fix(core): temporary fix for RSOD triggered by rng_fill_buffer_strong

What changed, and why it matters

This commit is a temporary hotfix that disables the Tropic secure-element randomness source in non-production builds to stop a Red Screen of Death (RSOD) crash triggered by the function rng_fill_buffer_strong. The change wraps the Tropic random-buffer mixing step in a PRODUCTION preprocessor guard, so it only runs in production firmware. In non-production/debug builds, the function will fall back to whatever other entropy sources remain (likely the STM32 hardware RNG plus optional optiga mixing). The commit message explicitly calls this a temporary fix and says to delete it later, so it is a workaround rather than a root-cause fix. There is no direct evidence in the commit that this is exploitable, but any change to cryptographic randomness generation in a hardware wallet is a security-sensitive signal.

Security signals we found

Evidence from the diff

Changed components

diff --git a/core/embed/sec/rng/rng_common.c b/core/embed/sec/rng/rng_common.c
index aea66e13..883352fc 100644
--- a/core/embed/sec/rng/rng_common.c
+++ b/core/embed/sec/rng/rng_common.c
@@ -55,6 +55,7 @@ bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
       dst[i] ^= block[i];
     }
 #endif
+#if PRODUCTION  // // HOTFIX -- DELETE IT --
 #ifdef USE_TROPIC
     if (!tropic_random_buffer(block, block_size)) {
       return false;
@@ -63,6 +64,7 @@ bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
     for (size_t i = 0; i < block_size; i++) {
       dst[i] ^= block[i];
     }
+#endif
 #endif
     dst += block_size;
     remaining -= block_size;