#include <stdint.h>
#include <string.h>

#define MB_REQ_BUF_SIZE  8
#define MB_RESP_BUF_SIZE 7

typedef enum {
    STATE_IDLE, STATE_SEND, STATE_WAIT_RESP,
    STATE_RESP_OK, STATE_TIMEOUT_ERR, STATE_CRC_ERR
} ModbusState;

typedef struct {
    ModbusState state;
    uint16_t wind_speed_x10;
    uint32_t timeout_start;
    uint8_t retry_cnt;
} WindSensor;

/* 有 BUG 的版本：retry_cnt 未初始化、数组越界可能 */
static void BuildReadRequest(uint8_t *buf)
{
    int i;   /* ❌ C99 混合声明问题 */
    buf[0] = 0x02;
    buf[1] = 0x03;
    buf[2] = 0x00;
    buf[3] = 0x10;
    buf[4] = 0x00;
    buf[5] = 0x01;
    /* ❌ CRC 未计算，buf[6]/buf[7] 未初始化 */
}

static uint8_t ParseResponse(uint8_t *frame, uint16_t len, uint16_t *speed_out)
{
    if (len < 2) return 0;           /* ❌ 应该检查 len < 7 */
    /* ❌ 如果 frame[5] 无效，下面的移位会得到垃圾值 */
    *speed_out = (frame[3] << 8) | frame[4];
    return 1;
}

void PollTask(WindSensor *sensor)
{
    uint8_t buf[MB_REQ_BUF_SIZE];
    uint8_t rx_buf[5];                /* ❌ 比 MB_RESP_BUF_SIZE 小，溢出 */

    if (sensor->state == STATE_SEND) {
        BuildReadRequest(buf);
        for (int i = 0; i < MB_REQ_BUF_SIZE; i++) {
            /* 模拟发送 */
            rx_buf[i & 7] = buf[i];   /* ❌ i 超出 rx_buf[5] 边界 */
        }
    }

    if (sensor->state == STATE_WAIT_RESP) {
        uint16_t speed;
        ParseResponse(rx_buf, 5, &speed);
        sensor->wind_speed_x10 = speed;
    }

    if (sensor->state == STATE_TIMEOUT_ERR) {
        sensor->retry_cnt++;         /* ⚠️ retry_cnt 未初始化 */
    }
}

int main(void)
{
    WindSensor sensor;               /* ❌ 结构体未初始化 */
    sensor.state = STATE_IDLE;
    for (;;) {
        PollTask(&sensor);
    }
}