#!/bin/sh
# DF-1158 runtime test — NOT EXECUTABLE ON THIS GUEST (no Intel 3945ABG WiFi HW).
# The bug requires wpi(4) to attach to a real (or emulated) Intel PRO/Wireless
# 3945ABG NIC. On the QEMU audit guest, pciconf -lv shows no such device, so
# the vulnerable RX-completion interrupt handler (wpi_notif_intr) is never
# entered. This script is a placeholder for what would be the runtime test.
set -e
echo "DF-1158: wpi_notif_intr index-mask bug"
echo "----------------------------------------"
echo "PREREQ: a system with an Intel PRO/Wireless 3945ABG (wpi) NIC attached,"
echo "        or a QEMU/+PCI passthrough setup exposing one."
echo
pciconf -lv 2>/dev/null | grep -i '3945\|wpi' || true
if ! kldstat -v 2>/dev/null | grep -q if_wpi; then
    echo "no wpi driver loaded/attached — cannot trigger"
    exit 0
fi
echo "Triggering wpi RX interrupt storm (would hang on vulnerable kernel)"
echo "On a vulnerable kernel, the host will hang in wpi_notif_intr's"
echo "infinite loop after the firmware writes shared->next > 63."