/var is mounted over /dev/mapper/encstateful, encrypted loopback device over /mnt/stateful_partition/encrypted.block.

/mnt/stateful_partition/encrypted.block is a spare file, set at 30% of the stateful partition: In case of a 32GB device we have:

/dev/mmcblk0p1           25641188 3210624  21104996  14% /home  (~25GB)
/dev/mapper/encstateful   7538684  415644   7106656   6% /var   (~7.5GB)

Note that the storage is oversubscribe, we don't have 25 + 7.5 for both filesystem in the stateful partition, only 25GB.


Now, let's fill up /stateful:
fallocate -l 20GB /mnt/stateful_partition/filler.block

/dev/mmcblk0p1           25641188 22723268   1592352  94% /home
/dev/mapper/encstateful   7538684   416088   7106212   6% /var

There is only 1.5GB left in stateful, but /var claims there is over 7GB available.

As expected, adding 5GB in /home fails:
fallocate -l 5GB /mnt/stateful_partition/filler_2.block 
fallocate: fallocate failed: No space left on device


But it "works" in var:
localhost ~ # fallocate -l 5GB /var/log/filler_2.block

/dev/mmcblk0p1           25641188 25624804         0 100% /home
/dev/mapper/encstateful   7538684  5298888   2223412  71% /var

It just an impression, the loopback filesystem can not find block in the underlying partition.

[  452.691195] loop: Write error at byte offset 7995392, length 4096.
[  452.691301] EXT4-fs warning (device dm-1): ext4_end_bio:336: I/O error -28 writing to inode 65352 (offset 0 size 118784 starting block 1952)
[  452.691348] Buffer I/O error on device dm-1, logical block 1952
[  452.691402] Buffer I/O error on device dm-1, logical block 1953
[  452.691436] Buffer I/O error on device dm-1, logical block 1954
[  452.691470] Buffer I/O error on device dm-1, logical block 1955
[  452.691500] Buffer I/O error on device dm-1, logical block 1956
[  452.691530] Buffer I/O error on device dm-1, logical block 1957
[  452.691561] Buffer I/O error on device dm-1, logical block 1958
[  452.691593] Buffer I/O error on device dm-1, logical block 1959
[  452.691624] Buffer I/O error on device dm-1, logical block 1960
[  452.691653] Buffer I/O error on device dm-1, logical block 1961


Then, chrome and services (shill) stop working, get respawn.

At reboot, the machine is wiped.

Code where encrypted sparse backend file is created.
https://cs.corp.google.com/chromeos_public/src/platform2/cryptohome/mount-encrypted.c?rcl=d7b00fd7d70c339ccbe4a5c0a34fe06ee1b79c74&l=999

The sparse code comes from 
https://chromium-review.googlesource.com/c/16889/, where the file was still in src/platform/vboot_reference/utility/mount-encrypted.c


fallocate has been more advance over the years. By default it is not creating sparse file as it used to.