cluster_callback() panics on residual/short cluster I/O instead of propagating an error to components

Summary

cluster_callback() treats any completion with b_bcount != b_bufsize (and no B_ERROR) as panic("cluster_callback: unexpected EOF on cluster"), taking down the system instead of propagating an error to the component buffers. Today dead code in-tree (nothing decrements a master cluster bp's b_bcount on completion; device EOF errors out with B_ERROR; nestiobuf_iodone maps sub-buffer shortfalls to EIO), but a trap: any current or future driver doing partial completion via b_resid without B_ERROR (the exact lost-error class the vfs_bio audit flagged) converts a recoverable short read into an immediate kernel panic. Reachable solely via a misbehaving storage driver or root-mounted corrupt metadata; not reachable unprivileged on stock.

Recommended fix

--- a/sys/kern/vfs_cluster.c
+++ b/sys/kern/vfs_cluster.c
@@ -1126,8 +1126,9 @@
    if (bp->b_flags & B_ERROR) {
        error = bp->b_error;
    } else if (bp->b_bcount != bp->b_bufsize) {
-       panic("cluster_callback: unexpected EOF on cluster %p!", bio);
+       kprintf("cluster_callback: short transfer on cluster %p\n",
+           bio);
+       error = EIO;
    }

Timeline

• 2026-08-30 Discovered during pass-2 audit of vfs_cluster.c (GLM 5.3).