#!/bin/sh
# DF-1071 — pnp_create_devices large-tag length bytes never subtracted from scanning.
# Static source verification (runtime needs malicious PnP card / hostile QEMU
# device model returning crafted resource data after winning isolation — not
# present in the audit's default QEMU guest).

set -e
F=sys/bus/isa/pnp.c

echo "=== (1) large-tag length bytes consumed but not subtracted from scanning ==="
sed -n '378,398p' "$F"

echo
echo "=== (2) sibling parsers in pnpparse.c DO subtract the 2 length bytes ==="
sed -n '525,540p' sys/bus/isa/pnpparse.c
echo "---"
sed -n '587,600p' sys/bus/isa/pnpparse.c

echo
echo "=== (3) pnp.c is built into the default kernel (device isa is configured) ==="
grep -nE "^device.*\bisa\b" sys/config/X86_64_GENERIC
grep -nE "bus/isa/pnp\.c" sys/conf/files

echo
echo "=== (4) pnp_identify runs every boot but finds 0 PnP cards in the audit guest ==="
./dfbsd-qemu/vm.sh run_root 'dmesg 2>/dev/null | grep -iE "^pnp|^isa.*pnp" | head' 2>/dev/null
echo "(no pnp device lines above = isolation protocol found no PnP cards; the"
echo " vulnerable loop in pnp_create_devices is never entered)"

echo
echo "DONE: all four static checks executed."