#!/bin/sh
# DF-2005 — runtime trigger is impossible on this guest (HW-gated).
#
# On a real system with a Vega-class AMD GPU + DragonFlyBSD amdgpu, to
# reproduce the (pre-fix) bug:
#
#  1. Craft a minimal ATOM VBIOS image (~2 KB) per findings/poc/DF-2005/README.md
#     (format_revision=9, structuresize=1, data_start near end of small buffer).
#  2. Boot with the malicious VBIOS as a PCIe option ROM
#     (QEMU: -device vfio-pci,romfile=malicious.rom, or a malicious PCIe card).
#  3. UNPATCHED kernel: amdgpu init triggers init_powerplay_table_information()
#     which memcpy's sizeof(PPTable_t) from a truncated table -> kernel panic
#     (page fault) or info leak into pptable_information->smc_pptable
#     (exfiltrable via /sys/class/drm/card0/device/pp_dpm_sclk).
#  4. PATCHED kernel (this fix.diff applied): dmesg shows
#       amdgpu: [powerplay] PowerPlay Table size smaller than ATOM_Vega12_POWERPLAYTABLE!
#     and amdgpu init fails cleanly -- no OOB read.
#
# This script just confirms the HW-gating on the current guest (informational).
echo "DF-2005: HW-gated on this guest (no AMD GPU). Runtime PoC not run."
ssh -F dfbsd-qemu/config dfbsd /bin/sh -c 'pciconf -lv 2>&1 | grep -A3 -i vga; kldstat | grep -iE "amd|drm" || echo "(no amdgpu loaded)"'