DF-0910 / panic.txt
DF-0910 PANIC SIGNATURE (from dfbsd-qemu/boot.log, unpatched #0 kernel)
======================================================================
Trigger: HAMMER_IOC_PRUNE ioctl with elms[0].mod_tid=0 on a HAMMER v1 mount
(/df910, vn0-backed 12GB sparse image) after seeding a deleted
record (creat+write+unlink+sync).
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer = 0x8:0xffffffff8094bcfb
stack pointer = 0x10:0xfffff80117f97318
frame pointer = 0x10:0xfffff80117f97478
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 1071
current thread = pri 6
kernel: type 18 trap, code=0
CPU0 stopping CPUs: 0x0000003e
stopped
Stopped at hammer_ioc_prune+0x31b: divq %r9,%eax
db>
----------------------------------------------------------------------
Trap 18 = x86 #DE (Divide Error). The faulting instruction is `divq`
(unsigned 64-bit divide) inside hammer_ioc_prune at offset +0x31b — this is
the inlined body of the static helper prune_should_delete() at
sys/vfs/hammer/hammer_prune.c:305-306:
(elm->base.create_tid - scan->beg_tid) / scan->mod_tid
==
(elm->base.delete_tid - scan->beg_tid) / scan->mod_tid
with scan->mod_tid == 0 (user-supplied via copyin at hammer_prune.c:104,
no zero-check in the validation block at hammer_prune.c:67-81).