DragonFlyBSD Kernel Audit
DF-0858 / run.log
← back to finding ↓ download raw
=== DF-0858 deterministic dive-loop proof ===
struct sizes: alblk=8 alnode=8 alleaf=12
HPFS_DIVE_MAX (proposed fix cap) = 20

--- Case 1: cyclic image (A->B->A), UNPATCHED (no depth cap) ---
  [hpbmap] dive depth=0  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap] dive depth=1  node[0]: an_nextoff=0xffffffff an_lsn=0x80  (bn=0x0)
  [hpbmap] dive depth=2  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap] dive depth=3  node[0]: an_nextoff=0xffffffff an_lsn=0x80  (bn=0x0)
  [hpbmap] dive depth=4  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap]   ... (condensed: depths 5..995 omitted; each is identical A<->B bounce) ...
  [hpbmap] dive depth=996  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap] dive depth=997  node[0]: an_nextoff=0xffffffff an_lsn=0x80  (bn=0x0)
  [hpbmap] dive depth=998  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap] dive depth=999  node[0]: an_nextoff=0xffffffff an_lsn=0x80  (bn=0x0)
  [hpbmap] dive depth=1000  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap] WOULD LOOP FOREVER: hit depth cap 1000 at bn=0x0 (this is the bug — kernel has NO cap)
  result: DEPTH-CAP TRIPPED (kernel: would loop forever)

--- Case 2: cyclic image (A->B->A), FIXED (cap = HPFS_DIVE_MAX) ---
  result: EINVAL — dive cap tripped, loop broken (FIX WORKS)

--- Case 3: control image (A->leaf), UNPATCHED (proves cycle is cause) ---
  [hpbmap] dive depth=0  node[0]: an_nextoff=0xffffffff an_lsn=0x60  (bn=0x0)
  [hpbmap] dive depth=1  node[0]: an_nextoff=0xffffffff an_lsn=0x90  (bn=0x0)
  [hpbmap] dive depth=2  leaf[0]: al_off=0x0 al_len=0x80 al_lsn=0x91  (bn=0x0)
  [hpbmap] FOUND: bn=0x0 -> disk lsn 0x91 (depth=2)
  result: FOUND normally (loop terminated at leaf)

=== SUMMARY ===
DF_0858_BUG_CYCLIC_DIVE_LOOPS_FOREVER=1
DF_0858_FIX_DEPTH_CAP_BREAKS_LOOP=1
DF_0858_CONTROL_TERMINATES_NORMALLY=1
DF_0858_BUG_CONFIRMED=1
RUN_EXIT=0