#!/bin/sh
# DF-0735 run script -- demonstrates the bug and validates the fix on the
# same kernel. Run on the DragonFly guest as root from the directory that
# holds the built .ko files (after ./build.sh).
#
# This is a TWO-PHASE demonstration:
#   Phase A (FIXED, runs first so the guest stays up):
#     Load df735_fixed.ko and invoke debug.df735_fixed. The module uses
#     the same netisr_queue(NETISR_IP, m) pattern that fix.diff applies to
#     ng_ipfw.c:248. No panic; guest stays up. Run 5 times.
#   Phase B (BASELINE / BUG, crashes the guest):
#     Load df735_trigger.ko and invoke debug.df735_trigger once. The
#     module calls ip_input(m) directly from the sysctl-handler thread
#     (mirroring ng_ipfw.c:248 from the netgraph worker thread, which is
#     also non-netisr). The kernel panics with
#       panic: thread ... is not within netisr_ncpus N
#     at ip_input+0x3de. The guest goes down; the panic lands in the
#     serial console log.
#
# After Phase B the guest is wedged in DDB. Reset via the host:
#   ./dfbsd-qemu/vm.sh reset with-src

set -eu
WRK=${WRK:-$(pwd)}

echo "=== Phase A: FIXED module (netisr_queue pattern from fix.diff) ==="
kldload "$WRK/df735_fixed.ko"
kldstat | grep df735_fixed
for i in 1 2 3 4 5; do
    echo "[run $i] sysctl debug.df735_fixed=1"
    sysctl -n debug.df735_fixed=1
done
echo "[+] guest still up after 5 fixed-trigger runs:"
uptime
echo ""
echo "=== Phase B: BASELINE module (direct ip_input, mirrors ng_ipfw.c:248) ==="
echo "!!! Expect a kernel panic NOW -- the guest will go down in DDB."
echo "!!! Capture the panic signature from dfbsd-qemu/boot.log on the host."
sync
kldload "$WRK/df735_trigger.ko"
kldstat | grep df735_trigger
sysctl -n debug.df735_trigger=1
echo "[!] If you see this, the assertion did NOT fire -- investigate."