# DF-3927 — `siba_pcicore_intr`: `1 << tmp` with hardware-derived `tmp` up to 63 (UB shift, wrong IRQ-mask bit on pre-rev6 PCI cores)

## What
`sys/dev/netif/bwn/siba/siba_core.c:2107-2138` (`siba_pcicore_intr`), legacy
branch (ChipCommon/PCIcore sd_rev < 6 and not PCIE):
```c
} else {
	tmp = siba_read_4_sub(sd, SIBA_TPS);
	tmp &= SIBA_TPS_BPFLAG;                        /* 0x0000003f -> tmp in [0,63] */
	siba_write_4_sub(psd, SIBA_INTR_MASK,
	    siba_read_4_sub(psd, SIBA_INTR_MASK) | (1 << tmp));   /* :2131-2132 */
}
```
`1 << tmp` with `tmp >= 32` is undefined behavior (C11 6.5.7). On x86 the
compiler emits `shl cl` which masks the count to 5 bits, so a hardware
TPS value of e.g. 33 enables bit 1 instead of bit 33: the *wrong* backplane
interrupt source is enabled. That corrupts interrupt routing on the shared
IRQ (missed device interrupts / interrupt storms) — a correctness/availability
defect, not memory corruption.

- `SIBA_TPS`/`SIBA_TPS_BPFLAG` = 0x0f18 / 0x3f (sibareg.h:258-259) — the value
  is device-controlled MMIO.
- Upstream-inherited: identical code in FreeBSD siba (rev 299541 lineage).

## Impact
Info (hardware-gated functional bug on ancient PCI-only cores; no memory
safety impact). Confidence likely (UB semantics certain; observable misroute
depends on TPS values the core reports).

## Fix
```diff
 	} else {
 		tmp = siba_read_4_sub(sd, SIBA_TPS);
 		tmp &= SIBA_TPS_BPFLAG;
-		siba_write_4_sub(psd, SIBA_INTR_MASK,
-		    siba_read_4_sub(psd, SIBA_INTR_MASK) | (1 << tmp));
+		if (tmp < 32)
+			siba_write_4_sub(psd, SIBA_INTR_MASK,
+			    siba_read_4_sub(psd, SIBA_INTR_MASK) | (1u << tmp));
 	}
```