#!/bin/sh
# variantB.sh — DF-3169 production-shaped race: real userspace triggers +
# fake automountd + umount -f loop.  Hunts the autofs_nmkdir NULL-deref
# (dummymount) panic or any crash from the trigger-retry UAF.
#
# UNPATCHED expectation: guest panics within a few cycles (fatal trap in
# autofs_nmkdir / autofs code), or corrupts silently (see KLD run.log).
# PATCHED expectation (fix.diff): loops forever without a panic.
kldunload df3169_race 2>/dev/null
kldload autofs
sysctl vfs.autofs.timeout=1
sysctl vfs.autofs.retry_attempts=12
sysctl vfs.autofs.retry_delay=2
sysctl vfs.autofs.interruptible=1
sysctl vfs.autofs.debug=0
mkdir -p /df3169b_mp

# unpriv-shaped trigger churn (any process outside the daemon's session)
( while :; do stat /df3169b_mp/key >/dev/null 2>&1; done ) &
CHURN=$!

/root/df3169/fake_daemon /df3169b_mp > /tmp/faked.log 2>&1 &
DAEMON=$!
sleep 1

CYCLE=0
while [ $CYCLE -lt 40 ]; do
	CYCLE=$((CYCLE+1))
	mount_autofs -f df3169b "" /df3169b_mp 2>/dev/null || { sleep 0.3; continue; }
	sleep 1.5
	umount -f /df3169b_mp 2>&1 | sed "s/^/cycle $CYCLE: /"
	sleep 0.7
done

kill $CHURN $DAEMON 2>/dev/null
echo "VARIANT-B-DONE (40 cycles, no panic)"