U-Boot Boot Menu Timeouts: Zero Delay Does Not Follow the Highlighted Default

A device boots the expected menu entry after a countdown, but selects
another entry when the delay is changed to zero. In U-Boot v2025.01,
those paths are intentionally different: zero delay bypasses menu
construction and directly executes entry zero. The highlighted default
belongs to the constructed-menu path.

For a Buildroot product that relies on U-Boot menus for unattended
startup, qualify the exact caller, delay and input conditions. This
analysis covers environment-defined menu entries. It assumes no pending
EFI BootNext diverts control before menu handling. EFI boot-option
maintenance and full console-access policy require separate review.

Resolve the delay
at the actual entry point

The bootmenu command accepts an explicit delay argument.
Otherwise it checks bootmenu_delay; absent both, the
implementation uses nonnegative CONFIG_BOOTDELAY when
available, or its local default of ten seconds. A negative delay
disables automatic selection. Command
documentation, do_bootmenu()
implementation.

Do not assume every menu invocation resolves the environment the same
way. The startup integration calls menu_show() with a delay
supplied by its caller. That wrapper and the explicit shell command have
different return and repetition behavior even though both use
bootmenu_show().

Zero delay bypasses
bootmenu_default

At zero delay, bootmenu_show() retrieves
bootmenu_0, finds the first equals sign and executes the
following command text. Missing entry zero or a malformed value fails
this internal operation. It does not construct the menu or read
bootmenu_default in that branch. Zero-delay
branch.

With a displayed menu, bootmenu_create() begins at
active index zero and then reads bootmenu_default as a
decimal index. After building the entries, it resets an out-of-range
active index to zero. The choice callback uses that active index when
selection occurs.

The generic menu also has a default-item setting of zero, which can
confuse a source review. In this integration, interactive choice
delegates to the bootmenu-specific callback. Countdown expiry produces a
select event, and that callback returns the currently active entry.
Follow the callback rather than treating the generic default setting as
the only selection rule. Bootmenu
choice logic, generic
menu dispatch.

Therefore a hypothetical configuration with two valid entries and
bootmenu_default=1 can select entry one after an
uninterrupted positive countdown, while zero delay executes entry zero.
This is a source-derived prediction, not a reported device test.

A finite
countdown can become an indefinite prompt

The countdown helper polls console input. When it sees a character,
it sets the delay to minus one before interpreting that character. An
ordinary character need not select an entry; it can simply stop
automatic selection. With no subsequent valid selection, the menu
remains interactive. Countdown
loop.

This matters for service fixtures, attached terminal software or
other sources of unexpected console input. A positive configured timeout
does not guarantee unattended progress if input cancels it. Test both a
disconnected console and controlled incoming characters; observing one
successful quiet-console boot does not cover the cancellation
branch.

Keep menu numbering contiguous as well. Environment-entry
construction stops when the next numbered variable is absent, and a
value lacking an equals sign ends that construction loop. A visible
default index only has meaning relative to the entries actually
constructed. Entry
construction.

Observe the
selected action, not just shell success

The explicit do_bootmenu() command calls
bootmenu_show() and then returns zero without forwarding
its internal result. Thus its shell status alone does not certify that
the selected boot command succeeded. The startup wrapper instead
consumes the internal result and, with console disabling configured, can
repeat the menu with automatic selection disabled on later
iterations.

Use harmless marker actions in a recoverable qualification image.
Compare positive delay, zero delay, negative delay, an invalid default
index and countdown cancellation. Record the marker reached and whether
the menu returns or waits again. No menu commands or boot attempts were
executed for this article. The desired contract is explicit: which
action starts without an operator, and which input or failure conditions
suspend that progress.