Fix panic handling in detached mode to return 500 instead of 499

Handler panics in HandlerTaskMode::Detached were incorrectly being
reported as 499 (Client Closed Request) instead of 500 (Internal
Server Error) in telemetry and traces.

This occurred because the panic handling code called panic::resume_unwind(),
which caused the request handling task to panic and trigger the disconnect
guard, leading to incorrect status code assignment.

Changes:
- Extract panic message from JoinError and convert to HttpError
- Return 500 Internal Server Error instead of propagating panic
- Add integration test to verify panic handling returns proper 500 status
- Preserve existing behavior for HandlerTaskMode::CancelOnDisconnect

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: nshalman

dropshot/src/server.rs

@@ -1,11 +1,12 @@
-// Copyright 2024 Oxide Computer Company
+// Copyright 2025 Oxide Computer Company
 //! Generic server-wide state and facilities
 
 use super::api_description::ApiDescription;
 use super::body::Body;
 use super::config::{ConfigDropshot, ConfigTls};
 #[cfg(feature = "usdt-probes")]
 use super::dtrace::probes;
+use super::error::HttpError;
 use super::handler::HandlerError;
 use super::handler::RequestContext;
 use super::http_util::HEADER_REQUEST_ID;
@@ -967,7 +968,10 @@ async fn http_request_handle<C: ServerContext>(
             match rx.await {
                 Ok(result) => result?,
                 Err(_) => {
-                    error!(request_log, "handler panicked; propogating panic");
+                    error!(
+                        request_log,
+                        "handler panicked; returning 500 error"
+                    );
 
                     // To get the panic, we now need to await `handler_task`; we
                     // know it is complete _and_ it failed, because it has
@@ -976,7 +980,27 @@ async fn http_request_handle<C: ServerContext>(
                     let task_err = handler_task.await.expect_err(
                         "task failed to send result but didn't panic",
                     );
-                    panic::resume_unwind(task_err.into_panic());
+
+                    // Extract panic message if possible
+                    let panic_msg = if task_err.is_panic() {
+                        match task_err.into_panic().downcast::<&'static str>() {
+                            Ok(s) => s.to_string(),
+                            Err(panic_any) => {
+                                match panic_any.downcast::<String>() {
+                                    Ok(s) => *s,
+                                    Err(_) => "handler panicked".to_string(),
+                                }
+                            }
+                        }
+                    } else {
+                        task_err.to_string()
+                    };
+
+                    // Instead of propagating the panic, return a 500 error
+                    // This ensures proper status code reporting (500 instead of 499)
+                    return Err(HandlerError::Dropshot(
+                        HttpError::for_internal_error(panic_msg),
+                    ));
                 }
             }
         }

dropshot/tests/integration-tests/main.rs

@@ -1,4 +1,4 @@
-// Copyright 2024 Oxide Computer Company
+// Copyright 2025 Oxide Computer Company
 
 //! Integration tests for Dropshot.
 //!
@@ -20,6 +20,7 @@ mod multipart;
 mod openapi;
 mod pagination;
 mod pagination_schema;
+mod panic_handling;
 mod path_names;
 mod starter;
 mod streaming;

dropshot/tests/integration-tests/panic_handling.rs

@@ -0,0 +1,85 @@
+// Copyright 2025 Oxide Computer Company
+
+//! Test cases for handler panic handling.
+
+use dropshot::endpoint;
+use dropshot::ApiDescription;
+use dropshot::HandlerTaskMode;
+use dropshot::HttpError;
+use dropshot::HttpResponseOk;
+use dropshot::RequestContext;
+use http::Method;
+use http::StatusCode;
+use schemars::JsonSchema;
+use serde::Serialize;
+
+use crate::common;
+
+#[derive(Debug, Serialize, JsonSchema)]
+struct EmptyResult {}
+
+#[endpoint {
+    method = GET,
+    path = "/panic",
+}]
+async fn handler_that_panics(
+    _rqctx: RequestContext<()>,
+) -> Result<HttpResponseOk<EmptyResult>, HttpError> {
+    panic!("test panic message");
+}
+
+#[tokio::test]
+async fn test_panic_handler_returns_500_in_detached_mode() {
+    let mut api = ApiDescription::new();
+    api.register(handler_that_panics).unwrap();
+
+    let testctx = common::test_setup_with_context(
+        "test_panic_handler_returns_500_in_detached_mode",
+        api,
+        (),
+        HandlerTaskMode::Detached,
+    );
+
+    testctx
+        .client_testctx
+        .make_request_error(
+            Method::GET,
+            "/panic",
+            StatusCode::INTERNAL_SERVER_ERROR,
+        )
+        .await;
+
+    testctx.teardown().await;
+}
+
+// Note: We cannot easily test CancelOnDisconnect mode panic behavior in a unit test
+// because panics propagate through the test harness and cause test failures.
+// The key difference is:
+// - Detached mode: Panics are caught and converted to 500 errors (tested above)
+// - CancelOnDisconnect mode: Panics propagate and crash the handler (as intended)
+// For now this test is just marked as should_panic.
+// TODO: Should this test be removed?
+#[tokio::test]
+#[should_panic]
+async fn test_panic_handler_returns_500_in_cancel_on_disconnect_mode() {
+    let mut api = ApiDescription::new();
+    api.register(handler_that_panics).unwrap();
+
+    let testctx = common::test_setup_with_context(
+        "test_panic_handler_returns_500_in_cancel_on_disconnect_mode",
+        api,
+        (),
+        HandlerTaskMode::CancelOnDisconnect,
+    );
+
+    testctx
+        .client_testctx
+        .make_request_error(
+            Method::GET,
+            "/panic",
+            StatusCode::INTERNAL_SERVER_ERROR,
+        )
+        .await;
+
+    testctx.teardown().await;
+}