/*
 * DF-1285 trigger analysis — INCONCLUSIVE (no hptmv HW in guest).
 *
 * The bug is a heap OOB write in OsSendCommand (hptmv/entry.c:2709-2759) when
 * a user issues INQUIRY / READ_CAPACITY / SERVICE_ACTION_IN with a dxfer_len
 * smaller than the fixed-size reply (96 / 8 / 12 bytes respectively). The CAM
 * bounce buffer is allocated at exactly dxfer_len bytes, so the reply
 * overwrites 4..92 bytes past the end.
 *
 * Reproduction requires:
 *   - a DragonFlyBSD system with a Highpoint RocketRAID 182x (Marvell 88SX508x
 *     chipset) HBA attached and presenting disks to CAM, AND
 *   - an unprivileged user with access to a CAM passthrough device (pass(4))
 *     on top of an hptmv disk, OR a filesystem on top of an hptmv disk that
 *     issues INQUIRY/READ_CAPACITY with a small dxfer_len.
 *
 * No hptmv PCI device exists in this QEMU guest (pciconf -l shows only
 * i440FX/PIIX/ACPI/virtio/std-VGA), so hptmv_attach never runs and
 * OsSendCommand is never called. Source-level proof in VERDICT.md.
 *
 * Build: N/A.
 * Run  : N/A.
 */
int df1285_trigger_marker = 0;