#!/bin/sh
# DF-4730 — static proof chain (no Apple SMC on the audit guest).
# Every step prints the cited source lines. Exit 0 = chain confirmed.
set -e
R="${1:-.}"
cd "$R"
S=sys/dev/apple/smc

echo "== [1] apple_smc_sms_intr reads ASMC_INTPORT_READ unconditionally =="
sed -n '609,631p' $S/smc_io.c

echo "== [2] ASMC_INTPORT_READ = bus_read_1(sc->sc_ioport, 0x1f) =="
rg -n "INTPORT" $S/smc.h

echo "== [3] sc->sc_ioport allocated ONLY when !sc_is_mmio =="
sed -n '162,186p' $S/smc.c

echo "== [4] IRQ handler registered whenever sc_has_sms (backend-blind) =="
rg -n "bus_setup_intr|apple_smc_sms_intr" $S/smc.c

echo "== [5] sc_has_sms detection works over either backend =="
rg -n "sc_is_mmio" $S/smc_io.c | head -6

echo "== [6] bus_read_1 -> rman_get_bustag = plain deref =="
rg -n "define rman_get_bustag" sys/sys/rman.h
rg -n "define bus_read_1" sys/sys/bus.h | head -2
sed -n "$(rg -n 'define bus_read_1' sys/sys/bus.h | head -1 | cut -d: -f2),+2p" sys/sys/bus.h 2>/dev/null || true

echo
echo "CHAIN CONFIRMED: MMIO Mac with SMS + SMC IRQ => apple_smc_sms_intr"
echo "=> bus_read_1(NULL, 0x1f) => rman_get_bustag(NULL) => NULL->r_bustag"
echo "=> page-0 fault in interrupt context => panic."