==> [0/6] precondition: guest up + INVARIANTS kernel
up
INVARIANTS: KASSERT live in kernel
==> [1/6] enable vfs.quota_enabled (loader tunable) + reboot (non-reverting)
booting guest headless (daemonized)...
waiting for ssh (dfbsd-maxx)...
up (pid 121857)
==> [2/6] build trigger + stand up loopback NFS server + soft mount
-rw-r--r--  1 maxx  maxx  4096 Jul  2 17:10 /mnt/estale_target
==> [3/6] launch estale_trig as maxx (opens fd, holds fixed filehandle)
pid 867
READY fd=3 path=/mnt/estale_target -- invalidate server-side handle now
==> [4/6] invalidate the fd filehandle SERVER-SIDE (delete + recreate -> stale FH)
handle_invalidated
==> [5/6] wait for the panic (ftruncate -> GETATTR on stale FH -> KASSERT)
    [t+16s] status=up
    [t+20s] status=down
==> [6/6] result
PANIC reproduced. Signature from /home/maxx/scripts/dfbsd/dfbsd-qemu/boot.log:
login: panic: kern_ftruncate(): VOP_GETATTR didn't return 0
cpuid = 1
Trace beginning at frame 0xfffff801185a3798
kern_ftruncate() at kern_ftruncate+0x152 0xffffffff80705e22 
kern_ftruncate() at kern_ftruncate+0x152 0xffffffff80705e22 
sys_xsyscall() at sys_xsyscall+0x89 0xffffffff80bd7039 
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

>>> REPRODUCED: kern_ftruncate KASSERT panic (CWE-617). <<<
>>> Guest is now in DDB. Recover with: /home/maxx/scripts/dfbsd/dfbsd-qemu/vm.sh reset