#!/bin/sh
# DF-5321 baseline, mode 1 (production /dev/fw FW_ASYREQ scenario):
# receiving context (production fw_rcv), watchdog context (production
# firewire_xfer_timeout), and the FW_ASYREQ waiter (tsleep -> wakeup ->
# fw_xfer_free_buf, exactly fwdev.c).
#
# Baseline expectation: kernel PANIC -- either the tlabel use-after-free
# inside firewire_xfer_timeout (freed by the waiter's fw_tl_free while the
# watchdog dereferences tl->xfer; observed: "Fatal trap 12 ... Stopped at
# firewire_xfer_timeout+0xbc: movq 0x8(%rax),%rax") or a double completion
# (counters printed if the race instead lands in the instrumented window).
# A fixed kernel completes with double-completions=0 and no panic.
kldload /root/df5321/df5321.ko
sysctl kern.df5321_mode=1
sysctl kern.df5321_iters=3000
sysctl kern.df5321_fire=1
echo "DF5321: mode1 returned unexpectedly without panic"
dmesg | tail -8