kern/39245: kernel panic writing at EOT/EOM

[stix%stix.id.au@localhost]

>Number:         39245
>Category:       kern
>Synopsis:       kernel panic writing at EOT/EOM
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 29 10:40:01 +0000 2008
>Originator:     Paul Ripke
>Release:        NetBSD 4.0_STABLE
>Organization:
>Environment:
System: NetBSD zion.stix.org.au 4.0_STABLE NetBSD 4.0_STABLE (ZION) #1: Sun Jul 
27 18:58:48 EST 2008 
stix%zion.stix.org.au@localhost:/export/netbsd/netbsd-4/obj.i386/export/netbsd/netbsd-4/src/sys/arch/i386/compile/ZION
 i386

Architecture: i386
Machine: i386

>Description:

Kernel panics when writing to a tape and reaching end-of-tape (EOT),
end-of-media (EOM).
Tape drive and controller are:

ahc0 at pci2 dev 10 function 0: Adaptec 29160B Ultra160 SCSI adapter
ahc0: interrupting at ioapic0 pin 22 (irq 10)
ahc0: aic7892: Ultra160 Wide Channel A, SCSI Id=7, 32/253 SCBs
scsibus0 at ahc0: 16 targets, 8 luns per target
st0 at scsibus0 target 6 lun 0: <HP, Ultrium 1-SCSI, E16V> tape removable
st0: density code 64, variable blocks, write-enabled
st0: sync (25.00ns offset 15), 16-bit (80.000MB/s) transfers

Panic is:

panic: kernel diagnostic assertion "(bp->b_flags & B_ERROR) == 0" failed: file 
"/export/netbsd/netbsd-4/src/sys/kern/kern_physio.c", line 201
Stopped in pid 116.1 (physiod) at netbsd:cpu_Debugger+0x4:        popl    %ebp
cpu_Debugger(c05345b0,cc688be8,cd03d3e0,c05a2ce0,3ea) at netbsd:cpu_Debugger+0x4
panic(c059058c,c0522931,c052f15a,c056e718,c9) at netbsd:panic+0x146
__assert(c0522931,c056e718,c9,c052f15a,10000) at netbsd:__assert+0x2e
physio_done(c1dc9bd0,0,c052f0f8,0,cc628450) at netbsd:physio_done+0xf5
workqueue_worker(cc628450,0,c01002d2,fbff,c01002d2) at 
netbsd:workqueue_worker+0x8c

I haven't tried this with current sources, but looking at the code, I
can't see any major divergencies.
st was running with default configuration, which seems to imply variable
block size and no early warning at EOM.

>How-To-Repeat:

Generate enough data to fill a tape, and keep writing. In the case
above, I was writing 64 KB blocks.

>Fix: