Seed-backup screens clip words: 1.63% of 24-word seeds show a truncated or entirely missing word

[BitHighlander]

Finding

Severity: high · Dimension: confirm-ui-truth · Location: lib/firmware/reset.c:425

ResetDevice with strength=256 produces the 24-word seed "tonight consider congress announce dance frog intact lyrics piece quality there recipe general stock hurry quarter rabbit earn fit urge melt giant cousin excuse". reset.c packs page 1 as "1.tonight 2.consider\n 3.congress 4.announce\n 5.dance" (calc_str_line at width 225 == 3, so the check passes). confirm_constant_power draws it via layout_constant_power_notification at x=132 with wrap width 225. draw_string_walk never wraps (x_offset never reaches 225) so it runs off the canvas: draw_char_impl rejects the glyph at absolute x>256, have_space goes false, and the walk stops. Replaying the real renderer with the real font tables: line 2 measures 125 px against 124 px available, so the screen shows "1.tonight 2.consider / 3.congress 4.announc" and the entire third line "5.dance" is never drawn. No ellipsis, no warning, no page indicator — the user writes down 23 words and a 7-letter fragment. Measured over 100,000 random BIP-39 seeds: 1,629/100,000 (1.63%) of 24-word seeds and 46/100,000 (0.05%) of 12-word seeds produce at least one clipped backup screen; of the clipped screens 1,036 render a word with characters missing (e.g. "24.announ" for "announce", "20.busines" for "business") and 600 omit a whole word. Sample line widths vs. the 124 px available: "3.congress 4.announce"=125, "19.business 20.business"=127, "23.mystery 24.announce"=132. Result: an unrecoverable seed backup. The identical defect is in the BIP-85 child-seed display at fsm_msg_bip85.h:74.

Evidence

reset.c:422-427 (page packing — the ONLY fit check, and it measures width 225):
    snprintf(mnemonic_display, FORMATTED_MNEMONIC_BUF, "%s   %s",
             formatted_mnemonic[page_count], formatted_word);

    if (calc_str_line(get_body_font(), mnemonic_display, BODY_WIDTH) > 3) {
      page_count++;

layout.c:389-392 (where that body is actually drawn):
  sp.x = 128 + LEFT_MARGIN;
  sp.color = BODY_COLOR;
  draw_string(canvas, body_font, str2, &sp, BODY_WIDTH,
              font_height(body_font) + BODY_FONT_LINE_PADDING);

keepkey_display.c:303-309 (proves only x>=128 is real screen area in constant-power mode):
  if (constant_power) {
    for (int y = 0; y < 64; y++) {
      for (int x = 0; x < 128; x++) {
        canvas.buffer[y * 256 + x] = 255 - canvas.buffer[y * 256 + x + 128];

confirm_sm.c:508-510 (why nothing catches it later):
  const bool render_incomplete =
      (layout_notification_func == &layout_standard_notification) &&
      !confirm_body_fits(request_body, body_width);

layout.h:55 `#define BODY_WIDTH 225` — but 256 - (128+4) = 124 px are actually available.

Suggested fix

The packing loop never checks row WIDTH at all — because every word pair is explicitly '\n'-terminated, calc_str_line at width 225 only ever counts newlines. Either (a) pass the true wrap width to both sides: measure with calc_str_line(get_body_font(), display, 124) and change layout_constant_power_notification's draw_string width argument from BODY_WIDTH to (KEEPKEY_DISPLAY_WIDTH - (128 + LEFT_MARGIN)); or (b) better, extend confirm_helper's render check to cover layout_constant_power_notification by making confirm_body_fits take the layout's real x-origin and width instead of hard-coding the standard-notification geometry, so a clipped seed page fails closed like every other clipped body. Fix fsm_msg_bip85.h:74 the same way.

Verification

(not independently verified)

---

Found by an adversarial audit of release/7.15 (628b09257). Each finding was independently re-checked by a separate reviewer instructed to refute it by default; this one survived at confidence ?.

[BitHighlander]

Additional analysis: the obvious fix would break wallet creation

I verified the geometry and it holds:

• KEEPKEY_DISPLAY_WIDTH = 256 (keepkey_display.h:29)
• LEFT_MARGIN = 4, BODY_WIDTH = 225 (layout.h:41,55)
• layout_constant_power_notification() draws the body at sp.x = 128 + LEFT_MARGIN = 132, and passes BODY_WIDTH (225) as the wrap width

Only 256 - 132 = 124 px exists past that origin, so the wrap width is nearly double the real space. draw_string never wraps, the walk runs off the canvas, and the overflow is dropped with no ellipsis and no page indicator. calc_str_line() in the same function counts lines against the same wrong width, and reset.c:425 packs seed pages against it too.

So the diagnosis is confirmed. But the one-line fix is wrong, and this is the part worth recording before anyone attempts it.

Why passing the real width is not sufficient

MAX_PAGES is 6 (reset.h:28). At 124px a page holds roughly half what it holds at 225px, so a 24-word seed needs something like 8–12 pages. reset.c:437 then hits:

if (MAX_PAGES <= page_count) {
  fsm_sendFailure(FailureType_Failure_Other, _("Too many pages of mnemonic words"));

That converts a silent, intermittent truncation into a hard failure of wallet creation — and intermittent, since whether it trips depends on the specific words drawn. Strictly worse than the bug.

What the real fix costs

Raising MAX_PAGES means growing two CONFIDENTIAL statics:

FORMATTED_MNEMONIC_BUF   = MAX_WORDS*(MAX_WORD_LEN + ADDITIONAL_WORD_PAD) + 1 = 361
MNEMONIC_BY_SCREEN_BUF   = WORDS_PER_SCREEN*(MAX_WORD_LEN + 1) + 1           = 265
                                                                    per page = 626 B

MAX_PAGES 6 → 12 is +3.7 KB of static SRAM, on a target that has already taken a boot fault from a large frame and now carries CI SRAM budget gates. It also doubles the number of screens a user clicks through during backup — a material change to the highest-stakes ceremony in the product.

Recommendation

Not a drive-by fix. It needs:

1. A decision on the SRAM budget for the extra pages, measured against the ARM build gates.
2. On-device OLED screenshots of the backup flow at 12/18/24 words, per the project's no-approval-without-OLED-proof rule. This is the one screen where "it looked fine in the emulator" is not good enough.
3. Consideration of the narrower alternative: keep the page count and render one word per line in constant-power mode, which fits 124px comfortably without new buffers, at the cost of more pages only for 24-word seeds.

I implemented the width fix, measured the consequence, and reverted it rather than ship a change that can hard-fail wallet creation. Flagging rather than guessing.

Scope beyond the seed backup

layout_constant_power_notification() is shared. Every constant-power screen with a long body is silently clipped by the same arithmetic — the seed backup is just where the consequence is unrecoverable. A width fix there has a blast radius across every notification screen, which is the other reason this needs a deliberate UI pass rather than a one-line change.