/*
 * DF-1059 — FW_SBINDADDR/FW_CBINDADDR ir==NULL deref
 *
 * Code-confirmed only: the FireWire controller driver (fwohci) is
 * compiled into the audit kernel, but the QEMU audit guest has no
 * FireWire PCI host controller, so /dev/fw* does not exist on this
 * guest and fw_ioctl is never invoked. This file documents the
 * bug for maintainers; it cannot be exec'd on this guest.
 *
 * Bug (sys/bus/firewire/fwdev.c):
 *
 *   443: ir = d->ir;             <-- only set by FW_SRSTREAM case
 *   ...
 *   592: case FW_CBINDADDR:
 *   ...
 *   600:     STAILQ_REMOVE(&ir->binds, fwb, fw_bind, chlist);  <-- NULL deref
 *   ...
 *   603: case FW_SBINDADDR:
 *   ...
 *   617:     fwb->sub = ir->dmach;                              <-- NULL deref
 *
 * If a user opens /dev/fwN and issues FW_SBINDADDR or FW_CBINDADDR
 * without a prior successful FW_SRSTREAM, d->ir is NULL and the
 * deref panics. Single syscall.
 *
 * Expected panic (with FireWire HW):
 *   Fatal trap 12: page fault while in kernel mode
 *   fault virtual address    = 0x0  (or small offset of dmach/binds)
 *   instruction pointer      = 0x.. in fw_ioctl+0x...
 *
 * Build: nothing to build (no /dev/fw*); for documentation only.
 */

int main(void) { return 0; }