fix(C3): persist a monotonic time floor to defeat clock-rewind replay

[d33mobile]

Finding (ISSUES.md — C3, Critical)

network/ntp.c rollback_check():

if (!synced)
    return true; // no floor before first sync

synced / last_sync_unix / last_sync_monotonic_us are RAM-only statics, nothing is persisted, and the RP2040 RTC is not battery-backed — so every power cycle resets the floor completely. An attacker who observed a valid code C at time T can power-cycle the lock; boot_network() immediately syncs with synced == false, the attacker answers with T, rollback_check waves it through, the RTC is set to T, and C is valid again at the keypad.

Since in-window TOTP replay protection is an accepted risk, this persisted floor is the only control stopping a code captured hours/days earlier from being replayed, so it is load-bearing.

Fix

• Persisted watermark. New storage_time_floor_get() / storage_time_floor_set() accessors persist a coarse "maximum unix time ever observed" value to a /timefloor littlefs file (mirrors the existing storage_wifi_* pattern). Granularity is hourly (TIME_FLOOR_GRANULARITY_S, rounded down) to bound flash wear to ≤24 writes/day.
• Load at boot. ntp_init() loads the watermark into persisted_floor (storage is already mounted at that point — main.c runs storage_init() before ntp_init(); in recovery mode the floor stays 0 and only the existing sane band applies).
• Enforce on every sync, including the first. rollback_check() now rejects new_time < persisted_floor before the !synced early-return, so a spoofed first-sync response can no longer rewind the clock. The in-session monotonic floor is unchanged and still applies once synced.
• Advance the watermark. apply_time() persists a new coarse bucket whenever an accepted (and already floor-checked) time crosses into it, so it only ever moves forward.

Host-test status

make -C test asan / valgrind / coverage and ./ci --action=check (clang-format + shellcheck) all green.

• harness_storage.c gains a time-floor set/get roundtrip + pre-mount refusal assertions, exercising the new storage accessors under ASan/UBSan + valgrind.
• fuzz_ntp.c gains storage stubs and a C3 first-sync-floor scenario asserting that a below-watermark first sync is rejected (RTC untouched) while an above-watermark first sync is accepted and advances the coarse watermark. While wiring this up I repaired three pre-existing bugs that had kept fuzz_ntp from ever linking/running (missing wifi_is_connected stub, NULL addr passed into the ip_addr_cmp deref, and make_ntp_packet leaving stratum=0 → kiss-o-death reject). The harness now builds and runs clean (~5M execs, no crashes), so the new assertions actually execute.

Firmware/hardware behaviour (actual flash persistence across a real power cycle) is verify-on-hw — no ARM toolchain / PICO_SDK_PATH in this environment, so the RP2040 paths were validated by code review + the host tests above.

Refs ISSUES.md C3. Focused on C3 only.

🤖 Generated with Claude Code