XCP-ng tapdisk / blkfront stall evidence bundle
================================================

Incident date: 2026-07-25
Timezone: Europe/Moscow (UTC+03:00)

Affected guest:
  name: os-ott-data-3-2
  IP: 172.30.52.193
  VM UUID: 8c055917-e0b8-da24-3078-00039b7e6c66

Hypervisor:
  hostname: xcp-50-191
  IP: 172.30.50.191

Affected data disk:
  VDI: d202a2b3-97c4-4c19-8c76-14e23278064e
  tapdisk PID before reboot: 372284
  tapdisk minor: 6

Timeline (MSK):
  04:40:54  Recovery controller routing guard marker created.
  04:45:44  First manual GDB/tap-ctl capture started.
  04:45:46  First capture completed and GDB detached.
  04:48:02  Full incident signature matched.
  04:48:03  Second automatic GDB/tap-ctl capture started.
  04:48:04  Second capture completed and GDB detached.
  04:58:33  Signature matched again and forced VM reboot requested.
  05:02:02  Guest rejoined the OpenSearch cluster.

Files:
  20260725-044544-gdb-172.30.52.193.log
    First complete GDB backtrace, tapdisk state and shared-ring dump.

  20260725-044732-gdb-172.30.52.193.log
    Independent repeat capture taken by the recovery controller.

  osott-193-daemon-20260725-0435-0510.log
    /var/log/daemon.log excerpt from xcp-50-191.

  osott-193-SMlog-20260725-0435-0510.log
    /var/log/SMlog excerpt from xcp-50-191.

Both host-log excerpts cover 2026-07-25 04:35:00 through 05:10:00 MSK.

Key captured state before reboot:
  Guest: 31 requests in flight, all 32 blkfront tags busy.
  tap-ctl: reqs_outstanding=0.
  tapdisk: n_reqs=32, n_reqs_free=32.
  Ring: req_prod=req_cons=rsp_prod=rsp_prod_pvt=0.
  tapdisk main thread: scheduler_wait_for_events().

The files were checked for common password, token, API-key, Authorization,
cookie and private-key patterns before packaging. XCP-ng had already redacted
the SM session reference as "******".