{
  "finding_id": "DF-2662",
  "title": "hammer2_update_spans() dereferences chain->data of an EIO-failed inode chain (NULL deref panic)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "kernel B: stock + DF-2661 inject.diff + DF-2661 fix_b.diff (see /root/df2661/build_fix.sh); kernel C adds this pack's fix.diff (see build_fix.sh)",
    "run": "sh /root/df2661/trigger_df2661.sh golden; sh /root/df2661/trigger_df2661.sh 5",
    "expected": "kernel B: Fatal trap 12 page fault at hammer2_autodmsg+0x273 (movq 0x90(%r15),%rax, r15=chain->data=NULL); kernel C: ROUND_SURVIVED x5"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_iocom.c:285-325",
    "sys/vfs/hammer2/hammer2_iocom.c:237",
    "sys/vfs/hammer2/hammer2_chain.c:985-1006"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "panic.txt", "disasm_autodmsg.txt",
    "fix.diff", "build_fix.sh", "buildC.log", "fix_run.log",
    "manifest.json", "verdict.json"
  ]
}