#!/bin/sh
# DF-1072 — pnp_create_devices ANSI tag trim loop has no lower bound (buf[-1] read/write).
# Static source verification (runtime needs malicious PnP card returning a
# PNP_TAG_ID_ANSI large tag with length 0 — not present in audit guest).

set -e
F=sys/bus/isa/pnp.c

echo "=== (1) the clamp only enforces upper bound (no lower bound check) ==="
sed -n '398,412p' "$F"

echo
echo "=== (2) with large_len == 0, buf[large_len-1] evaluates buf[-1] ==="
echo "  C: 'A'[large_len-1] with large_len=0 -> 'A'[-1] -> undefined / stack OOB read"
echo "  the loop continues decrementing past buf[0] while bytes below buf are 0x20."
echo "  then buf[large_len] = '\\0' writes NUL at the resulting negative index."

echo
echo "=== (3) PNP_TAG_ID_ANSI value and large-tag bit ==="
grep -nE "PNP_TAG_ID_ANSI|PNP_RES_TYPE|PNP_LRES_NUM" sys/bus/isa/pnpreg.h 2>/dev/null | head
grep -rnE "#define\s+PNP_TAG_ID_ANSI|#define\s+PNP_RES_TYPE|#define\s+PNP_LRES_NUM" sys/bus/isa/ | head

echo
echo "=== (4) pnp.c is built into the default kernel (device isa is configured) ==="
grep -nE "^device.*\bisa\b" sys/config/X86_64_GENERIC

echo
echo "=== (5) no PnP cards present in audit guest, so loop never executes ==="
./dfbsd-qemu/vm.sh run_root 'dmesg 2>/dev/null | grep -iE "^pnp" | head' 2>/dev/null

echo
echo "DONE: all five static checks executed."