{
  "finding_id": "DF-2644",
  "title": "hammer2_xop_inode_flush NULL-deref of error'd PFS-root chain during sync (kernel panics on media read failure instead of returning EIO)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "kernel A: cd /usr/src && patch -p1 < inject.diff && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC; kernel B: additionally patch -p1 < fix.diff and rebuild",
    "run": "sh run_df2644_inj.sh   (mount hammer2 on vn; mkdir+touch; sysctl vfs.hammer2.df2644_fail_inode_read=16; sync)",
    "expected": "kernel A: 'hammer2: chain error during flush' then Fatal trap 12, fault VA 0x200, Stopped at hammer2_xop_inode_flush+0x39c (repe movsq = the blockset copy at hammer2_flush.c:1336-1337). kernel B: same error messages, NO fault at the site (residual later panic is the unrelated pre-existing chain.c:3112 assert)."
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_flush.c:1334-1338",
    "sys/vfs/hammer2/hammer2_flush.c:1319-1331",
    "sys/vfs/hammer2/hammer2_flush.c:671-679",
    "sys/vfs/hammer2/hammer2_chain.c:998-1009"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "verdict.json", "manifest.json",
    "run_df2644_inj.sh", "validate_fix_df2644.sh",
    "inject.diff", "fix.diff",
    "build_kernelA.sh", "build_kernelA2.sh", "build_kernelB.sh",
    "panic.txt", "fix_run.log", "fix_run_partial_3112.txt",
    "code_hashes.txt"
  ]
}