From owner-freebsd-stable@FreeBSD.ORG  Fri Feb  8 22:58:14 2008
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E3D7416A418;
	Fri,  8 Feb 2008 22:58:14 +0000 (UTC) (envelope-from joe@skyrush.com)
Received: from shadow.wildlava.net (shadow.wildlava.net [67.40.138.81])
	by mx1.freebsd.org (Postfix) with ESMTP id B090F13C459;
	Fri,  8 Feb 2008 22:58:14 +0000 (UTC) (envelope-from joe@skyrush.com)
Received: from [10.0.3.98] (mail.boulder.swri.edu [65.241.78.2])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by shadow.wildlava.net (Postfix) with ESMTP id 9A00D8F394;
	Fri,  8 Feb 2008 15:58:12 -0700 (MST)
Message-ID: <47ACDE82.1050100@skyrush.com>
Date: Fri, 08 Feb 2008 15:58:10 -0700
From: Joe Peterson <joe@skyrush.com>
User-Agent: Thunderbird 2.0.0.9 (X11/20071119)
MIME-Version: 1.0
To: Mark Day <mday@apple.com>
References: <47ACD7D4.5050905@skyrush.com>
	<D6B0BBFB-D6DB-4DE1-9094-8EA69710A10C@apple.com>
In-Reply-To: <D6B0BBFB-D6DB-4DE1-9094-8EA69710A10C@apple.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: freebsd-fs@freebsd.org, freebsd-stable@freebsd.org
Subject: Re: Analysis of disk file block with ZFS checksum error
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Feb 2008 22:58:15 -0000

Mark Day wrote:
> Based on the subset of data you posted, the bad data looks like ASCII
> text.
> The bad data from offset a0000 to a000f is:
>
> ${138AFE{@
> @$$}1
>
> The bad data from offset af6c1 to af6c8 is:
>
> 392A9}@
>
> I don't recognize the content beyond that, but I'd guess that somehow
> the
> contents of some other file managed to overwrite that portion of the bad
> file.  As for how that happened, I don't know.  But if someone
> recognizes
> where the bad content came from, that might be a clue.


Gary/Mark,

Good eye!  Yes, it indeed does appear to be ASCII.  I *thought*
something in the repetition when I originally did an od -a looked
interesting.

I dumped the whole bad section as a string, and here's (partly) what I get:

${138AFE{@
@$$}138AFE}@

@$${138AFF{@
[A3:^80(^91^2146F)]
@$$}138AFF}@

@$${138B00{@
@$$}138B00}@

@$${138B01{@
[181:^80(^91^2146F)]
@$$}138B01}@

@$${138B02{@
@$$}138B02}@

@$${138B03{@
[2C:^80(^91^2146F)]
@$$}138B03}@

@$${138B04{@
@$$}138B04}@

.
.
.

@$${138B8B{@
<(21470=Thu Jan 24 23:20:58 2008)>
[117:^80(^91^21470)]
@$$}138B8B}@

.
.
.

@$${138C18{@
<(21472=1201242069)>[-2:^80(^82^85)(^83^1B5)(^84=b)(^85=1)(^86=0)(^87=0)
    (^88=0)(^89^2146C)(^8A=)(^8B=40)(^8C=2e)(^8D^84)(^8E=0)(^90^21472)
    (^91^21460)]
@$$}138C18}@

@$${138C19{@
<(21473=a72f78)>[2:^80(^89^21473)]
@$$}138C19}@

@$${138C1A{@
@$$}138C1A}@

.
.
.


and more of the same.  Note the date string.  There are several like
that.  Anyone recognize this text format?

				-Joe