# DF-0718 PoC — smb_dev2share type-confuses non-vnode fd as vnode

## Build (on guest, as any user)

    cc -o panic panic.c
    cc -o hunter hunter.c

(`hunter.c` warns about implicit `kqueue()` — harmless; add `-include sys/event.h` to silence.)

Or just: `./build.sh`

## Run (as **root**, after `kldload smbfs`)

    ./panic        # deterministic kernel PANIC on the buggy kernel
                   #   (Fatal trap 12, smb_dev2share+0x59, fault 0x70098)
                   # returns errno=22 (EINVAL) with NO panic on the FIXED kernel

    ./hunter       # broad sweep: socket/pipe/kqueue fds
                   #   BUGGY:   errno=9 (EBADF) — type-confusion path entered
                   #   FIXED:   errno=22 (EINVAL) — DTYPE_VNODE check fires

## Reproduce the fix

`smb_dev.c` is built into the `smbfs.ko` module. Apply `fix.diff` to
`/usr/src`, rebuild just the module, install, reload:

    cd /usr/src && patch -p1 < /path/to/fix.diff
    cd /usr/src/sys/vfs/smbfs && \
        KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC make obj && \
        KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC make
    cp /usr/obj/usr/src/sys/vfs/smbfs/smbfs.ko /boot/kernel/smbfs.ko
    chmod 555 /boot/kernel/smbfs.ko
    kldload smbfs          # (or kldunload+kldload if already loaded)

Re-run `./panic` — it must return `EINVAL` with the kernel staying up.

## Expected outcome

- **Bug present** (unpatched `#0` smbfs.ko, sha `d854773e…`): `panic` → kernel
  panic (deterministic). `hunter` → every non-vnode fd returns `EBADF`.
- **Bug fixed** (patched smbfs.ko, sha `73038f80…`): `panic` → `EINVAL`, kernel
  survives. `hunter` → every non-vnode fd returns `EINVAL`; vnode-non-device fd
  still `EBADF` (unchanged).

## Notes

- The trigger must run as **root**: `mount(2)` of `smbfs` requires root
  (`SYSCAP_RESTRICTEDROOT`). This is a root→kernel path, not an unprivileged
  LPE.
- The deterministic panic requires `SO_RCVLOWAT=3` so the misread `v_type`
  equals `VBLK(3)`. Without shaping, default `SO_RCVLOWAT=1` reads as `VREG`
  and the bug manifests as a (still-wrong) `EBADF` rather than a panic.