Physical firmware disclosure via uncleared validation block

Information disclosure in Semtech LR1110, LR1120, and LR1121 transceiver firmware allows physically proximate attackers to read decrypted firmware. A firmware validity check decrypts an encrypted package block by block but leaves the final plaintext block uncleared in memory, where later SPI memory-read commands expose it. Exploitation requires physical access to the SPI interface or control of its host; the disclosed data excludes cryptographic keys isolated by the onboard crypto engine.