/*
 * DF-1287 trigger analysis — INCONCLUSIVE (no Broadcom BCM43xx HW in guest).
 *
 * The bug is a heap OOB read of up to ~276 bytes past a 128-byte M_DEVBUF
 * allocation in siba_pci_sprom() (siba_core.c:1372-1437) when a Broadcom
 * BCM43xx device's SPROM image (a) has a valid 64-word R123 CRC and (b) a rev
 * byte claiming rev 4, 5, or 8. The dispatcher then calls siba_sprom_r45() /
 * siba_sprom_r8(), which index SPROM words 64..158 but the buffer is only
 * SIBA_SPROMSIZE_R123 = 64 words long.
 *
 * Reproduction requires a Broadcom BCM43xx PCI NIC (or USB-attached chip)
 * with a crafted SPROM. No Broadcom BCM43xx PCI NIC exists in this QEMU guest
 * (pciconf -l shows only i440FX/PIIX/ACPI/virtio/std-VGA), so siba_pci_probe
 * never matches and siba_pci_sprom is never called. Source-level proof in
 * VERDICT.md.
 *
 * Build: N/A.
 * Run  : N/A.
 */
int df1287_trigger_marker = 0;