/*
 * DF-1039 — pccard_child_pnpinfo_str NULL deref
 *
 * Code-confirmed only: pccard is the 16-bit PCMCIA bus
 * attachment. The QEMU audit guest has no PCMCIA bridge
 * (no pccard0/exca device), so no pccard bus is ever
 * instantiated and pccard_child_pnpinfo_str is never called
 * at runtime. This file documents the bug; it cannot be
 * exec'd to trigger the panic on this guest.
 *
 * Bug (sys/bus/pccard/pccard.c):
 *
 *   993:  pccard_safe_quote(char *dst, const char *src, size_t len)
 *   ...
 *   999:  while (walker < ep) {
 *   1000: {
 *   1001:     if (*src == '"') {           <-- derefs src with no NULL guard
 *   ...
 *   1020: pccard_safe_quote(cis0, sc->card.cis1_info[0], sizeof(cis0));
 *   1021: pccard_safe_quote(cis1, sc->card.cis1_info[1], sizeof(cis1));
 *
 * cis1_info[0..3] are initialized to NULL in pccard_cis.c:86-89 and
 * only assigned if the card's CIS contains a VERS_1 tuple. A
 * malicious/quirky PC Card without VERS_1 leaves them NULL, then
 * pccard_safe_quote dereferences *src -> page fault -> panic.
 *
 * Reachable automatically on card insert via devadded/devremoved
 * (subr_bus.c:645/673), or by any user reading
 * sysctl hw.bus.devices.N (subr_bus.c:3899).
 *
 * Every other cis1_info consumer checks NULL (pccard.c:974 "i < 4 &&
 * sc->card.cis1_info[i] != NULL", pccard_cis.c:471).
 *
 * Expected panic (with PCMCIA HW + VERS_1-less card):
 *   Fatal trap 12: page fault while in kernel mode
 *   fault virtual address    = 0x0
 *   instruction pointer      = 0x.. in pccard_safe_quote+0x..
 *
 * Build: nothing to build (no HW); for documentation only.
 */

int main(void) { return 0; }