DF-2731 panic proof (unprivileged pread at negative offset on ext2)
Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS)
Trigger: ./ext2trig /mnt/df2731/target.txt as uid 1001 (maxx)
Mon Aug 31 10:25:45 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: tmpfs_write uiomove error 14
vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
panic: ext2_read: uio->uio_offset < 0
cpuid = 0
Trace beginning at frame 0xfffff801166db6d8
ext2_read() at ext2_read+0x33e 0xffffffff8260f21e 
ext2_read() at ext2_read+0x33e 0xffffffff8260f21e 
vop_read() at vop_read+0x57 0xffffffff8070a487 
vn_read() at vn_read+0xd1 0xffffffff80708dc1 
kern_preadv() at kern_preadv+0x1e5 0xffffffff806a7395 
sys_extpread() at sys_extpread+0x7a 0xffffffff806a755a 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>