# DF-4135 — `config_volume()` `readpol` case falls through into
# `setupstate`, silently setting VF_CONFIG_SETUPSTATE

## Root cause
`sys/dev/raid/vinum/vinumconfig.c:1527-1557` — the inner
`switch (get_keyword(...))` for `kw_readpol` is **not followed by a
`break`** before `case kw_setupstate:`:

```c
	case kw_readpol:
	    switch (get_keyword(token[++parameter], &keyword_set)) {
	    case kw_round: ... break;
	    case kw_prefer: { ... } break;
	    default:
		throw_rude_remark(EINVAL, "Invalid read policy");
	    }                                    /* <-- no break */
	case kw_setupstate:                      /* <-- fallthrough */
	    vol->flags |= VF_CONFIG_SETUPSTATE;
	    break;
```

Every volume configured with a `readpol` keyword (a normal, documented
option) silently gains `VF_CONFIG_SETUPSTATE` — a flag that is meant to
be set **only** while restoring a configuration from disk, when all plexes
are known-empty.

## Consequence
`give_plex_to_volume()` (vinumconfig.c:202-204) skips
`invalidate_subdisks()` for any plex added to a volume that already has
plexes:

```c
    else if ((vol->plexes > 0)
    &&((vol->flags & VF_CONFIG_SETUPSTATE) == 0))	/* skipped! */
	invalidate_subdisks(&PLEX[plexno], sd_stale);
```

so the newly added mirror plex's subdisks keep the `sd_empty` state
instead of being invalidated to `sd_stale`.  Combined with the plex state
machine (vinumstate.c:515-541, where an all-empty plex with
VF_CONFIG_SETUPSTATE forceups **every** plex of the volume via
`forceup()`, which blindly marks all subdisks `sd_up`), a down/stale plex
holding outdated data can be resurrected as `sd_up` when a freshly added
empty plex is processed first — the volume then serves reads from
unrevived, stale data on a mirror whose admin expects resync semantics.

## Threat
Silent data-integrity break (stale-data resurrection / skipped mirror
invalidation) on any volume configured with `readpol` — a completely
ordinary configuration keyword.  Trigger is a plain config line:
`volume mv readpol round ...`.

## Fix
```diff
--- a/sys/dev/raid/vinum/vinumconfig.c
+++ b/sys/dev/raid/vinum/vinumconfig.c
@@ -1551,6 +1551,7 @@ config_volume(int update)
 		}
 		break;
 
+	    default:
 		throw_rude_remark(EINVAL, "Invalid read policy");
 	    }
+	    break;					/* terminate readpol */
 
	case kw_setupstate:
```
(the missing break after the inner switch is the actual defect).

## Verification
Analysis-only (skipped live): Low-severity logic defect; the control-flow
fallthrough is certain from source (confidence certain), the data-integrity
impact requires the plex processing order described above.  Live data
corruption testing on the guest would require a populated mirror and is
out of proportion to the severity.