What makes a firmware ‘valid’ anyway?