Post

Replies

Boosts

Views

Activity

Critical Regression: smbfs 7.0 introduces a crtitical bug regarding symlinks
Apple feedback FB25355124 The SMB client no longer accepts reads to symlinks that are an absolute path to a network volume or a symlink that contains a (..) in the relative path. Reproduction steps on an SMB mount with this file structure: dir a.txt Run this command from inside of "dir": ln -s my-link ../dir/a.txt Attempt to read that symlink: cat ./my-link Which results in this error: cat: link: Invalid argument which is translating to an EINVAL getting returned from the SMB client. Same behavior was observed when making a symlink with an absolute path: ln -s my-link /Volumes/Example/dir/a.txt The server is responding successfully to the IOCTL command but the client is still rejecting the request with that error. This behavior was not observed in macOS 26.6.2 (smbfs 6.0.1) as well as previous versions of macOS.
0
2
109
2d
Incorrect packet handling in SMBClient MacOS 26.
SMBClient-593 introduces a crtitical bug. When reading and writing data at high volume, the SMBClient no longer properly receives and handle responses from the server. In some cases, the client mishandles the response packet and the following errors are seen in the logs: 2025-12-02 21:36:04.774772-0700 localhost kernel[0]: (smbfs) smb2_smb_parse_write_one: Bad struct size: 0 2025-12-02 21:36:04.774776-0700 localhost kernel[0]: (smbfs) smb2_smb_write: smb2_smb_read_write_async failed with an error 72 2025-12-02 21:36:04.774777-0700 localhost kernel[0]: (smbfs) smbfs_do_strategy: file.txt: WRITE failed with an error of 72 In other cases, the client mishandles the response packet and becomes completely unresponsive, unable to send or receive additional messages, and a forced shutdown of the computer is required to recover. This bug is only present on macos 26. We believe the operative change is in the latest commit, SMBClient-593 beginning at line now 3011 in smb_iod.c. The issue seems to be a race, and occurs much more frequently once throughput exceeds around 10Gbps, and again more frequently above 20Gbps.
6
7
744
Jan ’26
Critical Regression: smbfs 7.0 introduces a crtitical bug regarding symlinks
Apple feedback FB25355124 The SMB client no longer accepts reads to symlinks that are an absolute path to a network volume or a symlink that contains a (..) in the relative path. Reproduction steps on an SMB mount with this file structure: dir a.txt Run this command from inside of "dir": ln -s my-link ../dir/a.txt Attempt to read that symlink: cat ./my-link Which results in this error: cat: link: Invalid argument which is translating to an EINVAL getting returned from the SMB client. Same behavior was observed when making a symlink with an absolute path: ln -s my-link /Volumes/Example/dir/a.txt The server is responding successfully to the IOCTL command but the client is still rejecting the request with that error. This behavior was not observed in macOS 26.6.2 (smbfs 6.0.1) as well as previous versions of macOS.
Replies
0
Boosts
2
Views
109
Activity
2d
Incorrect packet handling in SMBClient MacOS 26.
SMBClient-593 introduces a crtitical bug. When reading and writing data at high volume, the SMBClient no longer properly receives and handle responses from the server. In some cases, the client mishandles the response packet and the following errors are seen in the logs: 2025-12-02 21:36:04.774772-0700 localhost kernel[0]: (smbfs) smb2_smb_parse_write_one: Bad struct size: 0 2025-12-02 21:36:04.774776-0700 localhost kernel[0]: (smbfs) smb2_smb_write: smb2_smb_read_write_async failed with an error 72 2025-12-02 21:36:04.774777-0700 localhost kernel[0]: (smbfs) smbfs_do_strategy: file.txt: WRITE failed with an error of 72 In other cases, the client mishandles the response packet and becomes completely unresponsive, unable to send or receive additional messages, and a forced shutdown of the computer is required to recover. This bug is only present on macos 26. We believe the operative change is in the latest commit, SMBClient-593 beginning at line now 3011 in smb_iod.c. The issue seems to be a race, and occurs much more frequently once throughput exceeds around 10Gbps, and again more frequently above 20Gbps.
Replies
6
Boosts
7
Views
744
Activity
Jan ’26