Fixes from static analysis

[danielinux]

• F/1099 - Fix ARM32 AIRCR key literal (5b0c4005)
• F/1100 - fix policy_sign digest parse checks (20c3b866)
• F/1101 - Guard elf-parser fclose on open failure (d1b488f0)
• F/1102 - Validate qman portal cell-index (8041e832)
• F/1103 - remove TPM secret debug logging (805b16e2)
• F/1104 - zero decrypted disk header on exit (7e64e91c)
• F/1105 - clear store handles on close (916d9544)

[Copilot]

Pull request overview

This PR applies a set of static-analysis-driven fixes across TPM tooling, parsers, storage backends, and disk/TPM secret handling to improve safety (bounds/resource checks) and reduce sensitive-data exposure.

Changes:

• Tighten validation/guarding: digest parsing in policy_sign, qman portal cell-index bounds, and fclose() on open failure.
• Reduce sensitive-data exposure: remove TPM/disk secret debug printing and explicitly zero decrypted disk headers on exit paths.
• Improve keyvault store handle hygiene: clear handle state on close and add unit coverage for the behavior (plus new unit tests for policy_sign arg validation).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tools/unit-tests/unit-psa_store.c	Adds unit test asserting store handle state is cleared by wolfPSA_Store_Close().
tools/unit-tests/unit-pkcs11_store.c	Adds unit test asserting store handle state is cleared by wolfPKCS11_Store_Close().
tools/unit-tests/unit-policy-sign.c	New unit test binary validating policy_sign() rejects oversized/invalid hex args without invoking TPM/crypto paths.
tools/unit-tests/Makefile	Adds unit-policy-sign target and includes it in the unit test suite.
tools/tpm/policy_sign.c	Fixes digest parse error checks for unsigned sizes by casting before comparing to <= 0.
tools/fdt-parser/fdt-parser.c	Validates cell-index before indexing qman portal tables.
tools/elf-parser/elf-parser.c	Guards fclose() when fopen() fails.
src/x86/ahci.c	Removes logging of unlock secrets and reduces logging exposure.
src/update_flash.c	Removes printing of secrets/secret-check buffers during disk unlock flow.
src/update_disk.c	Zeroes decrypted disk header buffer on error paths and before boot.
src/psa_store.c	Clears entire store handle struct on close via memset.
src/pkcs11_store.c	Clears entire store handle struct on close via memset.
src/boot_arm32.c	Fixes invalid AIRCR VECTKEY literal.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.