--- a/sys/crypto/chacha20/chacha.c	2026-09-15 00:38:47.993911316 +0000
+++ b/sys/crypto/chacha20/chacha.c	2026-09-15 00:38:48.009911114 +0000
@@ -244,6 +244,7 @@
       if (bytes < 64) {
         for (i = 0;i < bytes;++i) ctarget[i] = c[i];
       }
+      explicit_bzero(tmp, sizeof(tmp));
       x->input[12] = j12;
       x->input[13] = j13;
 #ifdef CHACHA_NONCE0_CTR128