/*
 * DF-1038 — wsp_intr_callback NULL deref on TYPE1 (WELLSPRING1/2)
 *
 * Code-confirmed only: this is a USB trackpad driver callback
 * (wsp.c:836-1075) that is invoked by usbd_transfer once an interrupt
 * URB has been delivered for an attached WSP device. The QEMU audit
 * guest has no Apple Wellsping trackpad (USB VID 0x05AC, any of the
 * WELLSPRING* PIDs listed in wsp_devs[]), so the callback is never
 * called at runtime. This file documents the bug and the expected
 * panic signature for a maintainer; it cannot be exec'd on this guest.
 *
 * Bug (sys/bus/u4b/input/wsp.c):
 *   845:   int ntouch = 0;
 *   884:   if (params->tp_type >= TYPE2) {
 *   885:       ibt    = sc->tp_data[params->tp_button];
 *   886:       ntouch = sc->tp_data[params->tp_button - 1];   <-- TYPE1 skips this
 *   887:   }
 *   894:   for (i = 0; i != ntouch; i++) { ... sc->index[i] = f; }  <-- 0 iterations on TYPE1
 *   966:   if (sc->index[0]->touch_major < ... )             <-- derefs NULL on TYPE1
 *
 * TYPE1 = WELLSPRING1 / WELLSPRING2 (initial MFG trackpads, products
 * 2008-2010). On first interrupt report with no finger down, ntouch
 * stays 0, sc->index[0] is still NULL (newbus M_ZERO alloc), and
 * wsp.c:966 dereferences it -> page fault -> panic.
 *
 * Expected panic (with WSP USB HW):
 *   Fatal trap 12: page fault while in kernel mode
 *   fault virtual address    = 0x0
 *   instruction pointer      = 0x.. in wsp_intr_callback+0x...
 *
 * FreeBSD current has the else branch this driver is missing:
 *
 *   } else {
 *       ntouch = (len - params->tp_offset) / params->tp_fsize;
 *   }
 *   if (ntouch == 0)
 *       goto tr_setup;
 *
 * Build: nothing to build (no HW); for documentation only.
 */

int main(void) { return 0; }