Did tar record the wrong inode number?

[Göran Uddeborg]

The issue: a large backup was made on the 3rd of June. After that, two
more backups have been made which should include only changes since
the large one. But the smaller backups includes a few file trees that
have not been changed. The output says they have been changed.

In some detail:

I'm doing backups using tar with a lot of flags

 --create --blocking-factor=64 --listed-incremental=New.time \
 --file=$DEVICE --multi-volume --verbose --totals \
 --exclude-from=$EXCLUDE --exclude-caches-all --ignore-failed-read \
 --label="Säkerhetskopia nivå $NEXT `date +'(%Y-%m-%d %T)'`." /

A level 10 backup was made in 2019.

A level 9 backup, with all changes since the level 10 backup was made
on the 3rd of June (this year).

A level 1 backup, with all changes since the level 9 backup, was made
on the 7th of June.

The level 1 backup includes some files that have not been changed in
the interim. Several of them (possibly all, but I'm not sure about
that) are in my home directory.

I've studied one in particular, the .wine directory. I'm quite sure I
didn't run wine during this period so it felt like a good example.

In the snapshot file from the level 1 backup (with nulls tr:ed to
newlines) it looks like this:

0
1668945173
0
64768
11943970
/home/göran/.wine

In the snapshot file from level 9 it looks like this:

0
1668945173
0
64768
3869307
/home/göran/.wine

In the snapshot file from level 10 it looks like this:

0
1523388637
0
64768
3869307
/home/göran/.wine

Doing "stat" on the directory gives this information:

mimmi$ LANG=en_US.utf8 stat /home/göran/.wine
  File: /home/göran/.wine
  Size: 4096            Blocks: 16         IO Block: 4096   directory
Device: fd00h/64768d    Inode: 11943970    Links: 4
Access: (2775/drwxrwsr-x)  Uid: ( 1003/  göran)   Gid: ( 1003/  göran)
Context: unconfined_u:object_r:wine_home_t:SystemLow
Access: 2023-06-13 04:42:19.000000000 +0200
Modify: 2022-11-20 12:52:53.000000000 +0100
Change: 2022-11-20 12:52:53.000000000 +0100
 Birth: -

That is
- The level 1 file agrees with what "stat" says.
- The level 10 file describes an earlier version of the tree. This is
  probably correct, I have probably removed and recreated my .wine
  tree during those years.
- The level 9 file has the timestamp of the current directory version,
  but has the inode number from the level 10 backup! I find this very
  strange.

I have a hard time believing the filesystem (ext4) has done this
change on its own. I suspect some kind of tar bug, even if I admit it
feels like a strange bug.

The level 9 backup was quite large, somewhere around 750 GB.

This is on a Fedora system with this build of tar:
tar-1.34-8.fc38.x86_64

If it is of interest, I can provide the snapshot files. I don't
consider those particularly sensitive.