[JaxCalder]

Adds Dmod_TakeDeviceSecret(Buffer, Size), a platform-overridable SAL function (like Dmod_Reboot, #333): the platform that boots the system hands out a secret unique to the device (or to the firmware build), to be taken once.

• Root of whatever is kept encrypted at rest (a vault of secrets, dmsecrets): the module that owns the policy - in DMOD's own system the device file system, which serves it under a node with permissions - takes it at start; other modules ask that module, they do not get it raw.
• The weak default returns -ENOSYS (the host, tests). A platform overrides it: the length on success, -ENOSPC when the buffer is too small (the secret is then not consumed), -EACCES once it was taken, -EINVAL for a NULL buffer.
• Why a SAL function and not a mount parameter / environment / an address: the firmware knows the secret, drivers must stay generic, and an address or an environment variable would tell every module where to read it.

The weak default is tested (tests_dmod_device_secret, passes). The first user is dmod-boot (it supplies the secret at build time) and dmdevfs.

🤖 Generated with Claude Code

[JaxCalder]

Closing: a module that imports a SAL function the loader does not have crashes at load time on an older loader (found while testing dmdevfs against the released loader), so adding a SAL function for this makes every consumer's CI depend on a new runtime image. The secret will be handed over with an ioctl on the dmdevfs mount instead (a new DMDRVI_IOCTL_DEVFS_* command), which needs no change in the loader.