#!/bin/sh
# DF-3171 — exact reproduction sequence (guest), 2026-09-07.
# Root-only *setup*; the corruption is then hit by ordinary file I/O on the
# still-mounted filesystem. Expected on stock kernel:
#   panic "Bad tailq NEXT(%p->tqh_last) != NULL, last %p" in mfsstrategy
#   with stack ufs_strategy -> vop_strategy -> devfs_spec_strategy ->
#   dev_dstrategy_chain -> mfsstrategy.
#
# --- as root ---
# mkdir -p /mnt/mfs /mnt/d2
# chmod 1777 /mnt/mfs
# (mount_mfs -s 32768 swap /mnt/mfs &)           # server pid P -> /dev/mfsP
# mount | grep mfs                                # note the device name
# --- as unprivileged user (maxx): keep continuous I/O on the mount ---
# for i in 1 2 3 4 5 6; do (/tmp/mfsrace /mnt/mfs 2 > /tmp/mfsrace.$i.log &) ; done
# --- as root: kill the server via a VRECLAIMED close while mounted ---
# mount -t devfs none /mnt/d2
# sh -c "exec 8<>/mnt/d2/mfsP; umount /mnt/d2 || umount -f /mnt/d2"
#
# Mechanism: umount of the second devfs vgone()s its vnodes; devfs_spec_close
# calls d_close for a VRECLAIMED vnode regardless of the remaining open count
# (sys/vfs/devfs/devfs_vnops.c:1169-1171), so mfsclose() executes while the
# MFS is still mounted -> mfs_active=0 -> mfs_start exits ->
# destroy_dev(ASYNC: devfs_core.c:754-763) + kfree(mfsp) immediately
# (mfs_vfsops.c:494-498). The still-mounted filesystem's bios then hit
# mfsstrategy with a freed mfsnode (use-after-free) and the orphaned queue.
echo "see comments for the exact commands"