fwTPM v185: MSan-detected uninit reads (4 real bugs) + CI debug

.github/workflows/pqc-examples.yml

@@ -103,11 +103,22 @@ jobs:
 
       # ----- Tier 5: full run_examples.sh sweep -----
       # run_examples.sh does not start its own TPM — it expects one already
-      # listening. Reuse the fwtpm_server started in Tier 2.
+      # listening. Reuse the fwtpm_server started in Tier 2. Trace each
+      # command (set -x) so the failing call line is in the CI log; on
+      # failure, dump run.out (where the script redirects example stdout).
       - name: run_examples.sh full pass (auto-detects v1.85, runs 18-way matrix)
         env:
           WOLFSSL_PATH: ${{ github.workspace }}/wolfssl
-        run: ./examples/run_examples.sh
+        run: |
+          bash -x ./examples/run_examples.sh
+          rc=$?
+          if [ $rc -ne 0 ]; then
+            echo "=== run.out (last 200 lines) ==="
+            tail -200 run.out
+            echo "=== fwtpm_server.log (last 100 lines) ==="
+            tail -100 /tmp/fwtpm_server.log
+          fi
+          exit $rc
 
       - name: Stop fwtpm_server
         if: always()
@@ -128,4 +139,5 @@ jobs:
             test-suite.log
             tests/*.log
             config.log
+            run.out
           retention-days: 5

examples/pcr/quote.c

@@ -63,7 +63,7 @@ int TPM2_PCR_Quote_Test(void* userCtx, int argc, char *argv[])
 #if defined(HAVE_ECC) && !defined(WOLFTPM2_NO_HEAP) && \
     defined(WOLFSSL_PUBLIC_MP)
     byte *pubKey = NULL;
-    word32 pubKeySz;
+    word32 pubKeySz = 0;
 #endif
     WOLFTPM2_DEV dev;
     TPMS_ATTEST attestedData;

examples/wrap/hmac.c

@@ -109,8 +109,10 @@ int TPM2_Wrapper_HmacArgs(void* userCtx, int argc, char *argv[])
         argc--;
     }
 
+    XMEMSET(&storage, 0, sizeof(storage));
     XMEMSET(&hmac, 0, sizeof(hmac));
     XMEMSET(&tpmSession, 0, sizeof(tpmSession));
+    XMEMSET(&cipher, 0, sizeof(cipher));
 
     printf("TPM2.0 HMAC example\n");
     printf("\tUse Parameter Encryption: %s\n", TPM2_GetAlgName(paramEncAlg));

src/tpm2_wrap.c

@@ -2670,6 +2670,7 @@ int wolfTPM2_CreatePrimaryKey_ex(WOLFTPM2_DEV* dev, WOLFTPM2_PKEY* pkey,
 
     /* setup create primary command */
     XMEMSET(&createPriIn, 0, sizeof(createPriIn));
+    XMEMSET(&createPriOut, 0, sizeof(createPriOut));
     /* TPM_RH_OWNER, TPM_RH_ENDORSEMENT, TPM_RH_PLATFORM or TPM_RH_NULL */
     createPriIn.primaryHandle = primaryHandle;
     if (auth && authSz > 0) {