/*
 * DF-3842 PoC trigger (documentation harness — hardware-gated path).
 *
 * Unvalidated firmware ring indices in iwi_tx_intr()/iwi_rx_intr():
 *
 *   iwi_tx_intr()  (if_iwi.c:1681-1694):
 *       hw = CSR_READ_4(sc, txq->csr_ridx);        (fw/MMIO value)
 *       while (txq->next != hw) {
 *           data = &txq->data[txq->next];
 *           ...
 *           ieee80211_tx_complete(data->ni, data->m, 0);  NULL on lap >= 2
 *           data->ni = NULL; data->m = NULL;
 *           txq->queued--;                                 int underflow
 *           txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
 *       }
 *   hw is never masked/validated against IWI_TX_RING_COUNT (64).  If the
 *   firmware (or a wedged card during a bus error) publishes hw >= 64 (e.g.
 *   0xffffffff), `next` (mod 64) can never equal hw: the interrupt handler
 *   spins forever holding IWI_LOCK and the wlan serializer -> hard system
 *   hang.  ieee80211_tx_complete() tolerates ni==NULL (checks it), but
 *   txq->queued underflows and completed slots are re-completed forever.
 *
 *   iwi_rx_intr() (if_iwi.c:1639-1668) has the identical pattern:
 *       for (; sc->rxq.cur != hw;)   with hw = CSR_READ_4(IWI_CSR_RX_RIDX)
 *   and cur = (cur + 1) % IWI_RX_RING_COUNT — same unhangable spin.
 *
 * Trigger: requires the iwi NIC to publish an out-of-range read index —
 * reproducible with hostile/buggy firmware or by wedging the card (e.g.
 * repeated ifconfig down/up during rfkill toggling until a command
 * timeout desynchronises the ring).  Compare: every index read in iwn(4)
 * is bounds-checked before the loop.
 */
int main(void) { return 0; }