DragonFlyBSD Kernel Audit
DF-2617 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2617 run (guest, root, stock INVARIANTS kernel).
# Each variant needs its own fresh guest (P1/P2 panic; H wedges the mount):
#
#   sh trigger_P1.sh    # expect Fatal trap 12 @ hammer2_vfs_mount+0x1118, VA 0x90
#   (reset guest) sh trigger_P2.sh
#                       # expect Fatal trap 12 @ hammer2_pfsalloc+0x5ef, VA 0x87
#   (reset guest) sh trigger_H.sh
#                       # expect MOUNT_RC=0, unkillable ls (D5/h2coll),
#                       # kthread h2xop-*.23 wchan 'xxx', console
#                       # "hammer2: unexpected NULL data on <chain>"
#
# Full driver from the host (one variant per guest boot):
ssh -F dfbsd-qemu/config dfbsd 'sh /root/poc/df2617/trigger_P1.sh' || true
# capture serial panic
ssh -F dfbsd-qemu/config dfbsd 'dmesg | tail -5' >/dev/null 2>&1 || true
echo "see panic.txt / panic2.txt / run_H.log for the captured evidence"