Known limitations · DiamaneOS

Hardware and firmware

No secure element. Limiting unlock guesses and holding keys rely on the phone’s secure area (TEE), which is not verified.
A broken secure area leaves only the lock. If the secure area were broken, only the strength of the lock would protect the data. A long random passphrase holds. A PIN you choose does not.
Wipes rely on the secure area. A wipe asks the secure area to destroy the keys. That is no promise against someone who copied the storage first and later breaks the secure area.
No memory tagging. Memory bugs are easier to exploit than on phones that have it.
No protected virtual machines. The phone’s firmware does not offer them.
Radio isolation set by closed firmware. The modem and Wi-Fi run in their own memory, and their data paths go through Android’s IOMMU. The limits on the radios themselves are set by closed Qualcomm firmware, so DiamaneOS cannot check them.
Closed firmware. The bootloader, modem and other firmware come from the device maker and Qualcomm. DiamaneOS cannot fix them; fixes come only with the device maker’s releases.
Closed vendor code. The camera, mobile network, graphics, sensors and parts of audio run closed code. The GPU driver runs in every app. New Android versions work only while this code supports them.

USB-C power negotiation stays on. Off stops USB data and charging, but the charger firmware keeps USB-C power negotiation on, and the port cannot be turned off in the first seconds of boot.
Flash mode by hardware keys. Someone holding the phone can start Qualcomm’s emergency download mode (EDL) with the keys. Using it needs a signed tool.
No per-app CPU use in Battery usage. The kernel’s lockdown blocks the CPU time tracking it needs.
A factory reset leaves some data. The modem’s own settings, GPS state and factory calibration stay. eSIM profiles stay unless eSIM support is on and an eSIM was downloaded on the phone; that erase is not tested.
Portable microSD cards and USB drives are not encrypted. A microSD card set up as phone storage is.

Behind GrapheneOS. DiamaneOS follows one GrapheneOS release at a time. The source manifest names it.

Emergency calls tested only in simulation. No call to an emergency number has been made.
Some modem traffic skips Android. The modem itself sends VoLTE and Wi-Fi calling signalling and some location requests, outside VPNs and per-app controls.