# DF-5444 — pnp_set_config() panics on card-supplied misaligned memory base (sys/bus/isa/pnp.c:260-261)

## What

`pnp_set_config()` (the ISA_SET_CONFIG_CALLBACK installed by
`pnp_create_devices`, pnp.c:456-457) executes
`panic("pnp_set_config: bogus memory assignment")` when the assigned memory
base has bits below 0x100 set.  The base is card-controlled end-to-end:

  * `pnp_parse_desc()` PNP_TAG_MEMORY32_RANGE stores a fully arbitrary
    32-bit `ir_start` and `ir_align` from the card (pnpparse.c:295-300) —
    no 256-byte granularity clamp (unlike PNP_TAG_MEMORY_RANGE at
    pnpparse.c:266-269 which forces align ≥ 0x10000);
  * `isa_find_memory()` (isa_common.c:128-148) starts its candidate loop at
    the card-supplied `ir_start` and steps by `MAX(align,1)` — with align=1
    the *first* candidate is the misaligned base itself;
  * the config callback then panics (pnp.c:260-261).

Same reachability for PNP_TAG_MEMORY32_FIXED (pnpparse.c:323-328, align=1,
fixed base).

## Trigger model

Crafted ISA-PnP card (or emulated/counterfeit PnP device in a VM) declaring
a logical device with `MEMORY32_RANGE base=0xE0001001 align=1 size=1`.
Boot-time / driver-load-time kernel panic = DoS (DS_ATTACHED-gated identify
 notwithstanding: the kldload→isa_driver_added path runs the whole engine,
 see DF-5392).

## Rig

Same `rig/` as DF-5443 (verbatim pnp.c engine + virtual card).  Module
`hack_dfb` (script 2): card declares one logical device with the misaligned
MEMORY32_RANGE above and a valid END tag.  `pnp_create_devices` (real code)
creates the child with the real `pnp_set_config` callback;
`isa_driver_added`'s child loop (isa_common.c:835-862) then runs
`isa_assign_resources` → callback → panic.

## Build / Run

    (cd /usr/src/sys/bus/isa/hack_dfb && make obj && make depend && make)
    kldload /usr/obj/usr/src/sys/bus/isa/hack_dfb/rigdfb.ko

## Expected

Baseline: `panic: pnp_set_config: bogus memory assignment`, trace
`pnp_set_config <- isa_assign_resources <- isa_driver_added <- devclass_add_driver`.

Fixed kernel (fix.diff: pnpparse.c clamps MEMORY32_* granularity to 0x100
and rounds bases to 256; pnp.c degrades gracefully instead of panicking):
no panic, warning printed, kldload returns 0.