Dangers of fsync = off

[Joel Dice <dicej@xxxxxxxxxxxxx>]

Hello all.

It's clear from the documentation for the fsync configuration option that 
turning it off may lead to unrecoverable data corruption.  I'd like to 
learn more about why this is possible and how likely it really is.

A quick look at xlog.h reveals that each record in the transaction log 
contains a CRC checksum, a transaction ID, a length, etc..  Assuming the 
worst thing that can happen due to a crash is that the end of the log is 
filled with random garbage, there seems to be little danger that the 
recovery process will misinterpret any of that garbage as a valid 
transaction record, complete with matching checksum.

If my assumption is incorrect (i.e. garbage at the end of the log is not 
the worst that can happen), what else might happen, and how would this 
lead to unrecoverable corruption?  Also, are there any filesystems 
available which avoid such cases?

Sorry if this has been discussed before - in which case please point me to 
that discussion.

Thanks.

 - Joel