/*
 * DF-1097 — minimal in-kernel proof of the fwohci_pci_add_child UAF/double-free.
 *
 * This bug is in `fwohci_pci_add_child` at fwohci_pci.c:442-447 and is
 * only reachable from the FireWire (fwohci) PCI driver's attach path.  It
 * requires either a real FireWire OHCI PCI controller or a malicious PCI
 * device that probes as fwohci but fails to attach its firewire child.
 *
 * The default audit guest has no FireWire hardware (no fwohci in dmesg),
 * so this file is *documentation only* — it is the source-level proof of
 * the bug, not a runnable userspace trigger.
 *
 * Source trace (file:fwohci_pci.c lines:442-447):
 *
 *   err = device_probe_and_attach(child);  // child == sc->fc.bdev (set :439)
 *   if (err) {
 *       fwohci_pci_detach(parent);          // :446  -> subr_bus.c:1306 kfree(child)
 *       device_delete_child(parent, child); // :447  -> UAF read + double-free
 *       return NULL;
 *   }
 *
 * fwohci_pci_detach at fwohci_pci.c:351-353:
 *   if (sc->fc.bdev) {
 *       device_delete_child(self, sc->fc.bdev);  // frees child
 *       sc->fc.bdev = NULL;
 *   }
 *
 * device_delete_child at subr_bus.c:1284-1309 then:
 *   - device_detach(child) reads child->state  (UAF)
 *   - TAILQ_FIRST(&child->children)            (UAF)
 *   - child->devclass                          (UAF)
 *   - TAILQ_REMOVE(&dev->children, child, link) — corrupts parent TAILQ (UAF)
 *   - kobj_delete((kobj_t)child, M_BUS)        — DOUBLE-FREE
 *
 * The fix is in fix.diff: clear sc->fc.bdev before calling detach so the
 * detach's delete-child is skipped, leaving the explicit delete-child as
 * the sole delete.
 */

int main(void) { return 0; }