#!/bin/sh
# DF-5052 fix-semantics validation: the fix sets vector->container=NULL
# after the first kfree; we emulate exactly that state change with a
# kmem write and show destruct #2 becomes a safe no-op.
KV=/root/kv
KMALLOC=FFFFFFFF80656DC0
MTEMP=FFFFFFFF810D99C0
export KV_BCOPY=FFFFFFFF80BCA6A0
exec > /tmp/fv.out 2>&1
echo "### DF-5052 fix-semantics validation"
kldstat | grep -q amdgpu.ko || kldload amdgpu
BASE=$(kldstat | grep amdgpu.ko | awk '{print $3}' | sed 's/^0x//')
VCREATE=$(printf "%X" $((0x$BASE + 0x11d070)))
VDESTRUCT=$(printf "%X" $((0x$BASE + 0x11d120)))
V=$($KV call $VCREATE 0 4 10)
echo "vector=$V"
echo "before destruct:"; $KV kread $V 32
$KV call $VDESTRUCT $V >/dev/null; echo "destruct#1 rc=$? (chunk freed)"
echo "after destruct#1 (container still dangling in unfixed code):"
$KV kread $V 32
echo ">>> emulating the fix: kwrite NULL over vector->container:"
$KV write $V 0000000000000000
$KV kread $V 32
$KV call $VDESTRUCT $V >/dev/null; echo "destruct#2 rc=$? (kfree(NULL) no-op: NO PANIC)"
A=$($KV call $KMALLOC 40 $MTEMP 2)
B2=$($KMALLOC 2>/dev/null); B2=$($KV call $KMALLOC 40 $MTEMP 2)
echo "realloc A=$A B=$B2"
[ "$A" = "$B2" ] && echo "ALIASED (bad)" || echo "DISTINCT (no double-free aliasing: fix semantics hold)"
echo "### uptime: $(uptime)"
echo "### DONE"