erofs-freebsd-out-tree/tests/TC157-explicit-extent-order-validation.md

Test Case: Explicit Extent Global Ordering Validation

Test ID: TC157-explicit-extent-order-validation Category: Compression Mapping Priority: Critical Regression: Binary search over an unvalidated explicit extent table can silently select the wrong mapping

Objective

Verify that every 16-byte and 32-byte explicit extent table is validated once, before binary search, for globally strict lstart ordering and logical bounds. Descending, duplicate, and cross-search-branch violations must return positive FreeBSD EINTEGRITY without reading the referenced compressed payload.

Fixtures

Generate and self-check all final-review fixtures on the host:

python3 tests/final_review_fixtures.py make \
  --output /work/build/repo22-final-review-fixtures

For each record size, the helper emits descending, duplicate, and cross-branch images. The manifest records the complete lstart list, old binary-search indices, table offsets, payload offset, and SHA256. The cross-branch shape [0, 8192, 4096, 12288] is queried at 4096; the old search visits records 2 and 3 but never record 1, so a hit-neighbor-only check is not sufficient.

Procedure

1. Build and load the exact WITH_ZSTDIO=0 module on FreeBSD 15.

2. For each of the six images, attach an md provider and mount it read-only.

3. Before any lookup of /extent.bin, run:

   final_review_probe expect-stat-error /mnt/repo22-final/extent.bin 97
   

4. Wrap the command with io:::start, filtered to that md unit. Require a raw dd positive control to report the manifest payload offset 4096, then require zero events at offset 4096 during every failing target lookup.

5. Repeat one case to confirm the same positive errno, compare dmesg, and clean the mount, md unit, EROFS KLD, and DTrace modules.

Expected Results

• All six target lookups return EINTEGRITY (97).
• Both record sizes reject descending and duplicate lstart values globally.
• Cross-branch corruption is rejected even though the old binary search would not visit the preceding offending record.
• The payload-offset positive control fires and all six failing operations have zero payload-offset GEOM events.
• No wrapped, negative, or Linux-style errno is returned.