#!/bin/sh
# DF-2586 — run the PoC.
#   ./run.sh decisive   -> DECISIVE root-only trigger: sets the buggy msgbuf
#                          geometry via kvm_write, then reads kern.msgbuf.
#                          On the UNPATCHED kernel this PANICS (OOB read past
#                          msg_size -> fault -> vm_object_hold_shared assert).
#                          On the PATCHED kernel it returns rc=0, l=n (in-bounds).
#   ./run.sh unpriv     -> unprivileged poll (run as maxx): demonstrates the OOB
#                          is NOT reachable without root (msgbuf_clear). Steady
#                          state never underflows.
#   ./run.sh geometry   -> dump current msgbuf state + branch decision (root).
set -e
cd "$(dirname "$0")"
MODE="${1:-decisive}"
case "$MODE" in
  decisive)
    echo "[*] DECISIVE root-only trigger (sets buggy geometry, reads kern.msgbuf)"
    ./msgbuf_oob_decisive; echo "POC_EXIT=$?" ;;
  unpriv)
    echo "[*] unprivileged poll (300k reads, oldlen=1MiB)"
    ./msgbuf_diag 300000 1048576; echo "DIAG_EXIT=$?" ;;
  geometry)
    echo "[*] dump msgbuf state + sysctl_kern_msgbuf branch decision"
    ./dump_msgbuf ;;
  *)
    echo "usage: $0 {decisive|unpriv|geometry}" >&2; exit 2 ;;
esac