/* DF-2409: write /dev/tpm0 (arms 500ms discard callout), snapshot,
 * production tpm20_release + free + canary-resurrect, then wait. */
#include <sys/types.h>
#include <sys/sysctl.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
static void go(const char *s) {
    if (sysctlbyname("kern.dfhwgo", NULL, NULL, s, strlen(s)) < 0)
        perror(s);
}
int main(void) {
    char b[32];
    int fd;
    memset(b, 0x55, sizeof(b));
    go("t20_setup");
    fd = open("/dev/tpm0", O_RDWR);
    if (fd < 0) { perror("open /dev/tpm0"); return 1; }
    if (write(fd, b, 32) != 32) { perror("write"); return 1; }
    close(fd);
    go("t20_snapshot");
    go("t20_release_canary");   /* release + kfree + 0x41-clone */
    printf("released within the 500ms window; waiting 2s for the stale callout...\n");
    fflush(stdout);
    sleep(2);
    printf("survived (no UAF visible?)\n");
    return 0;
}