Skip to content

R05 — Temporary FAT12, PNG/JPEG and OS ejection

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

R01 passed; disposable OTP; identical QR in supported PNG and baseline JPEG; Finder, Windows Explorer and Linux file manager.

Steps

  1. Verify no disk/serial port in normal mode. Open Authentication → OTP → Add QR over USB.
  2. Record MSC-only enumeration and FAT12 volume name; read its README. Copy PNG using the normal OS interface and wait for parsing. Do not confirm the preview: verify the account is not yet stored.
  3. Confirm on-device, then wait without ejecting. The volume must remain present; clicks on the ejection prompt must not disconnect USB prematurely.
  4. Eject through the OS, wait for HID+CCID and verify the OTP. Repeat with baseline JPEG, different filenames and local cancellation.
  5. Restore multiple QR frames with successive copies, without remounting between files, then eject cleanly. Repeat with a power cut before confirmation; existing accounts must remain intact.

Expected result

MSC appears only after a local action; PNG/JPEG work; copying/parsing/commit stay separate; normal flow keeps the volume until OS ejection; functional FIDO/CCID returns on all three OSes. Images are not persistent readable storage.

Evidence to retain

Mount/copy/confirmation/ejection videos and timestamps, interfaces and USB/OS logs, image hashes, before/after accounts and FIDO result after returning.

Per-identity reception and copy retries

Copy all frames of one identity before Continue, then wait for the message allowing the next identity. During confirmation/KDF, WRITE(10) must explicitly reject with NOT READY 04/07 and full residue. Verify the OS reports failure and the same file succeeds after resumption. Keep MSC mounted between identities, finish explicitly, verify exact totals and completeness, then eject. A late failure retains completed identities without changing an incomplete/corrupt identity. Repeat retries on each OS; this behavior is not yet physically qualified.