vn_fallocate() loops over VOP_ALLOCATE until the requested range has
been allocated, permitting partial results. It only asserts that each
pass makes progress, so on a non-INVARIANTS kernel a filesystem that
returns success without shrinking the remaining length leaves the caller
spinning forever.
Keep the assertion, but also return EIO in that case, as was just done
for vn_deallocate_impl(). The NFS server already does the same in its
own VOP_ALLOCATE loop.
Document the progress requirement in VOP_ALLOCATE(9) and the new EIO
condition in posix_fallocate(2).