# DF-2657 — fix-kernel validation runs (kernel #1, participant-quorum)
# Reconstructed verbatim from the audit session (each phase ran as discrete
# ssh commands so all output below was captured live and survives the later
# panics; the in-guest fix_run.log froze at 23 lines on panic #1 — kept as
# fix_run.truncated.log).

Fix kernel: DragonFly dfbsd 6.5-DEVELOPMENT #1: Sun Aug 30 04:30:11 UTC 2026
            root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
Build:       cd /usr/src && make nativekernel && make installkernel
             -> BUILD_INSTALL_OK (full log: fix_build.log.tgz, 5.4 MB)
Patch:       fix.diff applied with `patch -p1` — all 10 hunks OK
Base image:  MD5 3027115ec4018fca962e27a0573cd28b (recreated after reset;
             layout: PFS "LOCAL" + PFS "testvol", MASTER, pfs_nmasters=1
             in the label — the clone merge raises the pmp to nmasters=2).

=======================================================================
PHASE A — identical clones (wedge regression)                [ALL CLEAN]
=======================================================================
A_MOUNT1_RC=0
A_MOUNT2_RC=1                         # EBUSY, chains merged (as designed)
sleep 12; h2nod census:
    0     -1      0   0 -12 -64      0      0 h2idle   B0     ??    0:00.00 (h2nod-LOCAL)
    0     -1      0   0 -12 -64      0      0 h2idle   B1     ??    0:00.00 (h2nod-LOCAL)
    0     -1      0   0 -12 -64      0      0 h2idle   B4     ??    0:00.00 (h2nod-testvol)
    0     -1      0   0 -12 -64      0      0 h2idle   B5     ??    0:00.00 (h2nod-testvol)
A_H2COLL_COUNT=0                      # STOCK: 4x h2coll, forever
A_LS_RC=0                             # VFS quorum path unchanged (2/2)

umount -f /mnt/h2:
A_UMOUNTF_RC=0  A_ELAPSED=0s          # STOCK: rc=1 after 65 s + stranded threads
# h2nod census after umount: EMPTY (sync threads stopped cleanly)
A_MOUNT3_RC=0                         # third same-clid mount: instant
A_M3_LS_RC=0
A_M3_UM_RC=0
A_SANITY_MOUNT_RC=0                   # single-device mount/umount unchanged
A_SANITY_UM_RC=0
PHASE_A_DONE

=======================================================================
CONTROL — 6x solo mount/ls/umount churn, NO cluster (attribution) [CLEAN]
=======================================================================
CYCLE_1_MOUNT=0 LS=0 UMOUNT=0
CYCLE_2_MOUNT=0 LS=0 UMOUNT=0
CYCLE_3_MOUNT=0 LS=0 UMOUNT=0
CYCLE_4_MOUNT=0 LS=0 UMOUNT=0
CYCLE_5_MOUNT=0 LS=0 UMOUNT=0
CYCLE_6_MOUNT=0 LS=0 UMOUNT=0
CHURN_DONE; +20 s settle: guest up, zero panics.
# -> the later UAF panics need the multi-element cluster teardown, not the fix.

=======================================================================
PHASE B — diverged cluster (m1 has X, m2 does not)          [PARTIAL]
=======================================================================
prep (solo rw mount of b1, echo converge-me-hammer2 > X, clean umount):
B_PREP_MOUNT_RC=0  B_PREP_UM_RC=0     # X persisted to b1 media (MD5s differ)

merge rw + rw-attach:
B_MOUNT1_RC=0 / M1=0
B_MOUNT2_RC=1 / M2=1                  # EBUSY merge
h2nod census (+5 s and +30 s): 4x h2idle, 0x h2coll
dmesg: NO "hammer2_sync_slaves: error" prints, NO "no quorum possible" spam

teardown:
B_UMOUNT_RC=0  ELAPSED=0s             # plain umount of the diverged rw cluster
UM_RC=0 ELAPSED=0s                    # (stock: impossible — wedge)

media verification (solo ro mounts):
b2 (stale clone):  M2CHK=0; ls: total 0; cat X -> No such file  (M2_X_RC=1)
b1 (fresh clone):  B_M1_MOUNT_RC=0; cat X -> converge-me-hammer2 (B_M1_X_RC=0)
# -> NO REGRESSION of the fresher master (forward-only gate holds);
#    pull-in of X into the stale clone was NOT observed (open item, see
#    VERDICT.md "Follow-ups").

=======================================================================
PHASE C — stability (pre-existing DF-2620-family UAF exposure)
=======================================================================
Every session that performed a cluster merge+teardown followed by 1-3 more
same-clid mount operations panicked at:
  Fatal trap 1/12: hammer2_primary_xops_thread+0x2d9: lock xaddl %edx,0x81558(%rsi)
4 occurrences captured (panic_serial.log).  Trap 12 = page not present,
trap 1 = protection fault — a surviving XOP worker dereferencing freed
xop_groups/thread state.  IDENTICAL site+instruction to the delayed panics
on DF-2631's independent (timeout-based) fix builds, and the no-cluster
control above is clean — i.e. the UAF is the pre-existing multi-chain
teardown defect (DF-2620 family) that stock never reaches because the
umount wedges first.  It is NOT introduced by this fix.