From a4544ba10fd8d6c7c5816ab675d9d6604d009bbc Mon Sep 17 00:00:00 2001
From: Stephen Waits <steve@waits.net>
Date: Tue, 31 Mar 2026 16:01:15 -0600
Subject: [PATCH] fix: audit improvements (SAFETY comment, warn on invalid
 params, lint config)

Add SAFETY comment to nRF52840 FICR unsafe block explaining the
register addresses and why read_volatile is correct.

Replace silent fallback defaults in to_sf()/to_cr() with defmt::warn
so invalid values are logged instead of silently accepted.

Remove unnecessary #[allow(dead_code)] on DisplayCommand enum.
Add clippy::undocumented_unsafe_blocks = "deny" lint to Cargo.toml.
---
 Cargo.toml                     |  5 ++++-
 src/board/rak_wisblock_4631.rs |  4 ++++
 src/channel.rs                 |  1 -
 src/radio/task.rs              | 10 ++++++++--
 4 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 5c42fd6d..d3a2a18f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ embassy-sync = "0.8"
 embassy-time = "0.5"
 embassy-usb = { version = "0.6", features = ["defmt"] }
 embassy-usb-driver = "0.2"
-ucobs = "0.2"
+ucobs = { path = "../ucobs", features = ["legacy-msrv"] }
 heapless = "0.9"
 lora-phy = "3.0"
 static_cell = "2.1"
@@ -79,6 +79,9 @@ rak_wisblock_4631 = [
     "embassy-executor/executor-thread",
 ]
 
+[lints.clippy]
+undocumented_unsafe_blocks = "deny"
+
 [profile.release]
 codegen-units = 1
 lto = "fat"
diff --git a/src/board/rak_wisblock_4631.rs b/src/board/rak_wisblock_4631.rs
index 4f5d1e78..eb8cab55 100644
--- a/src/board/rak_wisblock_4631.rs
+++ b/src/board/rak_wisblock_4631.rs
@@ -66,6 +66,10 @@ impl super::traits::LoRaBoard for Board {
     }
 
     fn mac_address() -> [u8; 6] {
+        // SAFETY: 0x10000000 is the nRF52840 FICR (Factory Information Configuration
+        // Registers) base address. Offsets 0x0A4 and 0x0A8 are the DEVICEADDR[0] and
+        // DEVICEADDR[1] registers containing the factory-programmed device address.
+        // read_volatile is correct for memory-mapped hardware registers.
         unsafe {
             let ficr = 0x10000000 as *const u32;
             let addr0 = core::ptr::read_volatile(ficr.byte_add(0x0A4));
diff --git a/src/channel.rs b/src/channel.rs
index fb6efb25..1eda48cb 100644
--- a/src/channel.rs
+++ b/src/channel.rs
@@ -14,7 +14,6 @@ use crate::protocol::{Command, RadioConfig, Response};
 
 /// Display commands routed from usb_task to display_task.
 #[derive(Debug, Clone, Copy, defmt::Format)]
-#[allow(dead_code)] // Constructed by usb_task once CDC-ACM is wired up
 pub enum DisplayCommand {
     On,
     Off,
diff --git a/src/radio/task.rs b/src/radio/task.rs
index 769a4f11..94d380c8 100644
--- a/src/radio/task.rs
+++ b/src/radio/task.rs
@@ -302,7 +302,10 @@ fn to_sf(sf: u8) -> lora_phy::mod_params::SpreadingFactor {
         10 => _10,
         11 => _11,
         12 => _12,
-        _ => _7, // validated to 5-12 earlier; unreachable but safe
+        _ => {
+            warn!("BUG: invalid SF {} passed validation", sf);
+            _7
+        }
     }
 }
 
@@ -313,7 +316,10 @@ fn to_cr(cr: u8) -> lora_phy::mod_params::CodingRate {
         6 => _4_6,
         7 => _4_7,
         8 => _4_8,
-        _ => _4_5, // validated to 5-8 earlier; unreachable but safe
+        _ => {
+            warn!("BUG: invalid CR {} passed validation", cr);
+            _4_5
+        }
     }
 }