FFS writes to read-only mount

[David Cecil]

Hi,

I have seen the following message (or equivalent) occasionally on a 
FreeBSD 6.1 system:
g_vfs_done():mirror/gm0s1a[WRITE(offset=1349091328, length=16384)]error = 1

The partition in question is the root partition, and it is mounted 
read-only.  I have verified that the problem occurs due to the write 
request returning EPERM due to the check in g_io_check:
case BIO_WRITE:
case BIO_DELETE:
        if (cp->acw == 0)
            return (EPERM);

I have been trying to determine what within FFS would be trying to write 
to the partition.  The "bio_from" in the bio structure indicates (in the 
geom) that it's ffs.mirror/gm0s1a that's trying to write.  The contents 
of the buffer looks somewhat like a directory (lots of files listed, but 
comparison to the actual directory that contians these files reveals 
it's somewhat different), followed by a binary (ELF header).  However, 
I'm at a loss to understand who's actually doing the writing.  Is it 
coming from within FFS or is there an application that's done the 
write?  (I can't understand how an application would be permitted to do 
it though.)

I have seen this sort of problem (same error number) reported on the 
Internet occasionally, but it doesn't seem it's been satisfactorily 
resolved in all instances.

Any help you can provide would be much appreciated.

Thanks,
Dave