# DF-4136 — ioctls that can reach `throw_rude_remark()` without holding
# the config lock panic the kernel (`VINUM_MOVE` demonstrated)

## Root cause
`throw_rude_remark()` (vinumconfig.c:105-106) starts with a bug-catcher:

```c
    if ((vinum_conf.flags & VF_LOCKED) == 0)		/* bug catcher */
	panic ("throw_rude_remark: called without config lock");
```

`VF_LOCKED` is set only by `lock_config()` (vinumlock.c:227-238), which is
called by `VINUM_CREATE` (vinumioctl.c:103) — **but not** by
`VINUM_SETSTATE`/`VINUM_SETSTATE_FORCE`, `VINUM_ATTACH`, `VINUM_DETACH`,
`VINUM_MOVE`, or `VINUM_PARITYOP`, even though those code paths reach
functions that throw:

* `attachobject()` (sd→plex) → `give_sd_to_plex()` →
  "Can't add %s to %s: plex full" (vinumconfig.c:250-254);
* `moveobject()` → `give_sd_to_drive()` → "Can't place %s on hot spare
  drive %s" (vinumconfig.c:318-322) or "No space for %s on %s"
  (vinumconfig.c:324-328, 373-381).

Any of those turns a routine, recoverable configuration error into
`panic()`.

## Reproduced trigger (VINUM_MOVE)
1. two crafted vinum drives on vn devices:
   * `x0` — normal drive with subdisk `s0`
   * `x1` — up drive with the `hotspare` flag
2. `VINUM_MOVE` (`_IOWR('F', 98, struct _ioctl_reply)`) with
   `{type = sd_object, index = driveno(x1), otherobject = sdno(s0)}`.
3. `moveobject()` → `give_sd_to_drive()` → hotspare rejection →
   `throw_rude_remark()` → **panic** "throw_rude_remark: called without
   config lock".

Expected panic text captured in panic.txt / serial log.

## Impact
Immediate kernel panic (local DoS) by anyone with /dev/vinum/control
access (root:wheel 0600) — a mis-typed `vinum move`/`vinum attach` on a
full or hotspare drive takes the whole machine down instead of returning
an error.

## Fix
Either wrap the affected ioctls with `lock_config()`/`unlock_config()`
(best: `VINUM_MOVE`, `VINUM_ATTACH`, `VINUM_DETACH`,
`VINUM_SETSTATE(_FORCE)`), or downgrade the bug-catcher panic to a
`log(LOG_ERR,...)` + error return.  The lock wrapper matches the
VINUM_CREATE pattern:

```diff
--- a/sys/dev/raid/vinum/vinumioctl.c
+++ b/sys/dev/raid/vinum/vinumioctl.c
@@ -316,7 +316,11 @@
 	case VINUM_MOVE:
+	    error = lock_config();
+	    if (error)
+		break;
 	    moveobject((struct vinum_ioctl_msg *) data);	/* move an object */
+	    unlock_config();
 	    break;
```