# DF-2616 variant B: panic loading crafted FILE DATA chain (stock INVARIANTS kernel) # trigger: mount -t hammer2 /dev/vn0@testvol /mnt/h2 (OK); ls/cat /mnt/h2/f1 # crafted bref: f1 DATA data_off = 0x1c0ff0a (radix 10 VALID, lbase 0x1c0ff00, misaligned + crossing; methods=0x00 CHECK_NONE) hammer2_mount: "/dev/vn0": no recovery needed hammer2_mount: hmp=0xfffff80118580000 pmp=0xfffff80118d60000 HAMMER2: VOLDATA DUMP HAMMER2: INITIATE SPANs HAMMER2: CONN WAS TERMpaniIc: asNsertioAn "pbase != 0 && ((lbase + lsize - 1)T & pEmask) == pDbase" f ailed in hammer2_io_alloc at /usr/src/sys/vfs/hammer2/hammer2_io.c:126 cpuid = 3 Trace beginning at frame 0xfffff80118de5710 _hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46 _hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46 _hammer2_io_bread() at _hammer2_io_bread+0x17 0xffffffff80965397 hammer2_chain_load_data() at hammer2_chain_load_data+0x2a5 0xffffffff8096f4a5 hammer2_chain_lock() at hammer2_chain_lock+0xde 0xffffffff8096fa4e hammer2_chain_get() at hammer2_chain_get+0x45 0xffffffff80970685 Debugger("panic") CPU3 stopping CPUs: 0x00000037 stopped Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip) db>