Block layer: a disk header that cannot be read is taken as blank (format_or_load ignores the read) #187

New Issue

2026-11-12T16:14:25Z

rajames commented

2026-11-12 16:14:25 +00:00

Found

v3/src/block_subsystem.c:634, blk_format_or_load_disk():

uint8_t hdr[BLK_DEVICE_SECTOR] = {0};
(void) read_header_4k(slot, hdr);      /* the read's result is thrown away */
volmeta_from_buf(&slot->vol_meta, hdr);

A disk whose header cannot be read is taken as blank: the zeroed buffer has no magic, the slot is made BLK_FMT_PROVISIONAL ("unformatted, the format decision deferred to the disk's owner") and blk_subsys_attach_device() succeeds. Nothing is written while it is provisional, so nothing is lost at attach -- but the system then holds a formatted volume as if it were empty, and offers its owner a format of a disk that may hold data. Silent failure: no message, no error.

Seen 2026-11-12 (qemu_session.py ident_attach_fail, written for #179): a data stick hot-plugged with every read at its identity partition's first sector (LBA 2048) failing -- the partition attached anyway, and Zuse was minted onto it (logs/20261112-160050).

Shared v3 code (the block layer v4 uses today): changes here wait for Captain Bob (FABRIC-3 XLVIII).

Done when

A header that cannot be read refuses the attach (BLK_EIO) with a message naming the device, instead of reading as blank
Seen to fail first: ident_attach_fail (or a test like it on a formatted Artemis volume) -- then the attach refused, and the same disk without the fault attaching as before
The other reads in the block layer checked for the same pattern ((void) on an I/O result)

🤖 Filed with Claude Code -- found writing the test for #179 (Captain Bob, 2026-11-12: "File it").

### Found `v3/src/block_subsystem.c:634`, `blk_format_or_load_disk()`: ```c uint8_t hdr[BLK_DEVICE_SECTOR] = {0}; (void) read_header_4k(slot, hdr); /* the read's result is thrown away */ volmeta_from_buf(&slot->vol_meta, hdr); ``` A disk whose header **cannot be read** is taken as **blank**: the zeroed buffer has no magic, the slot is made `BLK_FMT_PROVISIONAL` ("unformatted, the format decision deferred to the disk's owner") and `blk_subsys_attach_device()` succeeds. Nothing is written while it is provisional, so nothing is lost at attach -- but the system then holds a formatted volume as if it were empty, and offers its owner a format of a disk that may hold data. Silent failure: no message, no error. Seen 2026-11-12 (`qemu_session.py ident_attach_fail`, written for #179): a data stick hot-plugged with every read at its identity partition's first sector (LBA 2048) failing -- the partition attached anyway, and Zuse was minted onto it (`logs/20261112-160050`). Shared v3 code (the block layer v4 uses today): changes here wait for Captain Bob (FABRIC-3 XLVIII). ### Done when - [ ] A header that cannot be read refuses the attach (`BLK_EIO`) with a message naming the device, instead of reading as blank - [ ] Seen to fail first: `ident_attach_fail` (or a test like it on a formatted Artemis volume) -- then the attach refused, and the same disk without the fault attaching as before - [ ] The other reads in the block layer checked for the same pattern (`(void)` on an I/O result) 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- found writing the test for #179 (Captain Bob, 2026-11-12: "File it").

rajames added this to the v4.0.0-alpha.5: SDK milestone 2026-11-12 16:14:26 +00:00

rajames added the

labels 2026-11-12 16:14:28 +00:00

rajames referenced this issue

2026-11-12 16:14:50 +00:00

A failed identity attach leaves the system stick half attached #179