#!/bin/sh
# DF-0627 reproducer runner.
#
# The bug is triggered by a malicious SMB SERVER sending duplicate SMB
# responses for an outstanding MID; the victim is the kernel SMB CLIENT
# (mount_smbfs / netsmb). Reproducing it end-to-end requires:
#   1. A malicious SMB1 server reachable from the guest (network attacker).
#   2. A victim mounts its share (e.g. mount_smbfs //user@evil/share /mnt) and
#      issues any request that produces an outstanding MID.
#   3. The server sends ONE valid reply for that MID, then a burst of K
#      additional NetBIOS-framed SMB messages bearing the SAME MID. Each
#      duplicate hits the `else` branch at smb_iod.c:363-366 and is orphaned.
#
# Effect: each duplicate leaks one mbuf chain (up to SMB_MAXPKTLEN=0x1FFFF).
# `netstat -m` mbuf count climbs monotonically; a sustained flood drives the
# kernel into mbuf/memory exhaustion and panic.
#
# This script documents the harness (a full SMB1 negotiation/session-setup
# server is out of scope for this evidence pack). The bug itself is proven by
# source tracing — see VERDICT.md.
echo "DF-0627: see VERDICT.md for the source-level proof."
echo "Trigger requires a malicious SMB server (network attacker position);"
echo "observe mbuf leak via: ssh dfbsd 'netstat -m'"
exit 0