DF-2844 — vnode_pager_haspage() divides by mount f_iosize without a zero check

Bug: sys/vm/vnode_pager.c:259-260 Class: hardening (divide-by-zero landmine) Severity: Info Confidence: speculative (reachability currently blocked) Phase V: not run (Info).

259:    bsize = vp->v_mount->mnt_stat.f_iosize;
260:    voff = loffset % bsize;

vnode_pager_haspage() computes loffset % bsize from the mount's f_iosize with no validation. Every other f_iosize consumer in the tree (uipc_syscalls.c:1821, vfs_vnops.c:1238, vfs_bio.c:2504, ufs_bmap.c:142, msdosfs_vnops.c:1812, ...) makes the same assumption.

Current reachability analysis (why Info, not a finding with severity): * mount-time initialization is via VFS_STATFS(mp, &mp->mnt_stat, cred) for every filesystem that gives vnodes VM objects — all of which set a constant/validated f_iosize (ffs: fs->fs_bsize validated at mount; hammer2: HAMMER2_PBUFSIZE; tmpfs: PAGE_SIZE; nfs: nfs_iosize() clamps to >= PAGE_SIZE at nfs_vfsops.c:nfs_iosize). * autofs does leave f_iosize == 0 (autofs_vfsops.c:285 sets it in statfs, called at mount via :185), but autofs vnodes never acquire a VM object (no vinitvmio callers), mmap/exec cannot reach them, so vnode_pager_haspage() cannot run against an autofs mount today. It is exactly one future vinitvmio() call away from a divide-by-zero panic in kernel mode (local DoS at best).

Recommended fix (defense in depth)

259:    bsize = vp->v_mount->mnt_stat.f_iosize;
+   if (bsize <= 0)
+       return TRUE;    /* let the pager I/O path decide */
260:    voff = loffset % bsize;

(and, better, fix autofs to report a real f_iosize).