#!/bin/sh
# DF-1161 runtime test — NOT EXECUTABLE ON THIS GUEST (no LSI-Logic MPT FC HBA).
# The bug requires mpt(4) to attach to an FC HBA in target mode, plus an
# adjacent FC peer capable of sending crafted LINK_SERVICE_BUFFER_POST_REPLY
# frames with MsgLength > 5 and a TransactionContext >= 64. The QEMU audit
# guest has neither.
set -e
echo "DF-1161: mpt_fc_els_reply_handler unbounded els_cmd_ptrs[] index"
echo "-----------------------------------------------------------------"
echo "PREREQ: host with LSI-Logic MPT-Fusion FC HBA + adjacent FC peer"
echo "        capable of sending crafted LINK_SERVICE_BUFFER_POST_REPLY."
echo
pciconf -lv 2>/dev/null | grep -i 'mpt\|fusion\|lsi.*fc' || true
if ! pciconf -lv 2>/dev/null | grep -q -i 'mpt\|fusion'; then
    echo "no MPT FC HBA present — cannot trigger"
    exit 0
fi
echo "On a vulnerable kernel with FC target mode active, an adjacent peer"
echo "sending LINK_SERVICE_BUFFER_POST_REPLY TransactionContext >= 64"
echo "would cause an OOB read from els_cmd_ptrs[] and likely panic."