#!/bin/sh
# DF-0597 run script (root required).
#
# Prereqs (run once as root):
#   kldload ng_pptpgre
#   kldload ng_socket
#   kldload ng_ksocket
#
# This PoC attempts to race ng_pptpgre_disconnect() against an in-flight
# rackTimer trampoline to trigger the UAF on hpriv.
#
# Usage:
#   ./run.sh [topologies=4] [duration_sec=20]
#
# Expected outcome:
#   - On a successful race: kernel panic in ng_pptpgre_recv_ack_timeout
#     (or ng_pptpgre_send_ack_timeout) on a fault virtual address.
#   - On a quiescent system / no race hit: exits cleanly with the message
#     "race was silent". The UAF in that case lands on stale-but-valid
#     memory and is not externally visible. The bug is conclusively
#     proven by source-level analysis — see VERDICT.md.
#
# NOTE: this PoC requires a working netgraph7 ng_socket/ctl environment.
# If the topology build fails with EINVAL, the netgraph7 framework is
# rejecting the session_0001 hook add for reasons unrelated to the UAF
# bug (see VERDICT.md "Live reproduction outcome").
./race_thr "${1:-4}" "${2:-20}"