#!/bin/sh
# DF-3312 fix validation:
#  1. reset guest to clean source, apply fix.diff to /usr/src copy
#  2. make nativekernel + installkernel, reboot into patched kernel
#  3. re-run the exact baseline PoC -- the addba_timeout panic must be gone
# Run from the repo root on the host:  sh findings/poc/DF-3312/fixcheck.sh
set -e
D=dfbsd-qemu
P=/root/fw2

$D/vm.sh reset with-src >/dev/null

scp -F $D/config -q findings/poc/DF-3312/fix.diff dfbsd:/root/
$D/vm.sh run_root "cd /usr/src && patch -p1 --dry-run < /root/fix.diff && patch -p1 < /root/fix.diff"

echo "== building patched kernel (nativekernel)..."
$D/vm.sh run_root "cd /usr/src && make -j\$((\$(sysctl -n hw.ncpu)+1)) nativekernel" 2>&1 | tail -5
$D/vm.sh run_root "cd /usr/src && make installkernel" 2>&1 | tail -3
$D/vm.sh run_root "reboot" || true
sleep 45
$D/vm.sh status || $D/vm.sh up
echo "== patched guest: $( $D/vm.sh run_root 'uname -v' )"

echo "== rebuilding KLD on patched kernel + re-running the exact PoC"
sh findings/poc/DF-3312/build.sh >/dev/null 2>&1 && echo BUILD-OK
$D/vm.sh run_root "kldload $P/fw2.ko" || true
$D/vm.sh run_root "ifconfig wlan create wlandev fw2_0 wlanmode ap ssid fwtest mode 11ng channel 1 up"
sleep 2
$D/vm.sh run_root "ifconfig wlan1 create wlandev fw2_0 wlanmode wds wlanbssid 02:de:ad:be:ef:00 wdslegacy"
$D/vm.sh run_root "ifconfig wlan1 ht"
$D/vm.sh run_root "ifconfig wlan1 up"
sleep 2
$D/vm.sh run_root "sysctl kern.fw2_fire=1" || true
sleep 8
echo "== post-PoC status (guest must still be up, no trap):"
$D/vm.sh run_root "uname -v; ifconfig wlan1 | grep status; dmesg | grep -iE 'fatal|trap 12|addba' | tail -5" || true
$D/vm.sh status