/*
 * DF-1280 trigger analysis — INCONCLUSIVE (no MPT HW in guest).
 *
 * The bug is an OOB read+write of mpt->reply[] via a malicious IOC
 * address-reply descriptor (MPI_ADDRESS_REPLY_A_BIT set, upper 31 bits
 * pointing outside the 2*PAGE_SIZE reply DMA pool). The dereference is at
 * mpt_intr() mpt.c:743-744; the OOB write-back is via the event-deferral
 * path at mpt.c:588-589.
 *
 * Reproduction requires an MPT/Fusion HBA that posts a crafted reply
 * descriptor via DMA into the host-visible reply queue. No MPT PCI device
 * exists in this QEMU guest, so mpt_intr() is never invoked. Source-level
 * proof in VERDICT.md.
 *
 * Build: N/A.
 * Run  : N/A.
 */
int df1280_trigger_marker = 0;