Hi Brian, My first guess would be that you're underflowing the size variable in the while loop in cluster_io(). It's fairly easy to do, trust me ;-) If you're returning a blkno of -1 for a hole and the size has underflowed, you end up in a loop with size working its way down from 2^32 one page at a time and f_offset working its way up just as you described. I can't seem to get web access working in this hotel room right now, so I can't follow the links you posted. Send me an email with some more details attached if you like. Sam Okay, I'm at my wits end on a bug in the ext2 filesystem for OS X <http://sourceforge.net/projects/ext2fsx>: When writing a sparse file (even one with just one hole), the fs can hang or panic (with a Disk Image) the system. I've tracked this down to cluster_io() repeatedly calling VOP_CMAP with higher and higher offsets (way past the file size) that eventually cause our logical block address to overflow (this is much more likely on <4KB block FS), thus making a negative offset which VOP_BMAP treats as an indirect block address and I assume causes a weird page to be read and passed to the storage driver by cluster_io/VOP_STRATEGY. Anyway, I can't figure why this happens. I've gone through everything I can think of: <http://sourceforge.net/tracker/index.php? func=detail&aid=965119&group_id=64713&atid=508406> Could anyone be so kind as to look over the bug report above and see if they notice anything. I really need a fresh set of eyes (and minds) to look at this. TIA. PS. I have quite a log of GDB trace sessions too. ("`-''-/").___..--''"`-._ Sam Vaughan `6_ 6 ) `-. ( ).`-.__.`) (_Y_.)' ._ ) `._ `. ``-..-' samvaughan@mac.com _..`--'_..-_/ /--'_.' ,' __________________________(il),-'' (li),' ((!.-' _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.