# DF-1038 — wsp_intr_callback TYPE1 NULL deref

## Summary
`wsp_intr_callback` (Apple Wellspring trackpad USB interrupt callback) at
`sys/bus/u4b/input/wsp.c:966` dereferences `sc->index[0]->touch_major`
without a NULL guard. For TYPE1 devices (WELLSPRING1/2) the loop at
`:894-921` runs zero times because the `if (params->tp_type >= TYPE2)`
block at `:884-887` has no else branch to set `ntouch` from the payload,
so `sc->index[0]` stays NULL (M_ZERO softc) → kernel page fault on first
interrupt report.

## HW / preconditions
Requires an Apple WSP trackpad (USB VID 0x05AC, any WELLSPRING* PID) or
a malicious USB gadget emulating one. **Not present in the QEMU audit
guest** — this finding is **code-confirmed only**.

## Build / Run
No buildable PoC (no HW path to the callback in QEMU). The bug is
documented in `wsp_type1_null_deref.c` and confirmed by source review.
`./build.sh && ./run.sh` print the situation.

## Fix
`fix.diff` restores the missing TYPE1 else branch and adds an
`if (ntouch == 0) goto tr_setup;` early-return, mirroring FreeBSD current.