Secure Boot Bypass on NXP i.MX

This report details a mitigated but serious secure-boot bypass in NXP i.MX devices running HABv4 versions older than 4.3.7, where maliciously modified DCD or CSF sections can execute ROM commands that alter a second-stage bootloader in RAM before authentication is verified; the author demonstrates PoC techniques, documents the vendor and U-Boot software mitigations (and their release timeline), and highlights concerns about potentially unpatched field devices due to supply-chain and update-delivery complexities.