Add Phase 9C security hardening

Generate exact-hash SDK source overrides without modifying dependencies. Harden SSH allocation and algorithm policy, tighten web authentication cleanup, and add focused host contract tests and documentation.
2026-09-15 22:12:57 +02:00
parent 751dfb9ddb
commit cdc9c7335a
41 changed files with 3597 additions and 89 deletions
@@ -86,3 +86,9 @@ CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT=y
 # CONFIG_ESP_SYSTEM_GDBSTUB_RUNTIME is not set
 # CONFIG_ESP_DEBUG_OCDAWARE is not set
 # CONFIG_FREERTOS_DEBUG_OCDAWARE is not set
+
+# Audited allocation extents and TLS record retirement used by Phase 9C.
+CONFIG_HEAP_POISONING_DISABLED=y
+# CONFIG_HEAP_POISONING_LIGHT is not set
+# CONFIG_HEAP_POISONING_COMPREHENSIVE is not set
+# CONFIG_MBEDTLS_DYNAMIC_BUFFER is not set