Fenrir fixes 2026 07 02#814

Merged

dgarske merged 23 commits into

wolfSSL:masterfrom

danielinux:fenrir-fixes-2026-07-02

Jul 2, 2026

Commits on Jul 2, 2026

F-6407: zeroize static cached_sector after each flash commit in psa_store
danielinux
committed
F-6402: add negative tests pinning wolfBoot_check_rot digest comparison
danielinux
committed
F-6129: zeroize disk-unlock secret before the state-mismatch panic in sata_unlock_disk
danielinux
committed
F-5968: zeroize disk-unlock passphrase from static ATA command buffer
danielinux
committed
F-5965: skip wb_diff match candidates whose offset MSB collides with ESC
danielinux
committed
F-5963: fix over-advance of address/len in unaligned hal_flash_write (kinetis.c, mcxa.c, mcxw.c)
danielinux
committed
F-6408: zeroize UDS from OTP keystore generator's heap and stack buffers
danielinux
committed
F-6403: add successful-boot test coverage for HW-swap wolfBoot_start
danielinux
committed
F-6401: emit build-time warning for FPGA_NONFATAL=1
danielinux
committed
F-6399: fix imx_rt DCACHE invalidation to include down-alignment offset
danielinux
committed
F-6398: fix OOB write in bmpatch when reconstructed image grows past source size
danielinux
committed
F-6130: clear disk_encrypt_key/nonce before panic paths that skip the final cleanup
danielinux
committed
F-6127: fix custom-TLV 8-byte value saturation in arg2num
danielinux
committed
F-6126: add mutation-pinning test coverage for wolfBoot_check_flash_image_elf
danielinux
committed
F-6124: emit build-time warning for SIGN=NONE / WOLFBOOT_NO_SIGN
danielinux
committed
F-5964: fix stale in-word offset in hal_flash_write byte-wise path (samr21/same51)
danielinux
committed
F-6405: pin partition-fit accept boundary in wolfBoot_open_image_address/open_self_address
danielinux
committed
F-6131: enforce full-transfer bounds check in spi_flash_read/spi_flash_write (QSPI)
danielinux
committed
Added new tests to .gitignore
danielinux
committed
hal: advance source index in aligned flash-write fast path
danielinux
committed
hal/mcxw: fix truncated empty-word sentinel
danielinux
committed
tools/delta: check pwrite result in bmpatch
danielinux
committed
unit-tests: build otp-keystore-gen test without generated keystore.c
danielinux
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fenrir fixes 2026 07 02#814

Fenrir fixes 2026 07 02#814
dgarske merged 23 commits into
wolfSSL:masterfrom
danielinux:fenrir-fixes-2026-07-02

Commits on Jul 2, 2026

F-6407: zeroize static cached_sector after each flash commit in psa_store

F-6402: add negative tests pinning wolfBoot_check_rot digest comparison

F-6129: zeroize disk-unlock secret before the state-mismatch panic in sata_unlock_disk

F-5968: zeroize disk-unlock passphrase from static ATA command buffer

F-5965: skip wb_diff match candidates whose offset MSB collides with ESC

F-5963: fix over-advance of address/len in unaligned hal_flash_write (kinetis.c, mcxa.c, mcxw.c)

F-6408: zeroize UDS from OTP keystore generator's heap and stack buffers

F-6403: add successful-boot test coverage for HW-swap wolfBoot_start

F-6401: emit build-time warning for FPGA_NONFATAL=1

F-6399: fix imx_rt DCACHE invalidation to include down-alignment offset

F-6398: fix OOB write in bmpatch when reconstructed image grows past source size

F-6130: clear disk_encrypt_key/nonce before panic paths that skip the final cleanup

F-6127: fix custom-TLV 8-byte value saturation in arg2num

F-6126: add mutation-pinning test coverage for wolfBoot_check_flash_image_elf

F-6124: emit build-time warning for SIGN=NONE / WOLFBOOT_NO_SIGN

F-5964: fix stale in-word offset in hal_flash_write byte-wise path (samr21/same51)

F-6405: pin partition-fit accept boundary in wolfBoot_open_image_address/open_self_address

F-6131: enforce full-transfer bounds check in spi_flash_read/spi_flash_write (QSPI)

Added new tests to .gitignore

hal: advance source index in aligned flash-write fast path

hal/mcxw: fix truncated empty-word sentinel

tools/delta: check pwrite result in bmpatch

unit-tests: build otp-keystore-gen test without generated keystore.c