# DF-0624 — reproduce the OOB heap read / panic with a malicious SMB1 server.
#
# This drives the full live chain: a malicious SMB1 server on the host (the
# attacker) + the guest's mount_smbfs/ls client (the victim).  The server lies
# in its TRANS2 response (ParameterCount > actual payload) -> smb_t2_placedata
# inflates m_len -> OOB heap read -> panic on the default GENERIC kernel.
#
#   env CLAIM_PCOUNT=<lie>  BODY_BYTES=<actual>  ./run.sh
#
# CLAIM_PCOUNT=65535 BODY_BYTES=200  -> reliable PANIC (default).
# CLAIM_PCOUNT=512   BODY_BYTES=200  -> silent corruption/leak path (guest up).
set -e
cd "$(dirname "$0")"
MODE="${1:-mount}"
echo "Running live reproduction (mode=$MODE)..."
sh run_live.sh "$MODE"