#!/bin/sh
# DF-0526 trigger: ng_fec_choose_port OOB read (no m_pullup).
#
# ng_fec_choose_port() (:897-903) does:
#     eh = mtod(m, struct ether_header *);
#     ip = (struct ip *)(mtod(m,char*) + sizeof(ether_header));
#     ip6 = (struct ip6_hdr *)(mtod(m,char*) + sizeof(ether_header));
# with NO m_pullup and NO m_len check.  A short or fragmented mbuf whose
# head does not contain a full ether+IP header causes an OOB read past
# m_data when the switch derefs ntohl(ip->ip_dst) / ip6_dst.
#
# This is an OOB READ (info leak of adjacent slab/stack bytes), not a
# write.  Triggering it requires injecting a short mbuf into the fec
# if_snd queue, which needs a working fec node (DF-0529 must be fixed)
# plus a crafted packet whose head mbuf is shorter than
# sizeof(ether_header)+sizeof(ip).
#
# EXPECTED (bug present, on DF-0529-fixed kernel): OOB read of mbuf
#   trailing bytes; on INVARIANTS this may panic on a poisoned slab;
#   otherwise silent info leak.
#
# EXPECTED (fixed): short mbuf -> m_pullup fails -> choose_port returns
#   ENOBUFS, packet dropped, no OOB read.
#
# Run as root. (Demonstration needs crafted raw injection; this script
# is the harness entry point.  See VERDICT.md for the source-level proof.)

kldload netgraph 2>/dev/null || true
kldload ng_fec  2>/dev/null || true
echo "DF-0526: see VERDICT.md for source-level proof (OOB read at"
echo "ng_fec.c:897-935, no m_pullup).  Runtime demonstration needs a"
echo "DF-0529-fixed kernel plus crafted short-mbuf injection into fec0."