kern/56725: Panic when ls directory with device nodes on an older ffs

[cjep@berkeley.localdomain]

>Number:         56725
>Category:       kern
>Synopsis:       NetBSD current panics on ls in a directory with device nodes on older ffs format
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 21 09:40:00 +0000 2022
>Originator:     Chris Pinnock
>Release:        NetBSD 9.99.93
>Organization:
Very little
>Environment:
System: NetBSD berkeley 9.99.93 NetBSD 9.99.93 (BERKELEY) #21: Thu Dec 23 14:09:06 UTC 2021 cjep@berkeley:/home/cjep/src/NetBSD/current/src/sys/arch/amd64/compile/BERKELEY amd64
Architecture: x86_64
Machine: amd64
>Description:
On a very old FFS image mounted via a vnd, it is possible to panic 9.99.93 
by running ls on a directory containing device nodes. I cannot reproduce 
this on 9.2.

# vnconfig vnd0 inst-10.fs 
# mount /dev/vnd0d /mnt
[ 410.5390917] /dev/vnd0d: file system not clean (fs_clean=0); please fsck(8)
[ 410.5390917] /dev/vnd0d: lost blocks 0 files 0
# ls -l /mnt/dev

(Crashes after listing the tty devs)

[ 414.1587747] panic: kernel diagnostic assertion "vp->v_type != VLNK || ump->umvp->v_type != VLNK || ump->um_maxsymlinklen !=0 || DIP(ip, blocks) ufs_readwrite.c line 144
[ 414.1587747] cpu0: Begin traceback...
[ 414.1587747] vpanic() at netbsd:vpanic+0x156
[ 414.1587747] kern_assert() at netbsd:kern_assert+0x4b
[ 414.1688707] ffs_bufrd() at netbsd:ffs_bufrd+0x336
[ 414.1688707] VOP_READLINK() at netbsd:VOP_READLINK+0x40
[ 414.1688707] do_sys_readlinkat() at netbsd:do_sys_readlinkat+0x1b9
[ 414.1789647] syscall() at netbsd:syscall+0x196
[ 414.1789647] --- syscall (number 58) ---
[ 414.1789647] netbsd:syscall+0x196:
[ 414.1789647] cpu0: End traceback...

(I've recreated this on a QEmu VM as well has real hardware.)

Crash and core dumps here:
http://downloads.chrispinnock.com/crash/netbsd.0.core.gz
http://downloads.chrispinnock.com/crash/netbsd.0.gz

>How-To-Repeat:
- Get the install floppy image for 1.0 (yes weird - I'm working on a
nostalgic project).
- mount it and ls the dev directory.

ftp -a http://archive.netbsd.org/pub/NetBSD-archive/NetBSD-1.0/i386/floppies/inst-10.fs
vnconfig vnd0 inst-10.fs
mount /dev/vnd0d /mnt
ls -l /mnt/dev

>Fix:
not known but looks like a bug introduced since 9.2