#!/bin/sh
# run_dockrace.sh -- DF-4823 deterministic trigger (needs ssdt_dock.aml with
# the 3 s-sleeping _STA and the 96 _EJD dependents loaded at boot, and
# /root/dfnt.ko present).
#
# 1. kldload acpi_dock      -> attach stalls 3 s in _STA, then docks:
#                              insert_children queues 96 deferred
#                              acpi_dock_attach_later callbacks (drained).
# 2. sysctl status=0        -> undock (eject walk, status=UNDOCKED).
# 3. kldload dfnt           -> Notify(DFCK, 0x00): the acpi_task kthread runs
#                              acpi_dock_notifyHandler -> device_check ->
#                              get_info -> _STA -> Sleep(3000): kthread parked
#                              3 s INSIDE module text, holding dock serial.
# 4. sleep 1; kldunload     -> detach does not remove the handler and does not
#                              drain OSL work: module text/data freed while
#                              the handler is mid-execution and about to queue
#                              96 more attach_later callbacks.
# 5. sleep 6                -> kthread wakes, resumes/returns into freed text
#                              and queues attach_later into freed text.
# Expected: kernel panic (jump into freed module text) shortly after step 4/5.
set -x
kldload acpi_dock
sysctl hw.acpi.dock.status=0
kldload ./dfnt.ko
sleep 1
kldunload acpi_dock
echo "== acpi_dock unloaded while its notify handler is parked in _STA Sleep"
sleep 6
echo "== SURVIVED (no panic)"
dmesg | tail -5