#!/bin/sh

# panic: in_pcblookup_hash_locked: invalid local address
# cpuid = 11
# time = 1678303805
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0657e466d0
# vpanic() at vpanic+0x152/frame 0xfffffe0657e46720
# panic() at panic+0x43/frame 0xfffffe0657e46780
# in_pcblookup_hash_locked() at in_pcblookup_hash_locked+0x4e2/frame 0xfffffe0657e467f0
# in_pcb_lport_dest() at in_pcb_lport_dest+0x28a/frame 0xfffffe0657e468a0
# in_pcbconnect_setup() at in_pcbconnect_setup+0x31b/frame 0xfffffe0657e46940
# udp_send() at udp_send+0x68b/frame 0xfffffe0657e46a50
# udp6_send() at udp6_send+0x287/frame 0xfffffe0657e46c10
# sosend_dgram() at sosend_dgram+0x327/frame 0xfffffe0657e46c70
# sousrsend() at sousrsend+0x7e/frame 0xfffffe0657e46cd0
# kern_sendit() at kern_sendit+0x1bc/frame 0xfffffe0657e46d60
# sendit() at sendit+0xba/frame 0xfffffe0657e46db0
# sys_sendto() at sys_sendto+0x4d/frame 0xfffffe0657e46e00
# amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe0657e46f30
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0657e46f30 
# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x822a3a31a, rsp = 0x8208224d8, rbp = 0x820822500 ---
# KDB: enter: panic
# [ thread pid 47141 tid 357973 ]
# Stopped at      kdb_enter+0x32: movq    $0,0x12906d3(%rip)
# db> x/s version
# FreeBSD 14.0-CURRENT #0 main-n261389-109abf744bf76: Wed Mar  8 06:10:24 CET 2023
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/a
# db>

[ `uname -p` != "amd64" ] && exit 0
[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1

. ../default.cfg
prog=$(basename "$0" .sh)
cat > /tmp/$prog.c <<EOF
// https://syzkaller.appspot.com/bug?id=7cae38958ddfe2c338548b4217587bd6d89b43e2
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// Reported-by: syzbot+c8e3dac881bba85bc029@syzkaller.appspotmail.com

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
  intptr_t res = 0;
  res = syscall(SYS_socket, 0x1cul, 2ul, 0);
  if (res != -1)
    r[0] = res;
  *(uint32_t*)0x200001c0 = 0;
  syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul);
  *(uint8_t*)0x20000000 = 0x1c;
  *(uint8_t*)0x20000001 = 0x1c;
  *(uint16_t*)0x20000002 = htobe16(0x4e22);
  *(uint32_t*)0x20000004 = 0;
  memset((void*)0x20000008, 0, 10);
  memset((void*)0x20000012, 255, 2);
  *(uint32_t*)0x20000014 = htobe32(0);
  *(uint32_t*)0x20000018 = 0;
  syscall(SYS_sendto, r[0], 0ul, 0ul, 0ul, 0x20000000ul, 0x1cul);
  return 0;
}
EOF
mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1

(cd /tmp; timeout 2m ./$prog)

rm -rf /tmp/$prog /tmp/$prog.c /tmp/syzkaller.*
exit 0