#!/bin/sh
# DF-2984 run (part 1 — root setup, run as root in the guest):
#   1. kldload modA  -> slot 210 goes LIVE (fixed offset 210, normal path)
#   2. unprivileged call210 -> syscall(210) returns the live marker 4242
#   3. kldload modB  -> register EEXIST -> MOD_LOAD fails ->
#      kern_module.c:112 module_unload() dispatches MOD_UNLOAD ->
#      syscall_deregister(210, {0,NULL}) ZEROES THE LIVE SLOT,
#      while kldload(2) for modB still reports success (DF-2936 class)
#
# Success criterion (bug present) after step 3: the NEXT unprivileged
# ./call210 panics the kernel (NULL sy_call dispatch).
set -x
cd /tmp/df2984
kldload ./modA/dfpoca.ko; echo "KLDLOAD_A_RC=$?"
dmesg | tail -3
sudo -u maxx /tmp/df2984/call210; echo "LIVE_CALL_RC=$?"
kldload ./modB/dfpocb.ko; echo "KLDLOAD_B_RC=$?"
dmesg | tail -5
kldstat
echo "=== slot 210 is now {0,0,NULL,0}: unprivileged trigger below ==="