=== DF-1023 trigger documentation ===

Vulnerable code path:
  mmc_delayed_attach (mmc.c)
    -> mmc_discover_cards
       -> mmc_decode_csd_sd (mmc.c:1056)
          v = mmc_get_bits(raw_csd, 128, 126, 2);  // card-controlled
          if (v == 0) { ... } else if (v == 1) { ... }
          else panic("unknown SD CSD version");    // mmc.c:1108-1109

Trigger precondition: a (potentially malicious) SD card whose CSD
  bits 126-127 == 2 or 3 (csd_structure).
Effect: immediate kernel panic at card enumeration.

Status on this audit guest (no SDHCI PCI device, mmc.ko does not
attach): NOT REACHABLE. Bug is confirmed by code trace at
sys/bus/mmc/mmc.c:1108-1109 and fixed by replacing the panic() with
kprintf + return (mirroring mmc_app_decode_scr at mmc.c:1158-1163).
RUN_EXIT=0