# DF-2653 run.log — decisive runs
# guest: DragonFly 6.5-DEVELOPMENT #0 (stock, INVARIANTS ON)

==================== iteration 1: poison methods=0x00 (NO panic — honest miss) ===
$ vm.sh run_root '... dd if=w64k.bin of=/mnt/h2t/f2653 bs=64k seek=8 ...'
MOUNT_OK
WRITE_DONE
readback f2653@0x80000 == w64k.bin (served via poison chain data_off 0x1d80010)
=> analysis: CHECK_NONE + modify_tid > pfs_lsnap_tid took the overwrite-in-place
   path (chain.c:1495-1521, newmod=0): no freemap_alloc, no panic; the write
   silently landed in the poison's aliased block.

==================== iteration 2: poison methods=0x30 (DECISIVE) =================
$ vm.sh run_root '
vnconfig -c vn0 /tmp/forge2653b.img
mount -t hammer2 /dev/vn0@testvol /mnt/h2t
echo MOUNT_OK
head -c 65536 /dev/urandom > /tmp/w64k2.bin
dd if=/tmp/w64k2.bin of=/mnt/h2t/f2653 bs=64k seek=8 conv=notrunc 2>/dev/null
echo WRITE_DONE'
MOUNT_OK
WRITE_DONE
(the panic fires in the async strategy xop after dd returns; the next ssh
 command times out; vm.sh status => down)

--- vm.sh log 120 (serial console) ---
panic: assertion "j + bmradix <= HAMMER2_BMAP_BITS_PER_ELEMENT" failed in hammer2_bmap_alloc at /usr/src/sys/vfs/hammer2/hammer2_freemap.c:679
cpuid = 1
Trace beginning at frame 0xfffff801190ff6d0
hammer2_bmap_alloc.constprop.2() at hammer2_bmap_alloc.constprop.2+0x3ce 0xffffffff809825de
hammer2_bmap_alloc.constprop.2() at hammer2_bmap_alloc.constprop.2+0x3ce 0xffffffff809825de
hammer2_freemap_alloc() at hammer2_freemap_alloc+0x45c 0xffffffff80982a3c
hammer2_chain_modify() at hammer2_chain_modify+0x60c 0xffffffff809702ec
hammer2_assign_physical() at hammer2_assign_physical+0x101 0xffffffff80983851
hammer2_xop_strategy_write() at hammer2_xop_strategy_write+0x681 0xffffffff80985331
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

==================== FIX VALIDATION (kernel #1, guarded fast path) =============
$ vm.sh run_root '
echo "===== DF-2653 on FIXED kernel:"
vnconfig -c vn0 /tmp/forge2653b.img
mount -t hammer2 /dev/vn0@testvol /mnt/h2t && echo MOUNT_OK
head -c 65536 /dev/urandom > /tmp/w64k3.bin
dd if=/tmp/w64k3.bin of=/mnt/h2t/f2653 bs=64k seek=8 conv=notrunc 2>/dev/null
sync; sleep 3
dd if=/mnt/h2t/f2653 bs=64k skip=8 count=1 2>/dev/null | md5
md5 /tmp/w64k3.bin
umount /mnt/h2t
uname -n'
===== DF-2653 on FIXED kernel:
MOUNT_OK
f1fdf21f00ddb16c35b1e77fac5eaeac      <- readback
MD5 (/tmp/w64k3.bin) = f1fdf21f00ddb16c35b1e77fac5eaeac   <- match
dfbsd                                 <- guest alive