samba - Aug 2025 - Assertion failed in Samba 4.22.4 with zfsacl vfs module

While attempting to upgrade our Samba servers to 4.22.4 on our FreeBSD servers
with ZFS filesystems (needed due to the AD server security patches) I?m running
into a problem with it coredumping with an assertion failed:

	Assert failed: (dirfd != -1) || (smb_fname->base_name[0] == '/') in
vfswrap_openat

It seems to be related to the zfsacl module since since disabling that makes the
error go away.


I?ve opened a ticking in the Bugzilla:
https://bugzilla.samba.org/show_bug.cgi?id=15897
Ways to reproduce:

1. Create a directory "noaccess" in a folder.
2. Set the permissions of "noaccess" so that the user doesn't have
access.
3. Create a file "desktop.ini" inside "noaccess" (ACL
doesn't matter but it must exist)
4. Connect to the share with smbclient and try "get
noaccess/desktop.ini"


To get coredumps of smbd on FreeBSD you need to do this:

1. mkdir /var/cores
2. sysctl 'kern.corefile=/var/cores/%N.%P.core'
3. sysctl 'kern.sugid_coredump=1'


ACL I use on noaccess:

/export/test # getfacl noaccess
# file: noaccess
# owner: root
# group: nobody
owner@:rwxpDdaARWcCos:-------:allow

/export/test # ls -ld noaccess
drwx------+ 2 root nobody 3 Aug 22 19:21 noaccess


smb.conf:

bind interfaces only = yes
workgroup = GREBO
netbios name = KATLA
security = user
passdb backend = tdbsam

vfs objects = zfsacl

[test]
path = /export/test
browsable = yes



$ smbclient -W GREBO //katla/test
Password for [GREBO\peter]:
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Thu Aug 21 22:17:07 2025
.. D 0 Thu Aug 21 22:17:07 2025
noaccess D 0 Fri Aug 22 19:21:21 2025
s D 0 Fri May 31 20:03:41 2024
d D 0 Sat Jun 22 16:20:39 2024

1737041884 blocks of size 1024. 1737041748 blocks available
smb: \> get noaccess/desktop.ini
NT_STATUS_CONNECTION_DISCONNECTED opening remote file \noaccess\desktop.ini
smb: \> SMBecho failed (NT_STATUS_CONNECTION_DISCONNECTED). The connection is
disconnected now


The smbd process does not crash if the file inside the folder does not exist.


It?s a bit worrying that Samba tries to access a file inside a folder that
shouldn?t be possible to access for that user.

I?ve tried disabling both directory leases and unix extensions but that doesn?t
cause any change of behaviour:

  smb3 directory leases = no
  smb3 unix extensions = no

- Peter