/*
 * DF-3679 trigger (source-level; requires igb(4) hardware).
 *
 * The trigger is not a userspace program: the corrupted value lives in the
 * RX descriptor write-back, DMA-written by the NIC. On hardware, inject a
 * write-back with wb.upper.length > posted buffer size, e.g. via a
 * VF-assigned guest or device fault injection, while frames are received:
 *
 *   1. Bring the igb interface up:          ifconfig igb0 up
 *   2. Receive any frame (desc gets DD|EOP).
 *   3. Overwrite the completed descriptor's wb.upper.length with e.g.
 *      0xFFFF *before* the driver's igb_rxeof() runs (interrupt latency
 *      gives the window; or halt the device mid-ring).
 *   4. Observe m_len = 0xFFFF handed to ether_input -> OOB read past the
 *      2046/2048-byte cluster (leak/panic).
 *
 * This file documents the exact driver lines the corrupted field reaches:
 *   sys/dev/netif/igb/if_igb.c:2744  len = le16toh(cur->wb.upper.length);
 *   sys/dev/netif/igb/if_igb.c:2768  mp->m_len = len;
 *   sys/dev/netif/igb/if_igb.c:2770  mp->m_pkthdr.len = len;
 *   sys/dev/netif/igb/if_igb.c:2820  ifp->if_input(ifp, m, pi, cpuid);
 *
 * On the QEMU audit guest there is no igb NIC (vtnet0 only); run.sh proves
 * module presence + device absence. Nothing here is executable without the
 * device.
 */
int main(void) { return 0; }