>Number:         33245
>Category:       kern
>Synopsis:       iAudio U3 scsi-over-usb mis-handling
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Apr 12 19:25:00 +0000 2006
>Originator:     Havard Eidnes
>Release:        NetBSD 3.99.17
>Organization:
	
>Environment:
System: NetBSD vestlia.uninett.no 3.99.17 NetBSD 3.99.17 (VESTLIA) #6: Mon Apr 3 00:20:14 CEST 2006 he@vestlia.uninett.no:/usr/obj/sys/arch/i386/compile/VESTLIA i386
Architecture: i386
Machine: i386
>Description:
	Attaching an iAudio U3 results in these probe messages:

umass0 at uhub3 port 4 configuration 1 interface 0
umass0: COWON Systems, Inc. iAUDIO U3, rev 2.00/1.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <COWON, iAUDIO U3, 0100> disk removable
sd0: fabricating a geometry
sd0: 1279 GB, 974 cyl, 64 head, 32 sec, 688144 bytes/sect x 1995840 sectors

	The music player in question has 1GB flash memory, not 1279GB,
	and perhaps unsurprisingly, trying to access the "disk" results
	in a panic: buf mem pool index 12.  The stack backtrace from
	the saved core dump was:

(gdb) where
#0  0x1fe60000 in ?? ()
#1  0xc03cb707 in cpu_reboot ()
#2  0xc035a64a in panic ()
#3  0xc0378816 in allocbuf ()
#4  0xc03785a8 in geteblk ()
#5  0xc03c9c13 in readdisklabel ()
#6  0xc03e6a6e in sdgetdisklabel ()
#7  0xc03e5783 in sdopen ()
#8  0xc038c6d3 in spec_open ()
#9  0xc0387524 in VOP_OPEN ()
#10 0xc0384f34 in vn_open ()
#11 0xc03814d2 in sys_open ()
#12 0xc03d588a in syscall_plain ()
(gdb) 

	User-land tried to do "disklabel sd0".

	If the sector size was 512 bytes instead of the totally off-the-wall
	688144 value, we'd be closer to 1GB.

>How-To-Repeat:
	Try to use a Cowon iAudio U3 player with NetBSD, watch it fail
	as above.  Of course it works fine with Windows...
>Fix:
	Sorry, don't know.
	Suggestions for debugging appreciated.