lib/raid6 x1 SIMD gen_syndrome reads dptr[-1] with one data disk (2026-09-14)

Resolves the cand48 "rare raid6 race" (bhive #207 panic in the r6c3 cdev stage, console: bhive-cand48-r6c3-raid6-syndrome-oops-20260914.txt). Not a race and not stripe_alloc: a stock lib/raid6 bug, boot-dependent.

Mechanism

• sse1x1/sse2x1/avx2x1/avx512x1 gen_syndrome preload dptr[z0-1] before the loop over z0-2..0 and fold it in after the loop. disks == 3 -> z0 == 0 -> dptr[-1].
• Crash registers: R08 = 0xfffffffe = z0-2 -> z0 = 0 -> disks = 3; RAX = pointers[-1] = 0.
• pointers = rbio->finish_pointers (kcalloc(3, 8) -> kmalloc-32); pointers[-1] is the neighbour slab object's last 8 bytes: NULL -> oops, else read as data: P = D0 ^ X, Q = 2*D0 ^ X (correct: P = Q = D0).
• x2/x4 variants and generic int loop from z0-1: correct. Selection is the boot benchmark: bhive boot 2026-09-13T05:22 chose avx2x1 (the ONLY such boot on record over 9 bhive + 27 dhive boots) and that is the boot that panicked; every rerun boot chose x2/x4 and cdev passed (with correct parity).
• cdev layout 6 x 512M + 3 x 6G (raid1c3 metadata) => after the small devices fill, every data chunk is 3-wide raid6 (devs_min = 3) => nr_data = 1 rbios.

Evidence

• lib/raid6/test with NDISKS 3, unfixed, AddressSanitizer: SEGV in raid6_avx21_gen_syndrome avx2.c:54 (same line as the kernel RIP).
• Fixed: all algorithms OK at NDISKS 3 and 16 (ASan clean); avx2x1 gen() 29182 MB/s.
• bhive #207 (avx2x2 boot): raid6-3dev-parity.py -> P == Q == D0 for all stripes (why the reruns were clean).
• Kernel-side confirmation with raid6_pq.algo=avx2x1 (test-only knob): see below.

Fix

• 6.18/topics/raid6-fixes 7fa8a0f0201c, misc-next/topics/raid6-fixes 3480c8890b07 (lib/raid/raid6/x86/ paths there); patch in ~/share/patches/2026-09-14-raid6-x1/. Target: md maintainers (lib/raid6), Cc linux-btrfs, stable.
• cand49 = 6.18 zb64 12eafe115205 (with the fix) + v2 chain + knob = refs/wip/cand49/6.18-zb64 848031137e86; cand48p (positive control) = refs/wip/cand48p/6.18-zb64 f0207b15b21c.

Kernel-side runs

# unfixed userspace test, NDISKS=3, ASan:
==ERROR: AddressSanitizer: SEGV ... #0 raid6_avx21_gen_syndrome .../avx2.c:54  #1 main test.c:115

• bhive #208 = cand48 + knob, raid6_pq.algo=avx2x1: 3-device raid6 write -> oops in raid6_avx21_gen_syndrome+0xaa at 35 s uptime, panic (console: bhive-cand48p-forced-avx2x1-3dev-oops-20260914.txt). Deterministic positive control.
• bhive #209 = cand49 (fixed) + knob, avx2x1 forced: raw P/Q = D0/D0/D0 on all stripes; r6c3 cdev PASS (22:03); full r6c3 running.
• dhive #69 = cand49 + knob, avx2x1 forced: raw P/Q = D0/D0/D0; r6c3 running (after freeing 80 GiB of retired folio-repro images from /mnt/wh; preflight needs 25G).
• 2026-09-15 00:56 bhive #209 (cand49, avx2x1 forced) FULL r6c3: sanity, matrix-stock, matrix-sa, fsync-sa, recovery, cdev, cstripe all PASS; taint 0; 0 BUG/Oops/WARN in dmesg. Logs /root/r6c3-validation-20260914-220341/ on bhive.
• 2026-09-15 00:57 dhive #69 (cand49, avx2x1 forced) FULL r6c3: all 7 stages PASS, taint 0, 0 BUG/Oops/WARN. Logs /root/r6c3-validation-20260914-220713/ on dhive. => cand49 is green on raid6 coverage with the x1 implementation pinned on both VMs.