#!/bin/sh
# DF-2570 run script
#
# The vulnerable code path (ng_device_rcvdata) is dead code on the default
# DragonFly kernel: sys/netgraph/ng_device.c is not in sys/conf/files, not in
# the running kernel, not loadable as a module (removed cdevsw/make_dev API),
# and the maintained netgraph7/ng_device.c has NO analogous bug.  This script
# therefore reports the dead-code status rather than attempting a trigger.
#
# If the module WERE live (it is not), the trigger would be: as root, build a
# netgraph graph feeding data into an ng_device node hook, e.g.
#     ngctl mkpeer ng_device ng_socket0 dummy ngd0
#     # then push an mbuf down the hook -> ng_device_rcvdata() -> corruption
#
# EXPECTED ON VULNERABLE MODULE LOADED: heap corruption / slab panic on the
#   first mbuf received (kfree of an mbuf-zone pointer through M_DEVBUF).
# OBSERVED ON DEFAULT KERNEL: dead code, cannot trigger.
#
cd "$(dirname "$0")"
echo "=== DF-2570: ng_device_rcvdata kmalloc/mtod/kfree(M_DEVBUF) ==="
./trigger
echo "RUN_EXIT=$?"
echo "--- live reachability check ---"
nm /boot/kernel/kernel.debug 2>/dev/null | grep -c ng_device | sed 's/^/nm ng_device symbol count = /'
grep -c ng_device /sys/conf/files 2>/dev/null | sed 's/^/conf\/files ng_device (sys\/netgraph) entries = /' || true
ls /dev/ngd* >/dev/null 2>&1 && echo "/dev/ngd* EXISTS" || echo "/dev/ngd* does NOT exist (no device created)"
echo "RUN_DONE"