# DF-2662 — hammer2_update_spans() dereferences `chain->data` of an EIO-failed inode chain (NULL deref panic)

* File: `sys/vfs/hammer2/hammer2_iocom.c` (found during the pass-2 audit of
  `sys/vfs/hammer2/hammer2_io.c` — unmasked while validating DF-2661's fix)
* Severity: Medium (kernel NULL-deref panic; triggered by device read errors)
* Bucket: hammer2

## Build

Kernel B (baseline for THIS bug) = stock + DF-2661 fix (`fix_b.diff`) +
`DF-2661/inject.diff`.  With the DF-2661 assert fixed, the same trigger
exposes this bug in isolation.

Kernel C (fix validation) = kernel B source + `fix.diff` (this pack).

    cd /usr/src
    patch -p1 < /root/df2661/inject.diff
    patch -p1 < /root/df2661/fix_b.diff
    patch -p1 < /root/df2662/fix.diff
    make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel ...

## Run

    sh /root/df2661/trigger_df2661.sh golden   # once
    sh /root/df2661/trigger_df2661.sh 5        # ARM=1 default

## Expected

Kernel B: `Fatal trap 12: page fault ... Stopped at
hammer2_autodmsg+0x273: movq 0x90(%r15),%rax` — r15 == 0 is
`chain->data == NULL` for a PFS inode whose read failed with EIO during the
post-mount async SPAN walk (`hammer2_update_spans`).

Kernel C: 5x `ROUND_SURVIVED` + `ALL_ROUNDS_SURVIVED`.