#!/bin/sh
# DF-1326 run - attempts to open /dev/mprN and trigger MPTIOCTL_PASS_THRU.
# On real hardware with an LSI SAS2008-class HBA present, this opens
# /dev/mpr0 (mode 0640 root:operator -- requires operator group membership),
# issues MPTIOCTL_PASS_THRU with a 1024-byte RequestSize that overflows the
# 12-byte MPI2_REQUEST_HEADER on mpr_user_pass_thru's stack frame.  On the
# audit guest: /dev/mpr0 does NOT exist (QEMU lacks LSI SAS PCI), so the open
# fails with ENOENT.  The structural harness demonstrates the primitive
# independently of the live device.
cd "$(dirname "$0")"
echo "+ ./poc_mpr_stackoverflow   (live trigger; ENOENT on this guest)"
./poc_mpr_stackoverflow
echo "POC_RC=$?"
echo
echo "+ ./harness_overflow         (structural primitive proof)"
./harness_overflow
echo "HARNESS_RC=$?"