# DF-1093 — NULL pointer dereference in ppb_pnp_detect via crafted IEEE 1284 PnP string

## Build

```
cc -O0 -o df1093_harness df1093_harness.c
cc -O0 -DFIX -o df1093_harness_fix df1093_harness.c
```

## Run

```
./df1093_harness        # SIGSEGV at addr 1 (kernel panic equivalent)
./df1093_harness_fix    # safe return, no deref
sh verify.sh            # 7 static source checks
```

## Expected (bug present)

- `verify.sh` reports `PASS=7 FAIL=0` and counts **6** unguarded
  `search_token(token, UNKNOWN_LENGTH, ":") + 1` sites in `ppbconf.c`.
- `df1093_harness` traps a SIGSEGV at address 1 with
  `BUG: NULL+1 deref trapped (SIGSEGV at addr 1)`.
- `df1093_harness_fix` returns normally with
  `MFG keyword found but no ':' — skip safely`.

## Bug shape

`ppb_pnp_detect` at `sys/bus/ppbus/ppbconf.c:213-288` parses an IEEE 1284
PnP ID string and prints the device info. For each of six keywords
(`MFG`/`MANUFACTURER`, `MDL`/`MODEL`, `VER`, `REV`, `CLS`, `CMD`/`COMMAND`)
the function does:

```c
if ((token = search_token(str, len, "MFG")) != NULL || ...)
    kprintf("ppbus%d: <%s", unit,
        search_token(token, UNKNOWN_LENGTH, ":") + 1);   /* :242 */
```

`search_token` (`:177-206`) returns `NULL` when the inner token (here
`":"`) is not found in the scan window. When the malicious peripheral
supplies `MFG\0` (keyword found, no `:` before the next NUL), the inner
`search_token` returns `NULL`. The unconditional `+ 1` then yields
`(char *)0x1`, which `kprintf("%s", ...)` dereferences — unmapped address
in kernel VA, page fault, kernel panic.

A malicious peripheral can craft any of the six keyword-only strings to
trigger the panic at boot or on `kldload ppbus`. `DONTPROBE_1284` is not
defined by default.

## Impact / preconditions

The trigger is **physical** (`AV:P`) — a malicious IEEE 1284 peripheral
plugged into a parallel port. The audit QEMU guest has no parallel port
HW (`pciconf -l` shows no ISA/parallel bridge; `dmesg | grep -c pnp` = 0),
so the path is not exercised at runtime here; the bug is confirmed by
source trace + harness.