Two production ship-fence tests fail on the ui-px merge tree: rng-consumer-audit sees a dev-only rng::fill

[Nicola-Ceornea]

FINDING 3 of the 2026-09-24 ui-px merge review. Record: docs/security/adversarial-review/findings/ui-px-merge-2026-09-24.md.

Two tests fail in fsbl-tests/tests/rollback_ship_fences.rs:

• production_feature_policy_rejects_all_factory_and_prodtest_aliases (:294)
• advertised_ship_and_irreversible_factory_gates_fail_loudly (:443)

One root cause:

rng-consumer-audit: FAIL
- raw RNG allowlist drift in secure/src/main.rs:
  expected={}  found={'let r = rng::fill(&mut b);': 1}

secure/src/main.rs:1091, inside the se-lcd-diag "SE DIAG" screen (step "1. platform TRNG").

make rng-consumer-audit ("Refuse unreviewed direct platform-RNG consumers") scans the source text, so a #[cfg]-gated dev-only call still trips it.

Attribution: ours=0, base=0, his=1 — added by 435ec6a5 on the pq1-evt-dfu ancestry, not the pixel-UI work.

Fix, either:

• add the call site to the reviewed allowlist, with the justification that se-lcd-diag is in PROD_FORBIDDEN; or
• route the diagnostic through the reviewed accessor.

Blocks landing merge/ui-px-evt.

[Nicola-Ceornea]

Already fixed when I filed this — my error.

The allowlist entry landed in 7e7a8900 ("close the atlas fail-open, the carried-over chord, and the unpainted confirm") on 2026-09-24, as one of that commit's five fixes. I then transcribed FINDING 3 out of the merge write-up into this issue without re-checking whether it still held.

Current state on merge/ui-px-evt:

$ python3 scripts/rng_consumer_audit.py
rng-consumer-audit: PASS — 17 direct platform-RNG calls are bounded to reviewed
bootstrap/public/nonsecret/nonshipping contexts; ...

$ cargo test -p pqsigner-fsbl-tests --test rollback_ship_fences
test result: ok. 9 passed; 0 failed

Both named tests pass, including production_feature_policy_rejects_all_factory_and_prodtest_aliases and advertised_ship_and_irreversible_factory_gates_fail_loudly.

The committed justification is also better than the one I was about to write. I had reasoned "allowlist it because se-lcd-diag is nonshipping"; the entry actually says:

It is a liveness probe of the TRNG ITSELF, so routing it through rng_strong would defeat its purpose — the point is to see the bare peripheral answer.

That is the real reason the alternative fix (route through the reviewed accessor) is wrong here, not merely unnecessary.

Closing. No longer blocks landing merge/ui-px-evt.