/*
 * DF-2237 privesc-feasibility check: can an unprivileged user map page 0?
 * The NULL-deref in iconv_xlat16_conv reads NULL + c2*4 (c2 in 0..0x7f,
 * fault VA in 0x0..0x1fc). If page 0 were user-mappable this would be a
 * controlled-read primitive (attacker would read their own page -- still
 * no info gain). Verify it is unmappable on this amd64 guest.
 */
#include <errno.h>
#include <stdio.h>
#include <sys/mman.h>

int
main(void)
{
	void *p;

	p = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
	    MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0);
	if (p == MAP_FAILED) {
		printf("mmap(page0, MAP_FIXED) FAILED errno=%d (%s) -- "
		    "page 0 not mappable, NULL-deref is panic-only\n",
		    errno, strerror(errno));
		return (0);
	}
	printf("mmap(page0, MAP_FIXED) SUCCEEDED at %p -- page 0 mappable!\n", p);
	return (1);
}