[master] bc3f7515a cache_fetch: Fix bad assertion in vbf_objiterate()

[Nils Goroll]

commit bc3f7515a81aa3d85698816d295c1fee71fa1af7
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue Aug 12 11:17:14 2025 +0200

    cache_fetch: Fix bad assertion in vbf_objiterate()
    
    If we run into a storage error while copying the object body for a 304 response,
    the remaining length when seeing OBJ_ITER_END may be greater than zero.
    
    Fixes #4377

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 7cd779037..4ea54d9f9 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -819,7 +819,7 @@ vbf_objiterate(void *priv, unsigned flush, const void *ptr, ssize_t len)
 		len -= l;
 		vop->pl -= l;
 	}
-	if (flush)
+	if (flush && vop->bo->vfc->failed == 0)
 		AZ(vop->l);
 	return (0);
 }
diff --git a/bin/varnishtest/tests/r04377.vtc b/bin/varnishtest/tests/r04377.vtc
new file mode 100644
index 000000000..3847f7e21
--- /dev/null
+++ b/bin/varnishtest/tests/r04377.vtc
@@ -0,0 +1,39 @@
+varnishtest "storage failure with 304 response"
+
+server s1 {
+	rxreq
+	txresp -hdr {Etag: "abc"} -bodylen 2049
+
+	rxreq
+	txresp -status 304
+} -start
+
+varnish v1 \
+    -arg "-smalloc=malloc,1M" \
+    -arg "-scondfetch=debug,maxspace=1024B" \
+    -vcl+backend {
+	sub vcl_backend_response {
+		if (beresp.was_304) {
+			set beresp.storage = storage.condfetch;
+		}
+		set beresp.ttl = 0.001s;
+		set beresp.grace = 0s;
+		set beresp.keep = 1m;
+	}
+} -start
+
+varnish v1 -cliok "debug.fragfetch 2048"
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.bodylen == 2049
+
+	txreq
+	# we do not care that this is an error, the important point is not to
+	# panic
+	non_fatal
+	rxresp
+	expect resp.status == 200
+} -run