# DF-1020 — fw_bus_explore_callback unconditional OOB csrrom write

## Build
```
./build.sh
```
(or: `cc -o harness harness.c`)

## Run
```
./run.sh
```
(or: `./harness`)

## Expected output
The harness demonstrates that ongoaddr (16-bit bitfield) wraps via
csrreg->val*4 (24-bit device-controlled), and the write at firewire.c:1500
occurs BEFORE the bounds check at :1558.

## Preconditions (for runtime trigger)
- A FireWire controller present (to enable bus exploration).
- A malicious FireWire device responding with crafted Config ROM.
- This QEMU guest has NO FireWire hardware — source-level only.

## Fix
`fix.diff` — move the bounds check `(ongoaddr - CSRROMOFF) >= CSRROMSIZE`
to BEFORE the write at firewire.c:1500.