From ef5079455eb7c2d6e09ed0e241136bd597ae19bc Mon Sep 17 00:00:00 2001
From: Wessel Nieboer <wessel@weebl.me>
Date: Sat, 14 Feb 2026 14:00:15 +0100
Subject: [PATCH] Fix dirty session keys.

---
 src/helpers/BaseChatMesh.cpp | 4 ++++
 src/helpers/ClientACL.cpp    | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/src/helpers/BaseChatMesh.cpp b/src/helpers/BaseChatMesh.cpp
index 02dc91161..79c3c4a8a 100644
--- a/src/helpers/BaseChatMesh.cpp
+++ b/src/helpers/BaseChatMesh.cpp
@@ -1000,6 +1000,7 @@ bool BaseChatMesh::removeContact(ContactInfo& contact) {
     nonce_at_last_persist[idx] = nonce_at_last_persist[idx + 1];
     idx++;
   }
+  memset(&contacts[num_contacts], 0, sizeof(ContactInfo));
   return true;  // Success
 }
 
@@ -1139,6 +1140,7 @@ SessionKeyEntry* BaseChatMesh::allocateSessionKey(const uint8_t* pub_key) {
 
 void BaseChatMesh::removeSessionKey(const uint8_t* pub_key) {
   session_keys.remove(pub_key);
+  session_keys_dirty = true;
 }
 
 // --- Session key support (Phase 2 — initiator) ---
@@ -1395,6 +1397,8 @@ void BaseChatMesh::checkSessionKeyTimeouts() {
       // All retries exhausted — clean up
       memset(entry->ephemeral_prv, 0, PRV_KEY_SIZE);
       memset(entry->ephemeral_pub, 0, PUB_KEY_SIZE);
+      memset(entry->session_key, 0, SESSION_KEY_SIZE);
+      memset(entry->prev_session_key, 0, SESSION_KEY_SIZE);
       entry->state = SESSION_STATE_NONE;
       entry->timeout_at = 0;
     }
diff --git a/src/helpers/ClientACL.cpp b/src/helpers/ClientACL.cpp
index f3cda385a..fae658aa5 100644
--- a/src/helpers/ClientACL.cpp
+++ b/src/helpers/ClientACL.cpp
@@ -223,6 +223,7 @@ bool ClientACL::applyPermissions(const mesh::LocalIdentity& self_id, const uint8
       nonce_at_last_persist[i] = nonce_at_last_persist[i + 1];
       i++;
     }
+    memset(&clients[num_clients], 0, sizeof(ClientInfo));
   } else {
     if (key_len < PUB_KEY_SIZE) return false;   // need complete pubkey when adding/modifying
 
@@ -460,6 +461,7 @@ SessionKeyEntry* ClientACL::allocateSessionKey(const uint8_t* pub_key) {
 
 void ClientACL::removeSessionKey(const uint8_t* pub_key) {
   session_keys.remove(pub_key);
+  _session_keys_dirty = true;
 }
 
 void ClientACL::loadSessionKeys() {