DF-2843 — vnode_pager_generic_putpages() marks short-written pages clean

Bug: sys/vm/vnode_pager.c:767-781 Class: data-integrity (silent substitution family — write-side variant) Severity: Low Confidence: likely Phase V: not run (Low, non-corruption bucket; no FS on the audit guest exhibits error==0 with uio_resid>0 on VOP_WRITE, so there is no honest trigger available — see below).

The defect

767:    if (error) {
768:        krateprintf(&vbadrate,
769:                "vnode_pager_putpages: I/O error %d\n", error);
770:    }
771:    if (auio.uio_resid) {
772:        krateprintf(&vresrate,
773:                "vnode_pager_putpages: residual I/O %zd at %lu\n",
774:                auio.uio_resid, (u_long)m[0]->pindex);
775:    }
776:    if (error == 0) {
777:        for (i = 0; i < ncount; i++) {
778:            rtvals[i] = VM_PAGER_OK;
779:            vm_page_undirty(m[i]);
780:        }
781:    }

A VOP_WRITE that returns error==0 with uio_resid != 0 (short write) is detected — the residual is even rate-limited-logged — but the pages are still marked VM_PAGER_OK and undirtied. The never-written bytes are therefore silently dropped from the pageout pipeline:

• the page can be reclaimed and re-read from disk, resurrecting the OLD on-disk content where the application wrote new data (silent stale-data substitution — the write-side twin of the DF-2663 short-read family);
• rtvals[i]=VM_PAGER_OK tells vm_pageout_page() the write succeeded, so no retry ever occurs.

The rest of the function's EOF clipping (ncount/maxsize at :724-737) is correct, and the error!=0 path correctly leaves rtvals at VM_PAGER_AGAIN (pageout retry discipline).

Reachability

Requires a filesystem whose VOP_WRITE returns 0 with residual bytes. None of the filesystems on the audit guest (hammer2, ufs, tmpfs, devfs) do this in normal operation — their write loops run while (uio->uio_resid > 0) and propagate errors. The krateprintf exists because residual writes have been observed historically (interrupted large clustering paths). Hence: latent correctness bug, no trigger on the stock guest; PoC honestly classified untested.

Recommended fix

-   if (error == 0) {
+   if (error == 0 && auio.uio_resid == 0) {
        for (i = 0; i < ncount; i++) {
            rtvals[i] = VM_PAGER_OK;
            vm_page_undirty(m[i]);
        }
+   } else if (error == 0) {
+       error = EIO;    /* short write: leave pages AGAIN/dirty */
    }

(i.e. treat a residual write as an I/O error for the clean/undirty decision while keeping the per-page rtvals discipline.)