Hack@CHES 2026 - Phase 1 Bug Submissions

1. Bug 01 - PMP error output always zero
2. Bug 02 - CTN access-range check overridden
3. Bug 03 - Key Manager source-key validity gate
4. Bug 04 - AES DPA masking forceable off
5. Bug 05 - Debug module auth hardwired to 1
6. Bug 06 - Lifecycle token compared on 32 bits
7. Bug 07 - LC transition check OR instead of AND
8. Bug 08 - LcStProd in two unique case branches
9. Bug 09 - AES output register reset bypass
10. Bug 10 - AES S-Box DOM counter fault, DFA key recovery
11. Bug 11 - KeyMgr EDN error path unconnected
12. Bug 12 - KeyMgr FSM illegal state silent recovery
13. Bug 13 - CSRNG unmasked AES (state leak)
14. Bug 14 - ROM controller single-bit digest compare
15. Bug 15 - Entropy Markov health test dead
16. Bug 16 - CSRNG key not zeroized after op
17. Bug 17 - OTBN URND reseed ignores EDN error