# DF-2769 fix validation (patched kernel #1, same devfs exposure rule as baseline)
$ (/tmp/pty_master_hijack victim > /tmp/victim.out 2>&1 &); sleep 2
UNIT=/dev/pts/0
$ devfsctl -a -m /dev -f /tmp/rules && echo RULES_OK
RULES_OK
$ ls -la /dev/ptm/
crw-rw-rw-  1 root  wheel  32, 0x00000000 Sep  1 00:25 0   <-- stale master exposed 0666 (rule active)
$ su -m nobody -c "/tmp/pty_master_hijack attack /dev/pts/0 /tmp/df2769_cmd"
attack: open /dev/ptm/0 failed: Input/output error     <-- EIO: PF_SOPEN fence hit
RESULT=FENCED
attack rc=1
$ ls -la /tmp/df2769_root_pwn
ls: /tmp/df2769_root_pwn: No such file or directory    <-- no injection, no root file
# regression: fresh ptmx clone + slave open still work on the patched kernel
#   (the victim program itself allocated the pty and ran its session).
# baseline (stock #0): identical setup => RESULT=HIJACKED + root-owned proof file.