Crash-dump backtrace (kgdb /boot/kernel/kernel /var/crash/vmcore.0, captured live
while kernel #1 was running; trigger pid = trigger_scan, uid 1001):

#0  _get_mycpu () at ./machine/thread.h:69
#1  panic (fmt=0xffffffff80c3733e "%s") at kern/kern_shutdown.c:868
#2  trap_fatal (frame=0xfffff801167bc198, eva=<optimized out>) at platform/pc64/x86_64/trap.c:1101
#3  trap_pfault (frame=0xfffff801167bc198, usermode=0) at platform/pc64/x86_64/trap.c:996
#4  trap (frame=0xfffff801167bc198) at platform/pc64/x86_64/trap.c:630
#5  calltrap () at platform/pc64/x86_64/exception.S:319
#6  crc32c_sb8_64_bit (p_buf=0xfffff800523fa000, length=<optimized out>, ...) at libkern/icrc32.c:698
#7  multitable_crc32c (...) at libkern/icrc32.c:751
#8  calculate_crc32c (...) at libkern/icrc32.c:768
#9  calculate_crc32c (...) at libkern/icrc32.c:761
#10 iscsi_crc32 (buf=<optimized out>, size=<optimized out>) at libkern/icrc32.c:779
#11 hammer_crc_get_leaf (leaf=0xfffff80052216200, data=<optimized out>, vol_version=7) at vfs/hammer/hammer_crc.h:274
#12 hammer_crc_test_leaf (leaf=0xfffff80052216200, ...) at vfs/hammer/hammer_crc.h:295
#13 hammer_btree_extract (cursor=0xfffff801167bc358, flags=2) at vfs/hammer/hammer_btree.c:770
#14 hammer_btree_extract_data (cursor=0xfffff801167bc358) at vfs/hammer/hammer.h:1501
#15 hammer_ip_resolve_data (cursor=0xfffff801167bc358) at vfs/hammer/hammer_object.c:1890
#16 hammer_ioc_scan_pseudofs (trans=..., ip=..., pfs=...) at vfs/hammer/hammer_pfs.c:360
#17 hammer_ioctl (ip=..., com=3224397852, ...) at vfs/hammer/hammer_ioctl.c:264
#18 hammer_vop_ioctl (ap=...) at vfs/hammer/hammer_vnops.c:2524
#19 vop_ioctl (...) at kern/vfs_vopops.c:525
#20 vn_ioctl (...) at kern/vfs_vnops.c:1029
#22 mapped_ioctl (fd=..., com=..., ...) at kern/sys_generic.c:724
#23 syscall2 (frame=...) at platform/pc64/x86_64/trap.c:1285

Live element inspection (kgdb, same dump):

  (gdb) p elm->leaf
  $1 = {base = {obj_id = 1, key = 65536, create_tid = 4295000160, ...
  (gdb) p elm->leaf.data_len
  $2 = 292
  (gdb) p elm->leaf.data_offset
  $3 = 10376293545756590079          /* forged/garbage — non-data zone bits, unaligned */
  (gdb) p cursor->data
  $6 = (hammer_data_ondisk_t) 0xfffff800523f9fff   /* wild, unaligned kernel pointer */
  (gdb) p error
  $7 = 0                              /* bread "succeeded" */

=> hammer_btree_extract() took the forged on-disk data_offset/data_len with no
   validation (production KKASSERT compiled out), handed the wild pointer to
   hammer_crc_test_leaf(), whose crc32c walk faulted reading kernel memory.
   panic.txt holds the first (stock-kernel #0) instance of the same fault.