PASS  PNP_TAG_COMPAT_DEVICE bcopy(res,4) without len<4 guard
PASS  PNP_TAG_IRQ_FORMAT I16(res) without len<2 guard
PASS  PNP_TAG_DMA_FORMAT res[0] without len<1 guard
PASS  PNP_TAG_IO_RANGE res[6]/res[5]=1 without len<7 guard
PASS  PNP_TAG_IO_FIXED res[2]/I16(res) without len<3 guard
PASS  PNP_TAG_MEMORY_RANGE I16(res+7) without len<9 guard
PASS  PNP_TAG_MEMORY32_RANGE I32(res+13) without len<17 guard
PASS  PNP_TAG_MEMORY32_FIXED I32(res+5) without len<9 guard
PASS  PNP_TAG_ID_ANSI correctly clamps len before bcopy (control case)
PASS  pnp_parse_desc signature has no clamp
PASS  pnpparse.c passes attacker-controlled TLV length to pnp_parse_desc

PASS=11 FAIL=0