END probes normally do not fire until tracing has been explicitly stopped by the DTrace consumer. END probes are guaranteed to only fire on one CPU, but the CPU on which the probe fires is undefined. With fill buffers, tracing is explicitly stopped when at least one of the per-CPU principal buffers has been marked as filled. If the fill policy is selected, the END probe may fire on a CPU that has a filled buffer. To accommodate END tracing in fill buffers, DTrace calculates the amount of space potentially consumed by END probes and subtracts this space from the size of the principal buffer. If the net size is negative, DTrace will refuse to start, and dtrace(1M) will output a corresponding error message:
dtrace: END enablings exceed size of principal buffer
The reservation mechanism ensures that a full buffer always has sufficient space for any END probes.