#!/bin/sh
# DF-2208 evidence run, phase 2 (THE PANIC). Run ON THE GUEST as root.
# Loads the rig KLD (matrix re-runs harmlessly), then writes
# kern.df2208_fire=1 which injects kzalloc==NULL at drm_sysfs.c:39 and
# calls the VERBATIM drm_sysfs_connector_add: line 40 writes
# connector->kdev->kobj.name at NULL+8 -> fatal page fault -> panic.
# THE GUEST DIES BY DESIGN; capture the panic from the serial console
# (host: dfbsd-qemu/vm.sh log) and reset afterwards
# (host: dfbsd-qemu/vm.sh reset with-src).
set -e
cd "$(dirname "$0")"

./build.sh

kldload "$(pwd)/df22_rig.ko"
sleep 1
echo "[fire] arming DF-2208 kzalloc-NULL case via kern.df2208_fire=1"
sysctl kern.df2208_fire=1
echo "[fire] UNEXPECTED: sysctl returned; kernel did not fault"