Found by valgrind:

==185== Conditional jump or move depends on uninitialised value(s)
==185==    at 0x4C318B9: __strlen_sse2 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==185==    by 0x15B018C3: vfprintf (in /lib64/libc-2.26.so)
==185==    by 0x15B292E8: vasprintf (in /lib64/libc-2.26.so)
==185==    by 0x60D3F62: __dbgtext_va (in /home/ddiss/isms/samba/bin/default/lib/util/libsamba-deb
ug-samba4.so)
==185==    by 0x60D4064: dbgtext (in /home/ddiss/isms/samba/bin/default/lib/util/libsamba-debug-sa
mba4.so)
==185==    by 0x19741585: cephwrap_flistxattr (in /home/ddiss/isms/samba/bin/default/source3/modul
es/libvfs_module_ceph.so)
==185==    by 0x522568A: smb_vfs_call_flistxattr (in /home/ddiss/isms/samba/bin/default/source3/li
bsmbd-base-samba4.so)



Fix is a simple one liner (I'll attach when done):

diff --git a/source3/modules/vfs_ceph.c b/source3/modules/vfs_ceph.c
index f62fef05614..fbb37dd0b68 100644
--- a/source3/modules/vfs_ceph.c
+++ b/source3/modules/vfs_ceph.c
@@ -1306,7 +1306,7 @@ static ssize_t cephwrap_listxattr(struct vfs_handle_struct *handle,
 static ssize_t cephwrap_flistxattr(struct vfs_handle_struct *handle, struct files_struct *fsp, char *list, size_t size)
 {
        int ret;
-       DBG_DEBUG("[CEPH] flistxattr(%p, %p, %s, %llu)\n", handle, fsp, list, llu(size));
+       DBG_DEBUG("[CEPH] flistxattr(%p, %p, %p, %llu)\n", handle, fsp, list, llu(size));
 #if LIBCEPHFS_VERSION_CODE >= LIBCEPHFS_VERSION(0, 94, 0)
        ret = ceph_flistxattr(handle->data, fsp->fh->fd, list, size);
 #else



The @list buffer is uninitialized until the ceph_flistxattr() call. Looks like the %s was unintended, as cephwrap_listxattr() does the right thing (I've also checked all other vfs_ceph DBG_X(...%s) invocations).