/*
 * DF-3844 trigger sketch — mfi command released to the pool while the
 * firmware still owns it (mrsas_issue_blocked_cmd timeout discipline).
 *
 * NOT EXECUTABLE on the audit guest: it needs a MegaRAID SAS HBA behind
 * /dev/mrsas0 and firmware that stalls a passthrough DCMD > 180 s
 * (e.g. a long-running controller op) or drops a completion. The guest
 * has no LSI PCI device (see run.log). The source-level interleaving is
 * proven in VERDICT.md; this file documents the intended repro for a
 * machine that has the card.
 *
 * Prereqs: user in group operator (dev node is 0660 root:operator,
 * mrsas.c:790-792) or root; kernel with mrsas attached.
 *
 * What to run (on equipped hardware), concurrently from two shells:
 *   shell A: ./df3844_trigger   # passthru that stalls the FW (vendor DCMD)
 *   shell B: ./df3844_trigger   # second passthru racing for the same pool
 * After A times out internally (180 s) and releases its mfi cmd while the
 * FW still owns it, watch for: wrong cmd_status delivered to B, duplicate
 * entries on mrsas_mfi_cmd_list_head (pool corruption -> eventual double
 * completion), or a late mrsas_wakeup() on a recycled command.
 */
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>

/* MRSAS_IOC_FIRMWARE_PASS_THROUGH == MFI_IOC_LICENSE... see mrsas_ioctl.h;
 * a full struct mrsas_ioctl_pend_frame with a stalling DCMD opcode is
 * driver-version specific and assembled here only in outline. */
int
main(void)
{
    int fd = open("/dev/mrsas0", O_RDWR);
    if (fd < 0) {
        printf("open(/dev/mrsas0): %s — no MegaRAID HBA / driver attached\n",
            strerror(errno));
        return (1);
    }
    printf("HBA present; issue MRSAS_IOC_FIRMWARE_PASS_THROUGH with a "
        "long-running DCMD and race a second ioctl from another shell.\n");
    close(fd);
    return (0);
}