DF-2694 / run.sh
#!/bin/sh # DF-2694 reproducer (run as an UNPRIVILEGED user). # mode 0 = TCP -> panic: assertion "m" failed in sorecvtcp (uipc_socket.c:1852) # mode 1 = AF_UNIX -> panic: assertion "sb->sb_mb == m" in sbunlinkmbuf (uipc_sockbuf.c:552) # A vulnerable kernel dies within ~2 minutes; a patched kernel prints # "done: N rounds, 0 marker leaks" and stays up. ./poc_race 40 3000 3000 0 |