DF-4543 / poc_agp_liveness.sh
#!/bin/sh # DF-4543 liveness probe: is the agp.c userland attack surface present on this guest? # Checks: /dev/agpgart existence, AGP PCI capability on any bridge, agp module state, # and the VGA device identity (QEMU bochs vs real AGP-capable hw). echo "== uname =="; uname -a echo "== /dev/agpgart =="; ls -l /dev/agpgart 2>&1; echo "ls_rc=$?" echo "== kldstat (agp) =="; kldstat 2>&1 | grep -i agp; echo "kldgrep_rc=$?" echo "== display-class PCI devices =="; pciconf -lv | grep -E "class=0x03|vgapci" echo "== any device advertising AGP capability =="; pciconf -lc 2>/dev/null | grep -i agp; echo "capgrep_rc=$?" echo "== total PCI devices =="; pciconf -l | wc -l |