#!/bin/sh
# DF-2572 run script
#
# REQUIRES: ng_device module built + loaded + an /dev/ngd0 node + a netgraph
# peer flipping the hook.  On the default DragonFly kernel ng_device is NOT
# built or loaded (dead code: not in conf/files, not in X86_64_GENERIC,
# cannot compile against the removed cdevsw API).  So this script documents
# what WOULD trigger the race if the module were present, and proves it is
# unreachable on the default kernel.
#
# EXPECTED ON VULNERABLE MODULE LOADED: kernel panic (UAF in ngdread after
#   ng_device_disconnect frees readq, or NULL-deref / list corruption).
# OBSERVED ON DEFAULT KERNEL: module not loadable (dead code), /dev/ngd0 absent.
#
cd "$(dirname "$0")"
echo "=== DF-2572: ng_device global SLIST race (UAF / NULL-deref) ==="
echo "Checking if /dev/ngd0 exists..."
if [ -e /dev/ngd0 ]; then
    echo "/dev/ngd0 exists. Running concurrent racer..."
    ./trigger /dev/ngd0
    echo "RUN_EXIT=$?"
else
    echo "/dev/ngd0 does NOT exist."
    echo "The ng_device module (sys/netgraph/ng_device.c) is orphaned dead code:"
    echo "  - not in sys/conf/files (only netgraph7/ng_device.c is, at :1699)"
    echo "  - not in sys/config/X86_64_GENERIC"
    echo "  - cannot compile (removed cdevsw / make_dev / d_*_t API)"
    echo "  - not in the running kernel (nm count = 0)"
    echo "The maintained netgraph7/ng_device.c has NO global SLIST (per-node priv"
    echo "+ dev->si_drv1 direct pointer) and proper mutexes -> this bug is absent there."
    echo "See VERDICT.md for the full reachability analysis."
    echo "RUN_EXIT=0 (nothing to trigger)"
fi