fix(uf2): ignore an unknown application size in the staging guard

Author: jamesarich

changelog.md

@@ -7,7 +7,7 @@ it and is upstream Adafruit history, kept for provenance.
 
 - A device with no valid application that is plugged into a USB host comes up as a UF2 drive showing NO FIRMWARE instead of waiting for a phone. With no host enumerating within 3 s (battery, or a charger) it falls through to the BLE OTA wait. A cabled board with no application returns to the drive after an aborted copy or an eject. On battery, or when the cable is pulled while the drive is up (VBUS gone for 250 ms), it goes to the BLE OTA wait. Plugging a cable into a board with no application that is waiting for BLE, with no phone connected, brings the drive up (VBUS present for 250 ms); a cable already present when the wait began, or a phone connected, leaves the wait alone.
 - A UF2 application copy marks `bank_0` invalid when its first application block arrives, so a cable pulled mid-copy leaves the device with no application instead of an old `bank_0` marked valid over a half-written image. The completion path records the real application size as before.
-- A bootloader self-update whose staged image would overwrite the tail of the installed application (one larger than 744 KB with the S140 6.1.1 layout) marks `bank_0` invalid first, so the device comes up in DFU with no application instead of booting a corrupted one.
+- A bootloader self-update whose staged image would overwrite the tail of the installed application (one larger than 744 KB on S140 6.1.1 or 740 KB on 7.3.0) marks `bank_0` invalid first, so the device comes up in DFU with no application instead of booting a corrupted one.
 - DFU screens on I2C mono OLEDs (SSD1306 and SH1106), with a four-line layout: title, mode, version, and banner. A board opts in by defining `DISPLAY_PIN_SDA` in its `board.h`; `boards.h` rejects a board that also defines `DISPLAY_PIN_SCK`, since TWIM0 and SPIM0 share a peripheral. The bootloader probes 0x3C and 0x3D and reads the controller type off the panel, and a board with no panel shows nothing and otherwise behaves as before. Enabled on `wiscore_rak4631_board`, `wiscore_rak3401`, `wio_tracker_l1`, `promicro_nrf52840`, `xiao_nrf52840_ble`, and `xiao_nrf52840_ble_sense`, for about 2 KB of bootloader flash each. Verified on the RAK4631 and the Wio Tracker L1; the other four follow their firmware variants' pins. On the RAK4631 and RAK3401, DFU raises the switched 3V3_S rail (WB_IO2) that feeds the WisBlock slots, and lowers it again when no panel answers.
 - Fixed an out-of-bounds write in `printicon()` on the 160x80 `heltec_t096` and `heltec_t1`, where the third drag icon ran past the end of `frame_buf`. Those boards place it inside the panel, and `printicon()` skips any icon that would land outside.
 - Fixed BLE OTA started from an application's buttonless DFU falling back to the application after about 10 s. The 0xB1 entry now restarts through the 0xA8 path, so the bootloader initializes the SoftDevice itself; the peer data for reconnection survives the reset.

src/usb/uf2/ghostfat.c

@@ -556,8 +556,11 @@ int write_block (uint32_t block_no, uint8_t *data, WriteState *state)
         bootloader_settings_t const * boot_setting;
         bootloader_util_settings_get(&boot_setting);
 
+        // A size spanning the whole region is the CURRENT.UF2 full-region fallback, not a measured
+        // application end, so it is treated as unknown like current_flash_size() does.
         uint32_t const sz = boot_setting->bank_0_size;
         if ( boot_setting->bank_0 == BANK_VALID_APP && sz != 0 && sz != 0xFFFFFFFFUL &&
+             sz < USER_FLASH_END - DFU_BANK_0_REGION_START &&
              sz > BOOTLOADER_ADDR_NEW_RECIEVED - DFU_BANK_0_REGION_START )
         {
           dfu_update_status_t s = { .status_code = DFU_BANK_0_ERASED };