# DF-2657 — panic serials on the fix kernel (reconstructed verbatim from
# session `tail` captures of dfbsd-qemu/boot.log; the file itself is
# truncated/overwritten on each boot, so each excerpt below was captured
# immediately after the guest froze, before any reset).
#
# All four traps are the SAME site and instruction:
#   Fatal trap N ... Stopped at hammer2_primary_xops_thread+0x2d9:
#       lock xaddl %edx,0x81558(%rsi)
# an XOP worker spin-locking state inside a freed xop_groups/thread array —
# the pre-existing DF-2620-family teardown UAF (identical site/instruction
# to the delayed panics DF-2631's independent fix builds produced).
#
# Occurrences (fix kernel #1, participant-quorum):
#  #1 trap 12 — after Phase A cluster churn + Phase B prep/remount/merge:
#-----------------------------------------------------------------------------
hammer2_mount: devstr="/dev/vn0@testvol"
hammer2_mount: device="/dev/vn0" label="testvol" rdonly=0
hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x00000000010000000
hammer2_mount: "/dev/vn0": no recovery needed
hammer2_mount: hmp=0xfffff80119440000 pmp=0xfffff80118740000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED
hammer2_ondisk: "/dev/vn1" zone=0 id=0 offset=0x0000000000000000 size=0x00000000010000000
hammer2_mount: hmp=0xfffff8011b140000 pmp=0xfffff80118740000
hammer2_mount: PFS already mounted!

Fatal trapStopped at      hammer2_primary_xops_thread+0x2d9:      lock xaddl      %edx,0x81558(%rsi)
db>
#-----------------------------------------------------------------------------
#  #2 trap 1 — after Phase A churn, during the Phase B prep SOLO mount:
#-----------------------------------------------------------------------------
vn3: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
hammer2_mount: devstr="/dev/vn3@testvol"
hammer2_mount: device="/dev/vn3" label="testvol" rdonly=1
hammer2_ondisk: "/dev/vn3" zone=0 id=0 offset=0x0000000000000000 size=0x0000000010000000
hammer2_mount: hmp=0xfffff801191e0000 pmp=0xfffff801184c0000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED

Fatal trap 1Stopped at      hammer2_primary_xops_thread+0x2d9:      lock xaddl      %edx,0x81558(%rsi)
db>
#-----------------------------------------------------------------------------
#  #3 trap 12 — after the rw diverged-cluster session + 2 verification
#      solo mounts (dmesg fetch call froze):
#-----------------------------------------------------------------------------
hammer2_mount: hmp=0xfffff80119274000 pmp=0xfffff80118800000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED

Fatal trap 12: pStopped at      hammer2_primary_xops_thread+0x2d9:      lock xaddl      %edx,0x81558(%rsi)
db>
#-----------------------------------------------------------------------------
#  #4 trap 12 — second cluster session on one boot (diagnostic merge):
#-----------------------------------------------------------------------------
v-chain 0xfffff801192004c0 volume.0   0000000000000010 0000000000000000/0  mir=0000000000000011
      [00002000] (?) refs=1
f-chain 0xfffff80119200640 freemap.0   0000000000000010 0000000000000000/0  mir=0000000000000011
      [00000000] (?) refs=1

Fatal trap 12: page fault while Stopped at      hammer2_primary_xops_thread+0x2d9:      lock xaddl      %edx,0x81558(%rsi)
db>
#-----------------------------------------------------------------------------
# CONTROL (same fix kernel, NO cluster merge anywhere on the boot):
#   6x solo ro mount/ls/umount cycles of base@testvol + 20 s settle:
#   all RC=0, guest up, zero panics.  The UAF requires the multi-element
#   cluster teardown path (DF-2620 family), NOT the participant-quorum
#   change: single-device pmp lifecycle is untouched by the fix.