# DF-4895 baseline run (unpatched guest) — 2026-09-24, DragonFly 6.5-DEVELOPMENT x86_64
# Guest: dfbsd-qemu (QEMU/KVM), kernel built Jul  2 2026 (X86_64_GENERIC)
# Session transcript (decisive parts; full console trail in this file)

[setup]
root# sh /tmp/setup_vinum.sh
  == initial state ==
  D d1   State: up   Device /dev/md0s0  Avail: 5/8 MB (74%)
  D d2   State: up   Device /dev/md1s0  Avail: 3/8 MB (49%)
  V rv   State: up   Plexes: 1  Size: 4096 kB
  P rv.p0  R5 State: up  Subdisks: 3  Size: 4096 kB
  S rv.p0.s0  State: up  PO: 0 B   Size: 2048 kB
  S rv.p0.s1  State: up  PO: 16 kB Size: 2048 kB
  S rv.p0.s2  State: up  PO: 32 kB Size: 2048 kB
  SANITY: 32KB roundtrip OK

[mapping check: with everything up, a 0xAA write at volume seek=5
 (sectors 320-384, group i=5: parity ordinal 0 -> s0 on d1; data blocks
 s1 on md1s0 sector 425 and s2 on md1s0 sector 4521) lands on the raw
 devices exactly at the computed offsets]
  baseline (all up, 0xAA): s1(425) md1s0:  aa aa aa aa ...
  baseline s2(4521) md1s0:                aa aa aa aa ...

[trigger - proper force stop of d2: real set_drive_state() path]
root# vinum stop -f d2
  (dmesg: vinum: drive d2 is down
          vinum: rv.p0.s1 is crashed
          vinum: rv.p0 is degraded
          vinum: rv.p0.s2 is crashed
          vinum: rv.p0 is corrupt)
  D d2   State: down ...
  S rv.p0.s1 State: crashed ...
  S rv.p0.s2 State: crashed ...
  -> daemon processed daemonrq_closedrive: vn_close(drive->vp),
     drive->vp = NULL, VF_OPEN cleared (vinumio.c close_locked_drive)

[state pokes - vp stays NULL]
root# vinum setstate -f up d2
root# vinum setstate -f up rv.p0.s0 rv.p0.s1 rv.p0.s2 rv.p0 rv
  D d2   State: up ...   (vp still NULL - setstate_by_force only pokes state)
  V rv / P rv.p0 / S s0 s1 s2 all State: up

[THE WRITE]
root# dd of=/dev/vinum/vol/rv bs=32768 seek=5 count=1 if=/tmp/cc conv=notrunc
  <no output — guest died mid-syscall>

[serial console — see panic.txt]
  Fatal user address access from kernel mode from dd at ffffffff806d6aa8
  Fatal trap 12: page fault while in kernel mode
  cpuid = 1; lapic id = 1
  fault virtual address = 0x5c
  fault code = supervisor read data, page not present
  instruction pointer = 0x8:0xffffffff806d6aa8
  current process = 309906 (dd)
  kernel: type 12 trap, code=0
  Stopped at vn_strategy+0x38: testb $0x40,0x5c(%r13)
  db>

Analysis: vn_strategy+0x38 is vfs_bio.c:3375 ((vp->v_flag & VKVABIO)==0)
with vp==NULL (fault address 0x5c = offsetof(struct vnode, v_flag)-area).
Call path: dd -> vinumstrategy/vinumstart -> launch_requests (first-phase
reads via dev_dstrategy(cdev): completed fine) -> complete_rqe ->
complete_raid5_write -> vn_strategy(drive->vp==NULL, parity/data write)
= vinuminterrupt.c:427/464.