/*
 * DF-1311 trigger-path documentation (NOT a runnable exploit).
 *
 * The vulnerable code path (sys/dev/raid/hptiop/hptiop.c:2401) is the
 * HighPoint RocketRAID ITL-family SCSI submission callback. It is only
 * reachable when a HighPoint HBA is attached, i.e. when the kernel has
 * enumerated a matching PCI device and bound a CAM SIM to it.
 *
 * To trigger on real hardware, an unprivileged user with access to a disk
 * attached to the HBA issues a large read/write (a transfer spanning more
 * than one physical DMA segment):
 *
 *     dd if=/dev/daNs1 of=/dev/null bs=1m count=1024
 *
 * bus_dmamap_load() then yields nsegs = hba->max_sg_count (e.g. 32+), and
 * hptiop_post_req_itl() writes nsegs-1 scatter/gather entries past the
 * 1-entry stack array `struct hpt_iop_request_scsi_command req` (sg_list[1]),
 * corrupting the kernel stack.
 *
 * This QEMU audit guest has NO HighPoint PCI device, so the path is dead code
 * at runtime.  There is therefore no userspace trigger to run here; the
 * verification is a source trace (VERDICT.md) + a compile/boot validation of
 * the fix (fix.diff -> build.log / fix_build.log).
 *
 * Vulnerable signature:
 *   hptiop.c:2419   struct hpt_iop_request_scsi_command req;   // sg_list[1]
 *   hptiop.c:2432   if (ccb->csio.dxfer_len && nsegs > 0) {
 *   hptiop.c:2434       for (idx = 0; idx < nsegs; idx++, psg++) { ...write... }
 *   -> nsegs > 1 overflows req.sg_list past the stack struct.
 *   hptiop.c:2442   bcopy(cdb, req.cdb, ccb->csio.cdb_len);     // cdb[16] overflow
 */
int main(void) { return 0; }