#!/bin/sh
# DF-4110 hardware presence probe (audit guest).
# The trigger for this finding is device-DMA-written frame metadata on a
# ThunderLAN NIC; the guest has no such device, so the PoC phase is
# honestly limited to the presence probe (status: untested).
echo "--- uname ---"; uname -a
echo "--- interfaces ---"; ifconfig -l
echo "--- PCI vendor/device probe (ThunderLAN IDs: 0x104C:0x0500, 0x0E11:*) ---"
pciconf -l 2>/dev/null | grep -E 'chip=0x0500104(c|C)|vendor=0x104[cC]' && echo TL_PRESENT || echo TL_ABSENT