#!/bin/sh
# DF-2615 evidence pack run (on the INSTRUMENTED kernel; see instrument.diff).
# Host side:
#   scp -F dfbsd-qemu/config findings/poc/DF-2615/df2615_trigger.c dfbsd:/root/poc/df2615/
#   dfbsd-qemu/vm.sh run_root 'vnconfig -c vn0 /root/poc/df2615/img; dmesg > /tmp/b; /root/poc/df2615/df2615_trigger 20; dmesg > /tmp/a; grep -c DF2615_LEAK /tmp/a; vnconfig -u vn0'
# EXPECT baseline (instrumentation only): 20 x "DF2615_LEAK: 1 kdmsg_msg(s)
#   queued at iocom_uninit exit"
# EXPECT fix applied (fix.diff): 0 leak lines; 20 x "uninit exit msgq_nleak=0"
#   while "after ping write, msgq.first=<ptr>" still shows the PING queued.
dfbsd-qemu/vm.sh run_root 'vnconfig -c vn0 /root/poc/df2615/img; dmesg > /tmp/b; /root/poc/df2615/df2615_trigger 20; echo TRIG_RC=$?; dmesg > /tmp/a; echo LEAK_LINES=$(grep -c DF2615_LEAK /tmp/a); vnconfig -u vn0'