Reject host attempts to set keys in reserved ECC slots (117-132)

Host OKSETPRIV requests may only target user slots (RSA 1-4, ECC 101-116).
Reserved ECC slots 117-132 (HMAC 129/130, backup 131, derivation 128/132)
are provisioned by firmware via direct set_private() calls that bypass this
dispatch, so the guard does not affect internal provisioning.

Author: onlykey

onlykey/okcore.cpp

@@ -441,8 +441,19 @@ void recvmsg(int n)
 				if (profilemode != NONENCRYPTEDPROFILE)
 				{
 					#ifdef STD_VERSION
-					if (recv_buffer[0] != 0xBA)
+					if (recv_buffer[0] != 0xBA) {
+						// A host may only set keys in user slots: RSA 1-4 or ECC
+						// 101-116. Reserved ECC slots 117-132 hold firmware-managed
+						// keys (HMAC 129/130, backup 131, derivation 128/132) and are
+						// provisioned by the firmware itself via direct set_private()
+						// calls that bypass this host dispatch. Reject host attempts
+						// to write a reserved slot, for every key type.
+						if (recv_buffer[5] >= 117 && recv_buffer[5] <= 132) {
+							hidprint("Error cannot set key in reserved slot (117-132)");
+							return;
+						}
 						set_private(recv_buffer);
+					}
 					#endif
 				}
 			}