#!/bin/sh
# DF-0503 — ng_fec UAF demonstration (root-only).
# Sets up a fec bundle, then destroys a member interface, then waits
# for ng_fec_tick to deref the stale pointer.  On the buggy kernel
# this panics or corrupts memory; on a fixed kernel the
# ifnet_detach_event handler has nulled the stored pointer.
set -e
cd "$(dirname "$0")"

# This PoC requires root and the ng_fec + tap modules.  Running it
# end-to-end requires careful netgraph scripting; see VERDICT.md for
# the realistic scenario (admin destroys a bundle member iface).
echo "DF-0503: see VERDICT.md for the trigger analysis."
echo "This finding is a root-configured/root-triggered UAF:"
echo "  - ng_fec module load: kldload (root)"
echo "  - bundle configuration: ngctl (root, via socket(AF_NETGRAPH))"
echo "  - member iface detach: ifconfig destroy (root)"
echo "  - UAF fires from ng_fec_tick (1Hz callout)"
echo
echo "Code-path is confirmed at path:line.  No unpriv->root vector."
echo "RUN_EXIT=$?"