# DF-4738 — cbb_pci_attach(): collision-blind static CardBus bus-number allocator

File: `sys/dev/pccard/pccbb/pccbb_pci.c` (pass-2 GLM 5.3 re-audit)

## Build (on the audit QEMU guest)

    cc -Wall -Wextra -o /tmp/df4738 /tmp/df4738.c

## Run

    /tmp/df4738

## Expected output (decisive lines)

    => COLLISION: two bridges now own bus 2; type-1 config
       cycles for the CardBus card are also claimed by pcie0 ...
    socket #127: secbus_reg=256 -> u_int8_t secbus=0, ...
    bugs: exit 0

Case 1 shows a firmware-configured PCIe root port keeping bus 2 while a
cbb socket left unprogrammed (SECBUS=0) by firmware is renumbered onto the
same bus 2 — the allocator never checks bus numbers already owned anywhere
in the tree. Case 2 shows the shared static counter has no >255 bound:
socket #127 draws secbus_reg=256, truncated into the u_int8_t softc field
as 0 — the exact sentinel the driver itself treats as "unconfigured".

## Why a userspace replica

The QEMU audit guest has no CardBus bridge (class 0x0607) PCI device at
all — see guest_hw_evidence.txt — so cbb(4) never attaches and the
in-kernel path cannot run. The renumbering arithmetic is deterministic, so
a verbatim replica of pccbb_pci.c:299,344-359 with fixture bridges proves
both defect axes.