# DF-2318 -- pccard_child_pnpinfo_str NULL deref (no CISTPL_VERS_1)

**Impact:** kernel panic at evil-card insertion; re-triggerable on demand by
any unprivileged local user (`devinfo -v` / `sysctl hw.bus.devices`) while
the card is seated. Physical-access DoS (16-bit PC Card socket).

## Reproduce

The rig lives in this directory; it machine-extracts the production
`pccard.c` / `subr_bus.c` / `pccard_cis.c` code **byte-identical** from the
guest's `/usr/src` (sha256-gated) and drives the real entry
`pccard_attach_card()` with crafted CIS images.

```
# on the DragonFly guest (pristine /usr/src):
sh build.sh                     # extract + cc; prints BYTE_IDENTICAL=yes
./run.sh                        # all scenarios
```

**Success criterion (baseline):**
```
SCENARIO no_vers1_devadded ... RIG SIGSEGV si_addr=0x0 (signal 11)   <- DF-2318
SCENARIO no_vers1_nomatch  ... RIG SIGSEGV si_addr=0x0               <- DF-2318
SCENARIO no_vers1_sysctl   ... RIG SIGSEGV si_addr=0x0               <- DF-2318
SCENARIO vers1_pnpinfo_ok  ... exit 0  (negative control)
SCENARIO busypanic         ... RIG KERNEL PANIC: resource entry is busy + exit 42  (DF-5355)
SCENARIO reentry_leak      ... exit 0, leak=19176 bytes after 51 bounce cycles    (DF-5356)
SCENARIO benign_cycle      ... exit 0, leak=0                        (negative control)
```

The same binary covers sibling findings DF-5355 (busypanic) and DF-5356
(reentry_leak); see their packs for their own verdicts.

## Fix A/B

```
sh run_matrix.sh matrix          # baseline + f2318 + f5355 + f5356 variants
```
`f2318` flips exactly the three no_vers1 scenarios to clean exit 0
(`cisvendor="" cisproduct=""` strings built); all other scenarios unchanged.

`fix.diff` == `fixes/df2318.diff` (validated, never applied to sys/).