/*
 * DF-1264 trigger note — drm_dp_sideband_msg_build chunk[48] OOB write.
 *
 * Bug (sys/dev/drm/drm_dp_mst_topology.c:326 drm_dp_sideband_msg_build):
 *   msg->curchunk_len = recv_hdr.msg_len;            // 6-bit, 0..63 (hdr)
 *   ...                                               // no bound vs sizeof(chunk)
 *   msg->curchunk_idx = min(msg->curchunk_len, replybuflen-hdrlen);
 *   memcpy(&msg->chunk[0], replybuf+hdrlen, msg->curchunk_idx); // can be >48
 *   ...
 *   } else {
 *       memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); // OOB
 *       msg->curchunk_idx += replybuflen;
 *   }
 *   chunk is u8[48] (drm_dp_mst_helper.h:216). msg_len up to 63 -> curchunk_idx
 *   grows past 48 -> write past chunk[48] into adjacent msg_rx fields (msg[256],
 *   counts, initial_hdr). Input is an attacker-controlled DisplayPort MST
 *   sideband message header (msg_len + CRC4 attacker-computed).
 *
 * Reachability on the audit guest:
 *   drm_dp_sideband_msg_build is in the loadable drm.ko module (NOT in the
 *   base kernel text).  It is called from the MST topology worker when a DP
 *   MST branch device / monitor sends sideband replies over the AUX channel.
 *   The QEMU guest has no DP MST hardware (its only vgapci is a virtio-class
 *   device), and drm.ko is not loaded.  The path is therefore not reachable
 *   here; the bug is latent and reachable on real MST-capable display setups.
 *
 * This is a documentation/no-trigger PoC.  No userspace program can reach the
 * kernel sink without a DP MST topology; building/loading drm.ko alone is not
 * enough.  See VERDICT.md for the source trace and fix.diff for the patch.
 */
#include <stdio.h>
int main(void) {
    printf("[DF-1264] drm_dp_sideband_msg_build chunk[48] OOB write.\n"
           "[DF-1264] Sink is in loadable drm.ko (module-only); reachable only\n"
           "[DF-1264] via DisplayPort MST sideband replies from real MST HW.\n"
           "[DF-1264] Not triggerable on this QEMU guest (no DP MST device).\n"
           "[DF-1264] Bug confirmed in source; see VERDICT.md + fix.diff.\n");
    return 0;
}