CRITICAL F22 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.5: redbear-btusb/src/btintel.rs:178-187 sliced fw_data[644+128..644+224]
and [644+224..644+320] on the ECDSA branch with only 'if fw_data.len() < 644'
bounds-check. A 645..963 byte ECDSA firmware blob would panic with
'range start index 772 out of range for slice of length N'.
Fix: introduce ECDSA_FULL_LEN = ECDSA_HEADER_LEN + 128 + 96 + 96 (= 964)
covering the full ECDSA header (CSS + PKEY + SIG). Update the bounds
check to require fw_data.len() >= ECDSA_FULL_LEN. The payload slice
now starts at ECDSA_FULL_LEN, making the slice operations guaranteed
in-bounds. The error message is updated to print the actual minimum
length (964) instead of the misleading 644.
Also updates the existing ECDSA_HEADER_LEN = 644 constant reference:
the constant is correctly used; the bug was that the check itself
was under-specifying the requirement (only the header start, not
the header end).
vasilito
94c8b51b44