#!/bin/sh
# run2304.sh -- DF-2304 BASELINE: double-free/UAF in
# fwohci_pci_add_child error path (fwohci_pci.c:446-447).
#
# The real error branch is forced by interposing device_probe_and_attach
# to fail exactly at its call (fwohci_pci.c:442) inside a REAL
# fwohci_pci_attach() run: the REAL chain
#   fwohci_pci_attach -> fwohci_init -> bus_generic_probe
#   -> firewire identify -> BUS_ADD_CHILD -> fwohci_pci_add_child
#   -> device_add_child("firewire") -> [forced] probe_and_attach FAIL
#   -> fwohci_pci_detach(parent)  [device_delete_child #:352 frees child]
#   -> device_delete_child(parent, child)  #:447 SECOND delete on freed
# EXPECTED: INVARIANTS kernel panics (double kfree KASSERT
# "memory chunk ... is already free!" or trap in kobj_delete on the
# freed chunk).  Serial console carries the evidence; guest reboots
# into the crash dump.
echo "=== DF-2304 baseline: forced-branch double delete (root) ==="
/root/fwo/fwpcictl attach dpafail
echo "=== if we get here, the double delete SURVIVED (see delete log) ==="