#!/bin/sh
# DF-5563 baseline reproduction, variant A (the REAL in-tree entry):
# park via /dev/iic0 I2CSTART (iicioctl -> iicbus_request_bus(IIC_WAIT|IIC_INTR),
# iic.c:297-300), unload the stack, SIGKILL -> resume into freed text.
# EXPECTS the same Fatal trap 12 as variant B (run_f1.sh).
set -e
cd /root/df5563

echo "=== load chain ==="
kldload /usr/src/sys/bus/iicbus/iicbus/iicbus.ko
kldload /boot/kernel/iicbb.ko
kldload /usr/obj/root/df5563/build_reg/iicbb_reg.ko
kldload /usr/obj/root/df5563/build_rig/df5563_rig.ko
kldload /usr/src/sys/bus/iicbus/iic/iic.ko
sleep 1
ls -l /dev/iic0

echo "=== park via /dev/iic0 I2CSTART (blocking) ==="
sysctl hw.df5563.busy=1
./park iic &
PARK=$!
sleep 2
ps -o pid,stat,wchan,command -p $PARK || true

echo "=== text addresses BEFORE unload ==="
kldstat | grep -E 'iicbus|iicbb|df5563|iic\.ko' || true

echo "=== unload under the parked requester ==="
kldunload iic || true
kldunload df5563_rig || true
kldunload iicbb_reg || true
kldunload iicbb || true
kldunload iicbus || true
sleep 1

echo "=== SIGKILL: resume into FREED text ==="
sync
kill -9 $PARK || true
sleep 10
echo "=== still alive? ==="
ps -o pid,stat,command -p $PARK || echo "park process gone"