#!/bin/sh
# DF-0195 run: race the world-readable sysctl read (unprivileged) against a
# concurrent device-detach simulation (root-loaded harness). Demonstrates the
# UAF read -> panic (DoS) + kernel-heap-address leak on the UNPATCHED kernel.
#
# Two cooperating parties (split to match the real threat model, in which the
# unprivileged user only owns the sysctl-READ side and the detach is a
# privileged/hardware event such as a USB unplug or `mdconfig -d`):
#
#   Party A (root, one terminal):   load harness + make freed chunks observable
#   Party B (maxx, another terminal): run ./reader
#
# Root side (Party A):
#     kldload /root/df195/ds195.ko
#     sysctl -w debug.use_weird_array=1     # poison freed chunks so the UAF read is observable
#
# Unprivileged side (Party B):
#     ./reader 20
#
# Expected on UNPATCHED kernel:  reader prints "ANOMALY POISON-0xdeadc0de"
# hex dumps (freed slab memory leaked back through the sysctl) and the kernel
# panics in sysctl_devstat ("Fatal trap 9 ... Stopped at sysctl_devstat+0xa4:
# movq (%rbx),%rbx"); guest dies.
#
# Expected on FIXED kernel:     reader prints no anomalies, exits on alarm
# (RC=142), guest stays up.
echo "reader built as maxx; harness (ds195.ko) must be built+loaded by root first."
echo "see build.sh / README.md"
echo ""
echo "NOTE (2026-09-04 re-verification): run the reader in a BLOCKING ssh session,"
echo "e.g.  vm.sh run_user '/home/maxx/reader 45'   -- backgrounded readers"
echo "(nohup ... & inside su -c) get SIGHUP'd when the ssh session drops and"
echo "exit after printing only their banner."