Autonomous unmanned aerial vehicles (UAVs) increasingly rely on software-defined sensing, estimation, networking, and decision pipelines, making firmware integrity a prerequisite for trustworthy autonomy. A compromised or downgraded firmware image can silently alter safety constraints, navigation logic, command authorization, or telemetry behavior even when higher-layer cryptographic communication remains intact. This paper studies a policy-gated firmware trust mechanism implemented in an open GPS-denied UAV swarm research platform and develops a formal model for its anti-rollback and fail-closed properties. The implementation represents each firmware image through a manifest containing semantic version, measurement, signer, keyed-digest field, secure-boot claim, bootloader-lock claim, and monotonic rollback counter. Field and production profiles require secure-boot and bootloader predicates, non-regression of both version and rollback counter, trusted signer membership, keyed manifest integrity, and an admissible firmware measurement before node startup is permitted. Accepted state is persisted only after validation. The paper formalizes these predicates, derives monotonicity and rejection properties, maps threat classes to enforcement paths, and distinguishes source-verified behavior from assumptions that require a hardware root of trust. Repository evidence includes a registered native boot-trust test target with cases for trusted production acceptance, rollback rejection, and unauthorized maintenance rejection; the repository validation report records the native test suite as green at the studied commit. The analysis also exposes two important trust-boundary conditions: rollback protection depends on integrity of the persistent state record, and current secure-boot/bootloader values are externally supplied claims rather than independently measured hardware evidence. The result is a reproducible software-level firmware resilience baseline and a precise roadmap toward hardware-backed attestation.