#!/bin/sh
# DF-5162 — root half of the trigger (run AFTER grow_stale succeeded).
#
# bktr detach never frees the DMA buffers (bktr_os.c:362-364) *because*
# bktr_mem is supposed to keep them valid across unload/reload.  But the
# METEORSETGEO grow path already kmem_free()d the original buffer without
# clearing/re-storing the registry entry.  On reload,
# common_bktr_attach() (bktr_core.c:382-390) sees addresses_stored==1,
# retrieves the stale KVA, and then (bktr_core.c:429-432):
#
#     bktr->bigbuf = buf;                      /* freed pointer */
#     bktr->alloc_pages = BROOKTREE_ALLOC_PAGES;
#     bzero((caddr_t)bktr->bigbuf, BROOKTREE_ALLOC);   /* 3.5 MB WAF */
#
# followed by RISC DMA program emission targeting the same freed range as
# soon as capture starts.
set -e
echo "=== before: registry-driven reload ==="
kldunload bktr
kldload bktr
echo "=== bktr re-attached; dmesg tail: ==="
dmesg | tail -5
echo "=== bigbuf reinstalled from stale registry; any capture now writes freed KVA ==="