/*
 * DF-5455 shim, deliberately in its own compilation unit.
 *
 * It reproduces the exact usbd_do_request_flags() failure semantics for
 * an evil MCS7703 (traced in usb_request.c):
 *   mode 0: data/status stage never answered -> USB_ERR_TIMEOUT
 *           (usb_request.c:642-650: the WXFER loop breaks on
 *           xfer->error BEFORE the usbd_copy_out at :680-681)
 *   mode 1: zero-length data stage, status stage OK -> SUCCESS with
 *           nothing copied (usb_request.c:666-683)
 * In both modes the caller's buffer is left untouched, and the
 * usb_error_t is discarded by production umoscom_cfg_read() either way
 * (umoscom.c:551-556).
 *
 * Keeping this OUT of mo5455_harness.c's TU mirrors production, where
 * usbd_do_request_proc() is an opaque cross-module call: the compiler
 * must then keep umoscom_cfg_read()'s `val' as a real stack load --
 * which is the uninitialized-memory disclosure under test.
 */
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/bus.h>
#include <bus/u4b/usb.h>
#include <bus/u4b/usbdi.h>

void		mo_shim_request(struct usb_device_request *, void *, int);

int		mo_shim_mode;
int		mo_shim_requests;

void
mo_shim_request(struct usb_device_request *req, void *ptr, int timo)
{
	mo_shim_requests++;
	/* *ptr deliberately NOT written -- that is the bug's precondition */
	if (mo_shim_mode == 1)
		return;			/* USB_ERR_NORMAL_COMPLETION, 0 bytes */
	(void)req;
	(void)ptr;
	(void)timo;
	return;				/* USB_ERR_TIMEOUT (or SHORT_XFER) */
}