# Pre10 Batch B: Bounded Metadata Helpers

## Scope and baseline

Batch B is a source-only extraction based on commit
`3c7c774b296a2ee90578a78f372aad5fd2edbec6`. It changes only
`src/super.c`, `src/data.c`, and `src/inode.c`, plus this report. No build,
QEMU smoke, or feature test was run.

The extraction keeps ownership at the original FreeBSD lifecycle boundaries:

- `erofs_mountfs()` still owns mount allocation, the primary GEOM transfer,
  extent-cache lifecycle, device scanning, internal inode setup, publication,
  and the single `erofs_sb_free()` failure path.
- `erofs_map_dev()` still owns device selection, range and overflow checks,
  flat-device behavior, and all `ENODEV`/`EINTEGRITY` returns.
- `erofs_vget()` still owns vnode allocation, locking, mount association,
  hash insertion, construction state, publication, and failure cleanup.

## Superblock helper

`erofs_read_superblock()` now reads the on-disk superblock into a temporary
buffer, copies the fixed 144-byte structure to caller-owned stack storage,
releases the temporary buffer, and performs the existing validation and field
decode in the original order. It also retains the existing device-size,
checksum, generation-seed, metabox-NID, and compression-configuration checks.

The helper does not allocate or publish the mount, open extra devices, create
internal inodes, initialize xattrs, or own failure cleanup. `erofs_mountfs()`
still calls, in order:

```text
z_erofs_extent_cache_init
erofs_read_superblock
erofs_scan_devices
shared-EA/metabox combination check
erofs_init_packed_inode
erofs_init_metabox_inode
erofs_xattr_prefixes_init
mount publication and flag setup
```

All prior superblock outcomes remain at the same semantic boundary:

| Condition | Preserved result |
| --- | --- |
| read failure | underlying `erofs_bread()` error |
| invalid magic or block geometry | `EINVAL` |
| unsupported directory blocks or feature bits | `EOPNOTSUPP` |
| invalid xattr, timestamp, or metabox metadata | `EINTEGRITY` |
| invalid device geometry | existing `EINVAL`, `EINTEGRITY`, or `ENXIO` |
| checksum mismatch | `EINTEGRITY` |
| generation/config read failure | existing underlying error |

Copying the superblock before releasing its read buffer makes its lifetime
explicit. The copy remains available to `erofs_scan_devices()` and volume-name
publication, while checksum and compression configuration reads continue to
use their existing independent I/O helpers.

## Device-map helper

`erofs_fill_map_dev()` is a pure assignment helper for `m_em`, `m_dif`, and
`m_pa`. It has no branches, errors, allocation, I/O, or ownership effects.

The caller retains all explicit-device and unified-range selection, arithmetic
overflow checks, physical range validation, flat-device handling, and external
device availability checks. In particular:

- flat explicit mappings still use the primary device and add the unified
  offset to the existing physical address;
- flat implicit mappings still retain the primary device and unified address;
- non-flat explicit mappings select the requested extra device only after all
  validation succeeds; and
- non-flat implicit misses still return success with the initial primary map.

## Vnode helper

`erofs_fill_vnode()` sets only the inode-derived vnode type, FIFO operation
vector, and `VV_ROOT` flag. It runs after `erofs_read_inode()` succeeds and
immediately before `VSTATE_CONSTRUCTED`, while `erofs_vget()` still holds the
exclusive vnode lock.

Hash lookup/insertion, allocation, `insmntque()`, locking, race handling,
failure `vgone()`/`vput()`, shared-lock downgrade, and `*vpp` publication remain
in `erofs_vget()` in their original order.

## Known pre-existing risk

The `insmntque()` failure branch remains unchanged. FreeBSD's `insmntque()` may
reclaim and release the vnode on failure, while the existing EROFS branch then
accesses `vp->v_data`. This possible use-after-release is outside a helper-only
batch and was deliberately not mixed into this commit. Consequently, this
report does not claim that the pre-existing vnode cleanup path is correct.

## Static validation

| Check | Result | Evidence |
| --- | --- | --- |
| Changed-path allowlist | PASS | Only three allowed source files and this report changed. |
| Helper ownership | PASS | Each helper is `static` and has one direct caller. |
| Mount lifecycle order | PASS | Cache init, device scan, internal inode/xattr setup, publication, and `erofs_sb_free()` remain in `erofs_mountfs()`. |
| Device-map errors | PASS | All range, overflow, device-selection, `ENODEV`, and `EINTEGRITY` branches remain in `erofs_map_dev()`. |
| Vnode lifecycle order | PASS | `insmntque()`, hash insertion, inode read, construction, downgrade, and publication retain their order. |
| `git diff --check` | PASS | No whitespace errors. |
| Build/QEMU/feature test | NOT RUN | Reserved for later aggregate Pre10 validation. |

The pre-existing `insmntque()` concern is deferred; no new errno, logging,
ABI, Linux lifecycle facade, or Pre9 decoded-cache change was introduced.