DF-4270 / run.kld_fixed.log
cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wold-style-definition -Wmissing-include-dirs -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I. -Idragonfly -I/root/dfwb3/forwarder_x86_64/include -Idragonfly/../include -I/usr/include -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline -c dfwb3_rig.c wb_rxeof=0xffffffff808daed0 wb_init=0xffffffff808da750 wb_stop=0xffffffff808d9850 wb_start=0xffffffff808d9e90 wb_txeof.part.4=0xffffffff808da510 wb_watchdog=0xffffffff808dae60 mbstat=0xffffffff8131dec0 mbtypes=0xffffffff81325ec0 kern.dfwb3.rxeof: 0x0000000000000000 -> 0xffffffff808daed0 kern.dfwb3.init: 0x0000000000000000 -> 0xffffffff808da750 kern.dfwb3.stop: 0x0000000000000000 -> 0xffffffff808d9850 kern.dfwb3.start: 0x0000000000000000 -> 0xffffffff808d9e90 kern.dfwb3.txeof: 0x0000000000000000 -> 0xffffffff808da510 kern.dfwb3.watchdog: 0x0000000000000000 -> 0xffffffff808dae60 kern.dfwb3.mbstat: 0x0000000000000000 -> 0xffffffff8131dec0 kern.dfwb3.mbtypes: 0x0000000000000000 -> 0xffffffff81325ec0 === go4270: REAL wb_start under cluster exhaustion (DF-4270) === kern.dfwb3.go4270: 0 -> 0 GO_RC=0 === marker summary === dfwb3: cluster pool exhausted after 34716 clusters dfwb3: saved-chain walk: 1 mbufs intact (m_len==128, marker ok: 1 damaged) dfwb3: go4270 SURVIVED M-bM^@M^T guest stays up ---DMESG--- dfwb3: === DF-4270: force the wb_encap MCLGET-failure path under the REAL wb_start === dfwb3: crafted 17-mbuf chain, pkthdr.len=2176 (>16 fragments -> wb_encap coalesce branch; len > MHLEN -> MCLGET required) dfwb3: baseline accounting: mbtypes[MT_DATA]=344 mbstat.m_drops=0 (chain included in baseline) dfwb3: accounting self-test: +1 alloc observed: 1, back to 344: 1 dfwb3: cluster pool exhausted after 34716 clusters dfwb3: post-drain mbstat.m_drops=1 (+1 M-bM^@M^T MCLGET failure signature, uipc_mbuf.c:1249) mbtypes=35060 (expect baseline+stash=35060) dfwb3: ifsq_classic_enqueue -> 0 (0 = ok); mbtypes now 35060 (enqueue must not change it) dfwb3: dispatching REAL wb_start (wb_encap is inlined into it; return value ignored at if_wb.c:1327)... dfwb3: wb_start mbuf delta: -17 (LEAK expects +17; 0 means the chain was freed INSIDE wb_start!) dfwb3: post-dispatch mbstat.m_drops=2 (+1 since pre-dispatch) dfwb3: post-dispatch probe: MGETHDR ok; MCLGET FAILS dfwb3: post-wb_start state: dfwb3: wb_tx_head=0 (== &chain[0]: 0) wb_tx_tail=0 wb_tx_free=0xffffffff82650348 dfwb3: chain[0].wb_mbuf=0 (NULL: 1 M-bM^@M^T wb_encap returned BEFORE :1283 set it) dfwb3: TX queue len=0 (packet dequeued and gone) dfwb3: frag[0]: status=0000000000 ctl=0x21000080 (FIRSTFRAG:1 TLINK:1 FINT:0 LASTFRAG:0) dfwb3: frags with OWN set: 0/16; frags with LASTFRAG set: 0/16 (unterminated chain: YES) dfwb3: frag[15].wb_next=0x26d62600 vs vtophys(&frag[16])=0x26d62600 (one-past-the-array walk) dfwb3: MMIO WB_TXSTART=0000000000 (0xFFFFFFFF: chip told to TRANSMIT the half-armed descriptor, if_wb.c:1355) dfwb3: if_timer=0 (5s watchdog armed) dfwb3: accounting after evidence: mbtypes[MT_DATA]=35043 (chain-inclusive baseline 344 - 17 chain + 34716 stash + LEAK 0) dfwb3: saved-chain walk: 1 mbufs intact (m_len==128, marker ok: 1 damaged) dfwb3: wb_tx_head == NULL (nothing armed M-bM^@M^T FIXED behaviour): wb_txeof not dispatched (wb_intr's caller-side NULL guard, if_wb.c:1055-1056, applies) dfwb3: dispatching REAL wb_watchdog (the 5s recovery path)... dfwb3: after watchdog: wb_tx_head=0 (recovered: 1) mbtypes[MT_DATA]=35043 M-bM^@M^T leaked mbufs STILL leaked: no dfwb3: cleanup: chain NOT freed by wb_start per accounting M-bM^@M^T NOT double-freeing; freeing stash only dfwb3: rig cleanup complete: mbtypes[MT_DATA]=263 (baseline 344, delta -81 M-bM^@M^T accounting restored) dfwb3: go4270 SURVIVED M-bM^@M^T guest stays up