# DF-2623 — hammer2_fixup_pfses kprintf reads filename through pointer into the released (COW'd-away) buffer

* Cited: `sys/vfs/hammer2/hammer2_vfsops.c:2399-2406`

## What this pack contains

| file | what |
|---|---|
| `forge_2623.py` + `h2common.py` | image forger: clears `HAMMER2_BREF_FLAG_PFSROOT` on the testvol PFS inode bref |
| `run_2623.sh` | guest trigger (RW mount → hammer2_fixup_pfses) |
| `run_stock.log` | stock kernel #0 output (console message fires) |
| `run_instr.log` | instrumented kernel #1 output |
| `console_excerpts.txt` | stock + instrumented + fix-kernel console lines (pointer provenance proof) |
| `fix.diff` | print from `chain->data->ipdata.filename` post-modify |

## Build

1. Guest: `newfs_hammer2 -L testvol` 64M image + one small file (see
   `mkbases_dfv.sh` in the run's working dir), pull to host.
2. Host: `python3 forge_2623.py base2623.img craft2623.img`
   (clears the PFSROOT bit in the sroot-blockset bref; sroot bref →
   CHECK_NONE; volhdr CRCs recomputed).
3. Push `craft2623.img` to guest.

## Run (root, RW mount)

```sh
vnconfig -c vn0 craft2623.img
mount -t hammer2 /dev/vn0@testvol /mnt/h2x     # RW! fixup runs after recovery
```

## Expected

* Console: `hammer2: Correct mis-flagged PFS testvol` — printed from
  `ripdata->filename` where `ripdata` was captured **before**
  `hammer2_chain_modify()` COW'd the inode (the old dio reference is
  released inside modify at chain.c:1858 and `chain->data` redirected at
  :1859).
* Instrumented kernel proves the read is through the stale pointer:
  `ripdata=0xfffff80051cc6800 vs chain->data=0xfffff80051cc7000
  (same=0)` — while the *content* printed correctly on every attempt
  (the released buffer retains its bytes; no I/O lands in the window
  between the release and the kprintf).
* Fixed kernel: message unchanged, now sourced from the always-valid
  post-COW `chain->data`.

Honest classification: the use-after-**release** read is confirmed
(path, ordering, pointer provenance); observable **stale content** was
never produced on this guest (bqrelse retains cached contents and the
COW landed in the same 64KB window).  Low severity as filed — correct.