From e912aea06766fcba713a14826d3f407daeb4135c Mon Sep 17 00:00:00 2001 From: Phongsaton Untan Date: Fri, 4 Sep 2026 11:15:44 +0700 Subject: [PATCH] Restore applet-selected bit after authenticatorReset authenticatorReset() calls transientStorage.fullyReset(), which zeroes the whole transient bitfield including the applet-selected bit added for extended-length SELECT support (42d16ba / a656edc). Nothing restored it, so after a CTAP2 reset every subsequent command was rejected with SW_INS_NOT_SUPPORTED (0x6D00) until the next SELECT. Re-set the bit after fullyReset(). The full Python suite now passes: 248 tests, 244 pass, 4 skip, 0 fail / 0 error. Refs BryanJacobs/FIDO2Applet#65 Co-Authored-By: Claude Opus 4.8 --- src/main/java/us/q3q/fido2/FIDO2Applet.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/main/java/us/q3q/fido2/FIDO2Applet.java b/src/main/java/us/q3q/fido2/FIDO2Applet.java index 810cd26..cde8655 100644 --- a/src/main/java/us/q3q/fido2/FIDO2Applet.java +++ b/src/main/java/us/q3q/fido2/FIDO2Applet.java @@ -5518,6 +5518,10 @@ private void authenticatorReset(APDU apdu) { counter.clear(); transientStorage.fullyReset(); + // A CTAP2 reset does not deselect the applet; fullyReset() clears the whole + // transient bitfield including the applet-selected bit, so restore it here to + // avoid rejecting all later commands with INS_NOT_SUPPORTED until the next SELECT. + transientStorage.setAppletSelected(); forceInitKeyAgreementKey();