#!/bin/sh
# DF-0289: Verify the UAF code path exists in the kernel source
# ieee80211_mesh_rt_find returns rt after MESH_RT_UNLOCK (line 239)
# mesh_rt_del frees rt under MESH_RT_LOCK (line 365)
# forward_to_gates drops/reacquires lock in TAILQ_FOREACH_SAFE (lines 1146/1158)
echo "=== ieee80211_mesh_rt_find: returns rt after unlock ==="
grep -n 'MESH_RT_UNLOCK\|return rt' /usr/src/sys/netproto/802_11/wlan/ieee80211_mesh.c | head -10
echo ""
echo "=== forward_to_gates: lock drop/reacquire inside loop ==="
grep -n 'MESH_RT_UNLOCK\|MESH_RT_LOCK' /usr/src/sys/netproto/802_11/wlan/ieee80211_mesh.c | grep -A1 -B1 '11[0-9][0-9]:'
echo "RUN_EXIT=$?"