#!/bin/sh
# DF-5116 trigger — dcons_crom_detach vs fw_busreset post_busreset race
#
# REQUIRES: an OHCI FireWire controller with an attached bus (and ideally a
# second node so bus resets actually happen).  Without FireWire hardware the
# dcons_crom device never instantiates and this exits 42 (untestable).
#
# Success criterion (on real hardware): within minutes-to-hours of the
# unload/reload loop racing physical bus resets, the kernel panics inside
# dcons_crom_post_busreset / crom_add_* operating on freed dcons_crom softc
# memory (UAF write from interrupt context).

set -u

if ! pciconf -l 2>/dev/null | grep -q 'class=0x0c0010'; then
	echo "DF-5116: no FireWire OHCI controller present - untestable here"
	exit 42
fi
[ -e /dev/fw0.0 ] || { echo "DF-5116: no firewire bus device - untestable"; exit 42; }

# hammer attach/detach while a peer resets the bus (unplug/replug cable or
# power-cycle the peer node during this loop)
(
	while true; do
		kldload dcons_crom 2>/dev/null
		kldunload dcons_crom 2>/dev/null
	done
) &
LOOP=$!
echo "loop running (pid $LOOP); generate bus resets now (cable events)."
echo "watch for panic in dcons_crom_post_busreset / crom_add_*"
sleep 3600
kill $LOOP 2>/dev/null