Yanming, [...] > Specifically, in hv_balloon I have observed of a dm_unballoon_request > message of 4096 bytes being truncated to 4080 bytes. When the driver > tries to read next packet it starts from the wrong read_index, receives > garbage and prints a lot of "Unhandled message: type: <garbage>" in > dmesg. To make sure I understand your observations: Can you please print/share the values of (desc->len8 << 3) and (desc->offset8 << 3) for such a "truncated" packet, say, right after the desc = hv_pkt_iter_first(channel); in hv_ringbuffer_read()? Also, it'd be interesting to know whether any of the two validations on pkt_len and pkt_offset in hv_pkt_iter_first() fails (so that pkt_len/pkt_offset get updated in there). Thanks, Andrea