#!/bin/sh
# DF-5282 — poisoned phase. sc_offs was latched to 0xFF (simulated
# malicious CAPLENGTH). The same driver code paths now touch
# io_hdl+0xFF+reg instead of io_hdl+0x10+reg. On this guest's 4KB BAR
# those addresses are in-bar but unimplemented, so:
#   - GET_STATUS returns 0 (read consumed the poison)
#   - CLEAR/SET PORT_POWER have NO effect on the real port register
#     (write consumed the poison, landed at the wrong offset)
set -e
echo "== poisoned (sc_offs = 0xFF) =="
echo "-- GET_STATUS port1 (now reads io_hdl+0xFF+0x48 = +0x147):"
usbconfig -d ugen0.1 do_request 0xa3 0 0 1 4
echo "-- GET_STATUS port6 (now reads io_hdl+0xFF+0x5C = +0x15B):"
usbconfig -d ugen0.1 do_request 0xa3 0 0 6 4
echo "-- CLEAR_FEATURE(PORT_POWER) port1 (writes io_hdl+0x147):"
usbconfig -d ugen0.1 do_request 0x23 1 8 1 0
sleep 1
echo "-- GET_STATUS port1: real PP state unchanged => write missed:"
usbconfig -d ugen0.1 do_request 0xa3 0 0 1 4
echo "-- SET_FEATURE(PORT_POWER) port1:"
usbconfig -d ugen0.1 do_request 0x23 3 8 1 0