# DF-2616 variant A: mount-time panic (stock X86_64_GENERIC, INVARIANTS ON)
# Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
# trigger: vnconfig -c vn0 /tmp/h2_A_sroot_cross.img && mount -t hammer2 /dev/vn0@testvol /mnt/h2
# crafted bref: volhdr.sroot_blockset[0].data_off = 0x180fd0a
#   (radix 10 = PERFECTLY VALID, lbase 0x180fd00: 0xfd00 % 0x400 != 0 misaligned
#    AND 0xfd00 + 0x400 = 0x10100 crosses the 64KB DIO window boundary)
# Distinct from DF-0763/DF-2605 (radix magnitude 17+): here the radix is valid.

vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
hammer2_mount: devstr="/dev/vn0@testvol"
hammer2_mount: device="/dev/vn0" label="testvol" rd_only=0
hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000004000000
Illegal: 0000000001800000 000000000180fd00+00000400 / ffffffffffff0000
panic: assertion "pbase != 0 && ((lbase + lsize - 1) & pmask) == pbase" failed in hammer2_io_alloc at /usr/src/sys/vfs/hammer2/hammer2_io.c:126
cpuid = 2
Trace beginning at frame 0xfffff80119186aa8
_hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46
_hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46
_hammer2_io_bread() at _hammer2_io_bread+0x17 0xffffffff80965397
hammer2_chain_load_data() at hammer2_chain_load_data+0x2a5 0xffffffff8096f4a5
hammer2_chain_lock() at hammer2_chain_lock+0xde 0xffffffff8096fa4e
hammer2_chain_get() at hammer2_chain_get+0x45 0xffffffff80970685
Debugger("panic")

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Analysis: hammer2_chain_alloc (hammer2_chain.c:189-192) accepted the valid
# radix-10/1024-byte size but never validated the offset geometry.  The only
# geometry guard is the KKASSERT at hammer2_io.c:126 (INVARIANTS-only); the
# unconditional kprintf "Illegal:" line above it fired, proving the illegal
# geometry reached the DIO layer.  On non-INVARIANTS kernels execution
# continues and chain->data = bp->b_data + 0xfd00 with chain->bytes = 1024
# -> 0x300 bytes of every access land past the end of the 64KB DIO buffer.