#!/bin/sh
# DF-5643 RUN B (baseline, stock kernel): detach under owner -> softc
# freed -> owner's release path (smb.c:356 smbioctl exit) NULL-derefs.
#
# EXPECTED (buggy): VETO prints device_detach=0 (bus detached under its
# verifiable owner) + softc=NULL; RELFREE then takes Fatal trap 12
# (read of sc->owner at NULL+8) exactly as a mid-ioctl kldunload would.
set -e
cd /root/df5642

kldload /root/df5642/df5642_rig.ko 2>/dev/null || true
sleep 0.3
sleep 1

echo "=== GRAB: a client verifiably owns the bus ==="
./df5642ctl grab
echo "=== VETO: device_detach(smbus0) while owned ==="
./df5642ctl veto
echo "=== RELFREE: the owner's release path (smb.c:356) ==="
./df5642ctl relfree
echo "RUN-B-DONE (no trap?)"