instead of reporting success
danielinux
committed
0a6a5fe
F-9759: document that QE/FMan microcode is not authenticated
danielinux
committed
431b015
F-7970: free the LMS key on the parameter/import error paths
danielinux
committed
ce5f20c
F-7971: free the ECC key on the wolfHSM setup error paths
danielinux
committed
d722c0f
F-7974: declare hdr_cpy_done as int in both translation units
danielinux
committed
c5ae368
F-7056: fix node-found guards and esdhc log label in hal_dts_fixup
danielinux
committed
8aa5221
F-7990: bound the compatible string walk to declared lengths
danielinux
committed
08903c2
F-9758: validate FDT layout in fdt_check_header, use it in fdt_get_string
danielinux
committed
19d8a9e
F-9757: length-bound the FIT name/compression string properties
danielinux
committed
fe1dcb0
F-7066: bound the FIT DTS relocation copy to the staging size
danielinux
committed
d554bbb
F-9756: validate PT_LOAD segments before the scatter flash hash walk
danielinux
committed
f08c62a
F-9721: make ext_flash_encrypt_write doc match its signature
danielinux
committed
8d39a5f
F-7071: scrub the staging buffer on the swap resume early-return
danielinux
committed
58390cb
F-9766: scrub the nonce copies in the IV-derivation helpers
danielinux
committed
f3098cb
F-7966: propagate the CTR counter carry without branching on the nonce
danielinux
committed
495b80b
F-7396: scrub the decrypted-header cache after field extraction
danielinux
committed
e9ee837
F-6762: compare the TLV field budget in a 32-bit domain
danielinux
committed
00bc8b5
F-9755: assert wolfBoot_success erases the firmware encryption key
danielinux
committed
d64bf67
F-9750: decrypt the stored block before the encrypted RMW patch
danielinux
committed
5caac27
F-9751: Add positive E2E encrypted-update test, fix what it exposes
danielinux
committed
04531cb
bound the ELF paddr range check by the destination pointer width
danielinux
committed
72c1ec2
add unaligned fallback-IV RMW test for ext_flash_encrypt_write
danielinux
committed
1dcd481
share the DTS size bounds in fdt.h and state the window assumption
danielinux
committed
9b1a485
scrub the RMW scratch buffers in ext_flash_encrypt_write
danielinux
committed
ca6b60a
name the full 32-bit gated set in the skip message
danielinux
committed
4769c72
raise footprint limits for fenrir-fixes-2026-08-21 (max +16B)
danielinux
committed
5cd23c7

Navigation Menu

Uh oh!

Fenrir fixes 2026 08 21 - #868

Fenrir fixes 2026 08 21#868
danielinux wants to merge 27 commits into
wolfSSL:masterfrom
danielinux:fenrir-fixes-2026-08-21

Commits on Aug 21, 2026

F-7380: make SAMA5D3 ext_flash_read byte-accurate for partial pages

F-7381: fail SAMA5D3 NAND write/erase instead of reporting success

F-9759: document that QE/FMan microcode is not authenticated

F-7970: free the LMS key on the parameter/import error paths

F-7971: free the ECC key on the wolfHSM setup error paths

F-7974: declare hdr_cpy_done as int in both translation units

F-7056: fix node-found guards and esdhc log label in hal_dts_fixup

F-7990: bound the compatible string walk to declared lengths

F-9758: validate FDT layout in fdt_check_header, use it in fdt_get_string

F-9757: length-bound the FIT name/compression string properties

F-7066: bound the FIT DTS relocation copy to the staging size

F-9756: validate PT_LOAD segments before the scatter flash hash walk

F-9721: make ext_flash_encrypt_write doc match its signature

F-7071: scrub the staging buffer on the swap resume early-return

F-9766: scrub the nonce copies in the IV-derivation helpers

F-7966: propagate the CTR counter carry without branching on the nonce

F-7396: scrub the decrypted-header cache after field extraction

F-6762: compare the TLV field budget in a 32-bit domain

F-9755: assert wolfBoot_success erases the firmware encryption key

F-9750: decrypt the stored block before the encrypted RMW patch

F-9751: Add positive E2E encrypted-update test, fix what it exposes

bound the ELF paddr range check by the destination pointer width

add unaligned fallback-IV RMW test for ext_flash_encrypt_write

share the DTS size bounds in fdt.h and state the window assumption

scrub the RMW scratch buffers in ext_flash_encrypt_write

name the full 32-bit gated set in the skip message

raise footprint limits for fenrir-fixes-2026-08-21 (max +16B)