bin/52321: newfs_lfs can crash in case of LFS64 (?)

[clare%csel.org@localhost <shinichidoyashiki%csel.org@localhost>]

>Number:         52321
>Category:       bin
>Synopsis:       newfs_lfs can crash in case of LFS64 (?)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 21 14:00:00 +0000 2017
>Originator:     Shinichi Doyashiki
>Release:        NetBSD 8.99.1
>Organization:
	at home
>Environment:
System: NetBSD kanako.csel.org 8.99.1 NetBSD 8.99.1 (KANAKO) #8: Mon Jun 12 07:05:20 JST 2017 clare%kanako.csel.org@localhost:/export/stage/hack/sys/arch/amd64/compile/KANAKO amd64
Architecture: x86_64
Machine: amd64
>Description:
$ dmesg | grep dk[0-9]
dk0 at wd0: "root", 2097152 blocks at 8, type: ffs
dk1 at wd0: "swap", 18874368 blocks at 2097160, type: swap
dk2 at wd0: "var", 20971520 blocks at 20971528, type: ffs
dk3 at wd0: "usr", 20971520 blocks at 41943048, type: ffs
dk4 at wd0: "spool", 5797618592 blocks at 62914568, type: ffs
dk5 at wd1: "raid1", 7814037152 blocks at 8, type: raidframe
dk6 at wd2: "raid0", 7814037152 blocks at 8, type: raidframe
dk7 at wd3: "raid2", 7814037152 blocks at 8, type: raidframe
dk8 at wd4: "raid3", 7814037152 blocks at 8, type: raidframe
dk9 at wd5: "raid4", 7814037152 blocks at 8, type: raidframe
raid0: Components: /dev/dk6 /dev/dk5 /dev/dk7 /dev/dk8 /dev/dk9
dk10 at raid0: "export", 31256148224 blocks at 64, type: ffs
root on dk0 dumps on dk1
dk4 at wd0 (spool) deleted
dk4 at wd0: "spool", 5797618592 blocks at 62914568, type: lfs
# gpt show wd0
       start        size  index  contents
           0           1         PMBR (active)
           1           1         Pri GPT header
           2           6         Pri GPT table
           8     2097152      1  GPT part - NetBSD FFSv1/FFSv2
     2097160    18874368      2  GPT part - NetBSD swap
    20971528    20971520      3  GPT part - NetBSD FFSv1/FFSv2
    41943048    20971520      4  GPT part - NetBSD FFSv1/FFSv2
    62914568  5797618592      5  GPT part - NetBSD LFS
  5860533160           1         Unused
  5860533161           6         Sec GPT table
  5860533167           1         Sec GPT header
# newfs_lfs rdk4
Creating a version 2 LFS64 with roll-forward ident 0x1fb4a254
WARNING: The LFS64 on-disk format is not final.
WARNING: 64-bit volumes should be used only for testing.
2830868.0MB in 2830868 segments of size 1048576
super-block backups (for fsck -b #) at:
16, 579760128, 1159520256, 1739280384, 2319040512, 2898800640, 3478560768,
4058320896, -3951853568assertion "daddr > 0" failed: file "/export/stage/hack/src/sbin/fsck_lfs/segwrite.c", line 1054, function "lfs_writesuper"
[1]   Abort trap (core dumped) newfs_lfs rdk4
# gdb /sbin/newfs_lfs newfs_lfs.core
GNU gdb (GDB) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /sbin/newfs_lfs...(no debugging symbols found)...done.
[New process 1]
Core was generated by `newfs_lfs'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007694caf1bc2a in _lwp_kill () from /lib/libc.so.12
(gdb) bt
#0  0x00007694caf1bc2a in _lwp_kill () from /lib/libc.so.12
#1  0x00007694caf1b8b7 in abort () from /lib/libc.so.12
#2  0x00007694caf1b4a7 in __assert13 () from /lib/libc.so.12
#3  0x000000003960d4dc in lfs_writesuper ()
#4  0x00000000396048ba in make_lfs ()
#5  0x000000003960e61f in main ()
(gdb) quit

>How-To-Repeat:
	see above
>Fix:
	unknown...