Right. So this is mostly just my own academic interest, in practice it is of
course real crashes/powerfailures we want to handle, not SIGKILL.

If you are interested, this is my thinking: the server always does a write(2)
system call on the binlog at (group) commit, even with sync_binlog=0. So even
if we SIGKILL the server, the data is still in the kernel buffers (at least on
Linux), and will eventually reach disk.

I'm interested, and I learn too, thanks!

However, you are using DRBD. I am guessing that when mysqld on one node dies,
a failover is done to the other node, and this looses data in the kernel disk
buffers on the first node that have not been fdatasync()'ed.

I think you're right. I know that DRBD is not the best choice to have high-availibility on a MariaDB master, but I have my reasons to make this choice.... What could be the best settings in MariaDB and DRBD to handle this situation ?

In DRBD, I just set protocol B which should be sufficient, but I can easily test with C. I have test some disk options like no-disk-barrier no-disk-flushes no-md-flushes use-bmbv and yes I tried too no-disk-drain ...

In MariaDB I set :

innodb_flush_log_at_trx_commit = 1

sync_binlog = 1

innodb_file_per_table = 1

I can test things, patchs, but I don't know what ... I didn't found WL#4925 patch so I can't test it.