>Number:         35447
>Category:       kern
>Synopsis:       Panic by write to raw cgd device
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 19 16:35:01 +0000 2007
>Originator:     Christian Biere
>Release:        NetBSD 4.99.7
>Environment:
System: NetBSD cyclonus 4.99.7 NetBSD 4.99.7 (STARSCREAM) #4: Wed Dec 27 02:37:42 CET 2006 src@cyclonus:/o/NetBSD/obj/sys/arch/i386/compile/STARSCREAM i386
Architecture: i386
Machine: i386
>Description:

cgd7: error 30

By setting ddb.onpanic to 1 I could at least see that the panic occurs
in BF_cbc_encrypt+0x3f movl 0(%esi)

The stacktrace is not very useful:
uvm_fault(0xc0366640, 0xc9fb7000, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c027bbff cs 8 eflags 10212 cr2 c9fb7000 ilevel 6
panic: trap
Begin traceback...
uvm_fault(0xca9a8000, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c026d1ef cs 8 eflags 10246 cr2 6 ilevel 6
panic: trap
Faulted in mid-traceback; aborting...

>How-To-Repeat:

#! /bin/sh -x

set -e
mkdir /var/tmp/cgd_test
cd /var/tmp/cgd_test

dd if=/dev/zero bs=32k count=1k of=image
cgdconfig -g -o image.conf -V none blowfish-cbc 128
vnconfig -c vnd0 image
cgdconfig cgd0 /dev/vnd0d image.conf
echo > /dev/rcgd0d

The latter was just a test because disklabel -iI cgd0 kept
failing with this message:

disklabel: disklabel write (sector 0) size 8192 failed: Read-only file system

>Fix: