Heap overflow in mps(4) (was: Re: stable/9 mps(4) rev 254938 == BOOM!)

[Garrett Wollman]

<<On Thu, 30 Jan 2014 17:33:42 -0700, "Kenneth D. Merry" <ken at freebsd.org> said:

> The fact that the redzone code doesn't expose any problems makes it more
> likely that it is a problem other than a heap overflow.

So I built a new kernel with DEBUG_MEMGUARD.  When
vm.memguard.desc="mps", everything works fine both through two
load/unload cycles and statically compiled into the kernel.  When
vm.memguard.desc is not set, instapanic as before.  (I'm trying
memguard rather than redzone as it has much less of a performance
impact, so I can start doing some of the performance testing I was
originally intending to do.

Are there any debugging options that I could usefully enable that
would show just what mps is doing when the fault happens?  I see that
there are lots of tracing options but I don't know what would actually
be useful.

-GAWollman