#!/bin/sh
# DF-1070 — scsi_targ_bh teardown UAF (fixed hz/2 sleep, no wakeup source).
# Static source verification (runtime needs SCSI target-mode HBA; driver is
# `optional targbh` and is NOT built into X86_64_GENERIC — see env.txt).

set -e
F=sys/bus/cam/scsi/scsi_targ_bh.c

echo "=== (1) the fixed hz/2 sleep + immediate kfree ==="
grep -nE "sim_lock_sleep.*hz/2|kfree\(softc" "$F"

echo
echo "=== (2) NO wakeup(softc) anywhere in the file (only wakeup on other addrs) ==="
echo "all wakeup() calls:"
grep -nE "\bwakeup\(" "$F" || echo "  (no wakeup calls at all)"
echo
echo "the XXX comments marking the unfinished sync:"
grep -nE "XXX (Block|Wait)" "$F"

echo
echo "=== (3) targbhdislun aborts ATIOs and IMMED_NOTIFY but NOT CTIOs ==="
sed -n '329,385p' "$F" | grep -nE "XPT_ABORT|accept_tio_list|immed_notify_slist|XPT_CONT_TARGET_IO|continue" | head -20

echo
echo "=== (4) targbhdone dereferences periph->softc unconditionally ==="
grep -nE "softc = .*periph->softc|TAILQ_REMOVE\(&softc->pending_queue" "$F" | head -5

echo
echo "=== (5) scsi_targ_bh is optional targbh (NOT in default GENERIC) ==="
grep -nE "scsi_targ_bh" sys/conf/files
echo "in X86_64_GENERIC (expect none):"
grep -nE "targbh|targ_bh" sys/config/X86_64_GENERIC || echo "  (not configured)"
echo "in running kernel (expect none):"
./dfbsd-qemu/vm.sh run_root 'nm /boot/kernel/kernel 2>/dev/null | grep -i targbh' 2>/dev/null | head || echo "  (not in kernel — confirmed)"

echo
echo "DONE: all five static checks executed."