#!/bin/sh
# DF-0529 trigger: ng_fec node creation panics in ng_fec_constructor
# via interior-pointer kfree(ifp) + double kfree(priv).
#
# The ng_fec module's constructor computes ifp = &priv->arpcom.ac_if,
# which is an EMBEDDED pointer (not separately allocated).  On both
# error paths (ng_fec_get_unit failure at :1091 and ng_make_node_common
# failure at :1099) it does:
#       kfree(ifp, M_NETGRAPH);   <- interior pointer: UB for slab
#       kfree(priv, M_NETGRAPH);  <- double-free of same allocation
#
# On this guest one of those error paths fires on EVERY node creation
# (not just under memory pressure), so the panic is deterministic.
#
# EXPECTED (bug present): kernel panic
#   panic: trying to free NULL pointer
#   _kfree() at _kfree+0x558
#   _kfree() at _kfree+0x558
#   ng_fec_constructor() at ng_fec_constructor+0x3ae
#   (guest dies; ssh hangs)
#
# EXPECTED (fixed): ngctl mkpeer succeeds (or returns a clean netgraph
#   error), guest stays up, no panic.
#
# Run as root (netgraph control socket requires caps_priv_check
# SYSCAP_RESTRICTEDROOT at ng_socket.c:172).

set -e
# base netgraph + ng_fec must be loaded
kldload netgraph 2>/dev/null || true
kldload ng_fec  2>/dev/null || true
echo "loaded modules:"; kldstat | grep -iE 'netgraph|ng_fec'
echo "--- attempting ng_fec node creation (mkpeer) ---"
ngctl mkpeer .: fec myhook peerhook
echo "RC=$? (if you see this, the node was created without panic -> FIXED)"