The ring-buffer map will not trigger a UM callback after a first subscribe/unsubscribe.

[gtrevi]

A UM application subscribing to a ring-buffer map will not receive events after being restarted after a first run, as from the EbpfCore traces, ebpf_ring_buffer_map_return_buffer will return an arithmetic exception in retrieving data from the ring-buffer.

22:29:43.602925700 Event: EbpfGenericMessage, Entry: ebpf_pinning_table_find
22:29:43.602927400 Event: EbpfSuccess, Message: ebpf_pinning_table_find returned success
22:29:43.602928100 Event: EbpfGenericMessage, Entry: ebpf_handle_create
22:29:43.602939200 Event: EbpfGenericMessage, Message: ebpf_handle_create: returning handle, value: 244
22:29:43.602939800 Event: EbpfSuccess, Message: ebpf_handle_create returned success
22:29:43.602940600 Event: EbpfSuccess, Message: ebpf_core_get_pinned_object returned success
22:29:43.602941100 Event: EbpfSuccess, Message: _ebpf_core_protocol_get_pinned_object returned success
22:29:43.602946900 Event: EbpfSuccess, Message: invoke_ioctl returned success
22:29:43.602951800 Event: EbpfReturn, __FSTREXP __FUNCTION__ " returned": ebpf_object_get returned, fd: 3
22:29:43.602956000 Event: EbpfGenericMessage, Entry: ebpf_ring_buffer_map_subscribe
22:29:43.602956500 Event: EbpfGenericMessage, Entry: ebpf_ring_buffer_map_subscribe
22:29:43.602964700 Event: EbpfGenericMessage, Entry: _ebpf_core_protocol_ring_buffer_map_query_buffer
22:29:43.603013900 Event: EbpfSuccess, Message: _ebpf_core_protocol_ring_buffer_map_query_buffer returned success
22:29:43.603017200 Event: EbpfSuccess, Message: invoke_ioctl returned success
22:29:43.603024000 Event: EbpfGenericMessage, Entry: register_wait_async_ioctl_operation
22:29:43.603026900 Event: EbpfSuccess, Message: register_wait_async_ioctl_operation returned success
22:29:43.603027500 Event: EbpfSuccess, Message: initialize_async_ioctl_operation returned success
22:29:43.603031000 Event: EbpfGenericMessage, Entry: ebpf_async_set_completion_callback
22:29:43.603032900 Event: EbpfSuccess, Message: ebpf_async_set_completion_callback returned success
22:29:43.603034300 Event: EbpfGenericMessage, Entry: ebpf_ring_buffer_map_return_buffer
22:29:43.603034800 Event: EbpfGenericError, ErrorMessage: ebpf_ring_buffer_map_return_buffer returned error, Error: 22
22:29:43.603037300 Event: EbpfApiError, Api: "ebpf_core_invoke_protocol_handler", status: {EXCEPTION}
Integer overflow.
22:29:43.603051500 Event: EbpfApiError, Api: DeviceIoControl, last_error: Overlapped I/O operation is in progress.
22:29:43.603052400 Event: EbpfGenericError, ErrorMessage: invoke_ioctl returned error, Error: 997
22:29:43.603053400 Event: EbpfSuccess, Message: ebpf_ring_buffer_map_subscribe returned success
22:29:43.603057500 Event: EbpfReturn, __FSTREXP __FUNCTION__ " returned": ring_buffer__new returned, local_ring_buffer: 0x24BA1339E00
22:29:43.603205500 Event: EbpfGenericMessage, Entry: _ebpf_ring_buffer_map_async_query_completion
22:29:43.603208800 Event: EbpfGenericError, ErrorMessage: _ebpf_ring_buffer_map_async_query_completion returned error, Error: 22