#!/bin/sh
# DF-3083 run (guest, root): mangled dirent (rec_len % 4 != 0) in a directory
# of a crafted ext2 image.
#   RO mount  -> ext2_dirbad() logs via SDT only, lookup skips -> survives
#   RW mount  -> ext2_dirbad() calls panic() -> kernel panic (local DoS)
set -e
kldload ext2fs 2>/dev/null || true
/root/vntool detach 0 2>/dev/null || true
/root/vntool attach 0 /root/mangle.img
mkdir -p /mnt/e2
echo "--- read-only mount (control) ---"
mount -t ext2fs -o ro /dev/vn0 /mnt/e2
ls -l /mnt/e2/d || echo "(ls -l rc=$? on RO mount: EIO from readdir is expected, no panic)"
umount /mnt/e2
echo "--- read-write mount (trigger) ---"
mount -t ext2fs /dev/vn0 /mnt/e2
# lookup of a name that sorts after the mangled entry walks past it
# (readdir alone EIOs before emitting names, so ls -l is NOT a reliable
# trigger -- use a direct lookup)
stat /mnt/e2/d/file4
echo "NEVER-REACHED: kernel panicked on stock build"