From b12c95e64a9972abff90cf636671773690dff39d Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Thu, 10 Sep 2026 11:25:53 -0700
Subject: [PATCH] F-11929 - Zeroize the append-only NV replay buffer before
 freeing

---
 src/fwtpm/fwtpm_nv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/fwtpm/fwtpm_nv.c b/src/fwtpm/fwtpm_nv.c
index fe1059c5..df17ea8a 100644
--- a/src/fwtpm/fwtpm_nv.c
+++ b/src/fwtpm/fwtpm_nv.c
@@ -1759,6 +1759,7 @@ static int FwNvInitAppendOnly(FWTPM_CTX* ctx, byte** valueBufP,
                     rc = TPM_RC_MEMORY;
                     break;
                 }
+                TPM2_ForceZero(valueBuf, valueBufSz);
                 XFREE(valueBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                 valueBuf = newBuf;
                 valueBufSz = len;