#!/bin/sh
# DF-2816 run (root; destructive: reboots/panics the guest)
#
# baseline variant: single-threaded reboot caller, no siblings -> clean
#   reboot (control; see DF-2815 pack for the dump baseline).
# race variant:    /root/sibs 4  -> 4 sibling threads loop relative-path
#   open() while main calls reboot(RB_DUMP|RB_NOSYNC); on the vulnerable
#   kernel: naccess+0x33 NULL-deref panic then machine wedge.
#
# Run via:  dfbsd-qemu/vm.sh run_root 'sh /root/run6.sh'
case "$1" in
race)
	echo "=== DF-2816: sibs 4 ==="
	sysctl debug.debugger_on_panic=0 debug.trace_on_panic=1 >/dev/null
	/root/sibs 4
	;;
race2)
	echo "=== DF-2816: race2 (ioctl siblings) ==="
	sysctl debug.debugger_on_panic=0 debug.trace_on_panic=1 >/dev/null
	/root/race2 /dev/vbd0s1b 4 8
	;;
*)
	echo "usage: $0 race|race2" >&2
	exit 1
	;;
esac