R06 — Hostile images and QR payloads

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

R05 passed; test device; retained hashed test/fuzz corpus and mutations; monitored power.

Steps

1. Run FUZZ_SECONDS=60 make fuzz, retain results and minimised crashes, then run make test-c.
2. Copy to the physical volume: truncated PNG/JPEG, bad PNG CRC, dimensions >1024, files >256 KiB, excessive expansion, progressive JPEG, other formats disguised as images, non-otpauth/FB1 QR and malformed URIs. Use tests/c/fimg, tests/c/fqr, tests/c/fmsc corpora and generators; record every transmitted hash.
3. Try two QR codes in one image, no QR, heavy noise, limit sizes/rotation and rewriting during a copy. Fragment/reorder sectors with the fmsc harness and compare against actual OS copies.
4. After each rejection, eject, inspect accounts/keys and perform FIDO and GET CHALLENGE. Import a valid control image after the hostile series.
5. Interrupt a copy and reconnect; verify no partial identity and no persistent startup volume.

Expected result

Bounded explicit rejection; no content execution, panic/overflow or secret mutation without consent; recovery after errors. Host fuzzing does not replace MCU RAM/time measurements.

Evidence to retain

Exact corpus, hashes/seeds, sanitizer/fuzz logs, observed per-model errors/times, before/after state and valid control-import result.