#!/bin/sh
# DF-1045 PoC run script
# Run as root (targopen requires SYSCAP_RESTRICTEDROOT).
#
# On the default X86_64_GENERIC kernel, /dev/targ* does not exist because
# 'device targ' is not in the config — scsi_target.c is 'optional targ'.
# Even if it were compiled in, TARGIOCENABLE requires a SCSI HBA with
# PIT_PROCESSOR (target mode), which the QEMU guest lacks (only ATA buses).
#
# So this PoC documents that the bug path is unreachable on this guest.
set -e
cd "$(dirname "$0")"
echo "[run] attempting to exercise targclose UAF path..."
echo "[run] NOTE: default kernel has no 'device targ' — /dev/targ* absent"
echo "[run] attempting open anyway to document the gate..."
./tgt_uaf 1 0 0 2>&1 || true
echo "[run] exit status reflects: /dev/targ absent on default kernel"
echo "[run] See VERDICT.md for source-level UAF confirmation."