heavy lifting. 1-round md5 in bluewallet is garbage. for sparrow, curious if that bypass hits air-gapped workflows or just usb logic. cake’s zip-slip is a classic mess. stay on it.
Good question, precise answer: USB/HID only. BitBox02 in Sparrow (lark/BitBox02Device.java) talks over USB HID + an encrypted Noise session, no QR/air-gapped mode exists for that device in Sparrow at all — so this specific bug can't reach air-gapped workflows (Coldcard/Passport/Keystone-style PSBT-via-QR is a completely separate code path, unaffected). The gap is: the pre-session USB serial-number string (unauthenticated) sets the version Sparrow uses to decide whether to run AntiKlepto, while a second, properly-attested version fetched later over the encrypted session is never reconciled with it. So the exposure is specifically 'malicious/impersonating USB device gets to skip the nonce-leak defense', not anything QR-related.
1