# DF-3003 evidence pack — build/run

## Build
* Guest: `cc -o /root/trig /root/trig.c` (trig.c in this directory; uses
  utimensat with UTIME_OMIT — utimes(tv_sec=-1) is EINVAL on DFly).
* Host (image crafting): `python3 craft_image.py h1.img h1_patched2.img`
  — h1.img is a normal newfs_hammer image containing one file `f` with
  content "hello" (see README "Reproduce" step 1).

## Run
* Stage A (silent write past record's 16KB block): `sh run.sh a`
  Expected: no panic; after umount the image contains
  0x00062e8551e8c000 (=1740000000*10^6) at crafted-target+16392.
* Stage B (mtime panic): `sh run.sh b`
  Expected (vulnerable kernel): panic
  `assertion "(rel_offset & ~(intptr_t)HAMMER_BUFMASK) == 0" failed in
  hammer_modify_buffer` from hammer_sync_inode on the flusher thread.
* Fix validation: apply fix.diff to /usr/src, `make nativekernel`, install,
  reboot, re-run both stages: `f` resolves to ENOENT (crafted record
  rejected with EIO at extraction), no panic, no write.