shadow_copy_opendir() return address to shadow_copy_Dir. The readdir() and The closedir() functions is hooked VFS shadow_copy module, then no problems. But, seekdir(), telldir() and rewinddir() is not hooked by VFS shadow_copy module. these function processed by default handler/function in the smbd/vfs-wrap.c. these default handler expect address to struct DIR. but shadow_copy_opendir() returned address to shadow_copy_Dir, not address to struct DIR. Therefore paniced in seekdir(), telldir() and rewinddir() on The FreeBSD 5.4-STABLE. Maybe other system (LINUX, Solaris,...) is not panic, return -1 and set EBADF to errno.
Created attachment 1269 [details] Hook seekdir(), telldir() and rewinddir() shadow_copy module hook seekdir(), telldir() and rewinddir(). these function don't use address to struct DIR.
Applied - thanks ! Jeremy.
sorry for the same, cleaning up the database to prevent unecessary reopens of bugs.