/*
 * DF-2216 / DF-2220 / DF-2223 / DF-2224 verbatim-code rig - HEAD
 * Targets (all LinuxKPI compat shims under sys/dev/drm/):
 *   DF-2216  linux_dmi.c      dmi_match() kgetenv() leak
 *   DF-2220  linux_kobject.c  kobject_release() kobj->name leak
 *   DF-2223  linux_pci.c      pcie_capability_read_dword() *dst uninit
 *   DF-2224  linux_printf.c   seq_printf() __va_list misforwarding
 *
 * Rig class: verbatim-code, kernel-compiled (runtime kldload of drm GPFs
 * on this guest; same class as the DF-2212 ttm harness kernel).  The four
 * production files are #included VERBATIM below - build.sh pins their
 * sha256 against the audited sys/ tree and aborts on mismatch.  The FIXED
 * variants are extracted from fix.diff-applied scratch copies of those
 * same bytes and concatenated after this head (function-renamed so
 * baseline and fixed live in one kernel).
 *
 * The rig fabricates only the BOUNDARY state each verbatim function walks
 * (kenv variables, kobj_type/release pairs, struct pci_dev wrappers around
 * REAL guest PCI device_t's, canary-instrumented seq_file buffers) and
 * meters kernel malloc accounting (malloc_type.ks_use[].memuse/.calls,
 * sys/sys/_malloc.h) to turn "leak" into a deterministic integer delta.
 * All observation state is rig-local; no host memory outside the rig's own
 * allocations is written.
 */
#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/sysctl.h>
#include <sys/errno.h>
#include <sys/libkern.h>
#include <sys/bus.h>

#include <linux/slab.h>		/* MALLOC_DECLARE(M_DRM); the type itself
				 * is kernel-resident:
				 * MALLOC_DEFINE(M_DRM) kern/kern_slaballoc.c:202
				 */

/*
 * kvasprintf()/kasprintf() live in the drm *module*
 * (sys/dev/drm/drm_dragonfly.c:67-84) and are only *declared* in
 * <linux/kernel.h>; the verbatim linux_kobject.c below calls kvasprintf,
 * so the kernel-compiled rig carries the production body verbatim
 * (build.sh extracts+hashes it from the guest tree file).
 */