#!/bin/sh
# run2303b.sh -- DF-2303 (B): impossible-state injection proving the
# latent negative-length bcopy at fwohci.c:2735 is a live memory-
# corruption landmine IF the state machine ever hands the split-header
# path a previous-buffer fragment longer than sizeof(pktbuf)=16.
# The battery in run2303.sh shows no packet input can produce that
# state; this injection demonstrates the consequence.
#
# EXPECTED: "why rlen < 0" then Fatal trap 12 (page fault) in
# fwohci_arcv from the bcopy with (size_t)-8.
#
# Run as: sh /root/fwo/run2303b.sh
FW=/root/fwo/fwpoc
echo "=== DF-2303 (B): inject buf_offset = -(4096-24) -> rlen_old=24 ==="
$FW ctl dbinit 2 0 0 0 0 0 0
$FW ctl rxen 2
dmesg -c >/dev/null
$FW ctl arcv 1 0 0 4072
echo "=== survived (unexpected on baseline) ==="