changing it back to general gpd5x (done) as the bug was never in any release.

Applied to master.

I created a branch https://dev.gnupg.org/source/gnupg/history/gniibe%252Ft8048 and pushed all changes (including keyboxd-patch-2026-04-23).

As I'd like to have it in vsd34, I'll set that tag (and of course gpd5x, too)

Enhance keyboxd to have new command for what keybox_set_flags does.

FWIW: There is actually a problem in the reference code: Having a
fixed size buffer inside a function and allowing the caller to provide
content at arbitrary length is bad coding style because the caller
needs to know internals of the called function (in a different source
file).

This is the original bug report to security at gnupg dated 2026-04-07:

In T8215#217199, @uwi wrote:

Anyway after reboot I could complete the update. The only think I had noticed was that Kleopatra's hair is blue now (it had been red in the past) ;-)

In T8215#216993, @ikloecker wrote:

By the way, your screenshot shows the wrong folder. That's why you didn't see the file that the error message mentions.

Here is the change:

diff --git a/configure.ac b/configure.ac
index 30be86b5..ac2696e5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3073,7 +3073,8 @@ AC_CHECK_FUNCS(strtoul memmove stricmp atexit raise)
 AC_CHECK_FUNCS(strerror rand mmap getpagesize sysconf waitpid wait4)
 AC_CHECK_FUNCS(gettimeofday getrusage gethrtime clock_gettime syslog)
 AC_CHECK_FUNCS(syscall fcntl ftruncate flockfile getauxval elf_aux_info)
-AC_CHECK_FUNCS(explicit_bzero explicit_memset getentropy sysctlbyname)
+AC_CHECK_FUNCS(memset_explicit explicit_bzero explicit_memset)
+AC_CHECK_FUNCS(getentropy sysctlbyname)

Reporter has tested 2.5 - the code in 2.2 is identical; no need for separate testing

I reworked the reading using our dedicated line reading functions which is used at other places. Extra benefit is that the code now also prints a status line ERROR which gives information on the first faulty line. Thus gpg-connect-agent listtrusted /bye can be sued to quickly check for errors without configuring a log file.

Looks good to me on vsd-3.3.7-beta90.9 @ win10:

Looks good to me on vsd-3.3.7-beta90.9 @ win10.

It is also shown in gpd-5.0.2:

I found the description in ARM Architecture Reference Manual:
https://developer.arm.com/documentation/ddi0487/mb/-Part-D-The-AArch64-System-Level-Architecture/-Chapter-D11-The-Guarded-Control-Stack/-D11-1-Introduction/-D11-1-3-Overview?lang=en