DragonFlyBSD Kernel Audit
DF-0771 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-0771 run script — demonstrates the bug via the deterministic harness
# (proves the CRC-bypass + struct-copy OOB logic with the real kernel
# structs and the verbatim CRC inline code). Lives as the unprivileged
# user; needs no privileges and does not touch the kernel.
#
# The full live-path reproduction (crafted HAMMER image mount -> panic at
# hammer_get_inode) is documented in VERDICT.md and reproducer-live.sh;
# it needs root (vnconfig/newfs_hammer/mount_hammer) because the threat
# model is "root/operator mounts an attacker-supplied filesystem image".
set -e
cd "$(dirname "$0")"

echo "==== DF-0771 deterministic harness ===="
./df0771_harness
rc=$?
echo "harness exit: $rc"