From a211f74a8d3e807f14a11078c4cd50ef90b5f6c2 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Mon, 18 May 2026 13:52:53 -0700
Subject: [PATCH] fix(se050): fenrir 2638 zero ed25519 der buffer

---
 wolfcrypt/src/port/nxp/se050_port.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/wolfcrypt/src/port/nxp/se050_port.c b/wolfcrypt/src/port/nxp/se050_port.c
index d97bc38cb2..0f5d8d57e5 100644
--- a/wolfcrypt/src/port/nxp/se050_port.c
+++ b/wolfcrypt/src/port/nxp/se050_port.c
@@ -37,6 +37,13 @@
 #include <wolfssl/wolfcrypt/logging.h>
 #include <wolfssl/wolfcrypt/curve25519.h>
 
+#ifdef NO_INLINE
+    #include <wolfssl/wolfcrypt/misc.h>
+#else
+    #define WOLFSSL_MISC_INCLUDED
+    #include <wolfcrypt/src/misc.c>
+#endif
+
 #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
 
 #ifdef WOLFSSL_SE050_INIT
@@ -3013,6 +3020,7 @@ int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
                 status = sss_key_store_set_key(&host_keystore, &newKey, derBuf,
                                                 derSz, keySize * 8, NULL, 0);
             }
+            ForceZero(derBuf, sizeof(derBuf));
         }
         else {
             status = sss_key_object_get_handle(&newKey, keyId);