syzbot


Fatal trap NUM: page fault in mld_change_state

Status: upstream: reported on 2025/03/01 23:46
Reported-by: syzbot+0375ef1e774d247be26e@syzkaller.appspotmail.com
First crash: 288d, last: 19d

Sample crash report:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x28
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff81aee14e
stack pointer	        = 0x28:0xfffffe0056ef9240
frame pointer	        = 0x28:0xfffffe0056ef93d0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 972 (syz-executor)
rdi: 0000000000000028 rsi: 00000000000082d6 rdx: 0000000000000000
rcx: fffffe0002bf1850  r8: 0000000000000000  r9: 0000000000000001
rax: fffffe0000000000 rbx: 1fffffc00addf250 rbp: fffffe0056ef93d0
r10: 0000000000000000 r11: 0000000000000033 r12: fffffe0059783410
r13: dffff7c000000000 r14: 0000000000000000 r15: fffffe006e849000
trap number		= 12
panic: page fault
cpuid = 1
time = 1764105633
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056ef8a70
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056ef8bd0
vpanic() at vpanic+0x257/frame 0xfffffe0056ef8d90
panic() at panic+0xb5/frame 0xfffffe0056ef8e50
trap_pfault() at trap_pfault+0xaf2/frame 0xfffffe0056ef8f90
trap() at trap+0x784/frame 0xfffffe0056ef9170
calltrap() at calltrap+0x8/frame 0xfffffe0056ef9170
--- trap 0xc, rip = 0xffffffff81aee14e, rsp = 0xfffffe0056ef9240, rbp = 0xfffffe0056ef93d0 ---
mld_change_state() at mld_change_state+0x13e/frame 0xfffffe0056ef93d0
in6_leavegroup_locked() at in6_leavegroup_locked+0x17b/frame 0xfffffe0056ef9500
ip6_freemoptions() at ip6_freemoptions+0x282/frame 0xfffffe0056ef9560
in_pcbfree() at in_pcbfree+0x682/frame 0xfffffe0056ef95b0
sorele_locked() at sorele_locked+0x264/frame 0xfffffe0056ef95f0
soclose() at soclose+0x41f/frame 0xfffffe0056ef96e0
_fdrop() at _fdrop+0x5c/frame 0xfffffe0056ef9710
closef() at closef+0x655/frame 0xfffffe0056ef98f0
fdescfree() at fdescfree+0xa5e/frame 0xfffffe0056ef9ad0
fork1() at fork1+0x833/frame 0xfffffe0056ef9bf0
sys_rfork() at sys_rfork+0x1b7/frame 0xfffffe0056ef9d10
amd64_syscall() at amd64_syscall+0x4e2/frame 0xfffffe0056ef9f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0056ef9f30
--- syscall (198, FreeBSD ELF64, __syscall), rip = 0x3a6e9a, rsp = 0x82555bf08, rbp = 0x82555bf80 ---
KDB: enter: panic
[ thread pid 972 tid 100302 ]
Stopped at      kdb_enter+0x6e: movq    $0,0x258d767(%rip)
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs                        0x20
ds                        0x3b
es                        0x3b
fs                        0x13
gs                        0x1b
ss                        0x28
rax                       0x12
rcx         0xfffffe0077e00000
rdx                    0x7ffff
rbx         0xffffffff82831be0  .str.27
rsp         0xfffffe0056ef8bb0
rbp         0xfffffe0056ef8bd0
rsi                    0x80001
rdi         0xffffffff8165b449  printf+0x149
r8                           0
r9                  0xffffffff
r10                          0
r11                       0x17
r12         0xfffffe00586c6780
r13         0xfffffffffffffffd
r14         0xffffffff82831be0  .str.27
r15                          0
rip         0xffffffff8164482e  kdb_enter+0x6e
rflags                    0x46
kdb_enter+0x6e: movq    $0,0x258d767(%rip)
db> show proc
Process 972 (syz-executor) at 0xfffffe00586fd558:
 state: NORMAL
 uid: 0 gid: 0 supp gids: 0, 5
 parent: pid 855 at 0xfffffe00586fe008
 ABI: FreeBSD ELF64
 flag: 0x10580080  flag2: 0x1
 arguments: ./syz-executor exec
 reaper: 0xfffffe0007809010 reapsubtree: 1
 sigparent: 20
 vmspace: 0xfffffe00586b0490
   (map 0xfffffe00586b0490)
   (map.pmap 0xfffffe00586b0530)
   (pmap 0xfffffe00586b05a0)
 threads: 2
100111                   s                                   syz-executor
100302                   Run     CPU 1                       syz-executor
db> ps
  pid  ppid  pgrp   uid  state   wmesg   wchan               cmd
  979   763   763     0  R       (threaded)                  syz-executor
100305                   RunQ                                syz-executor
100314                   RunQ                                syz-executor
100315                   D       voffloc 0xfffffe0058711b1a  syz-executor
  977   765   765     0  R       (threaded)                  syz-executor
100276                   RunQ                                syz-executor
100309                   RunQ                                syz-executor
100310                   S       uwait   0xfffffe005830cd00  syz-executor
  972   855   855     0  T       (threaded)                  syz-executor
100111                   s                                   syz-executor
100302                   Run     CPU 1                       syz-executor
  971     1   971     0  L      *mld_mtx 0xfffffe00079f9540  syz-executor
  970     1   763     0  S       uwait   0xfffffe005858e800  syz-executor
  969     1   763     0  S       uwait   0xfffffe005858f280  syz-executor
  964     1   855     0  S       uwait   0xfffffe005830cf00  syz-executor
  951     1   855     0  S       uwait   0xfffffe005830a780  syz-executor
  946     1   763     0  S       uwait   0xfffffe005830b100  syz-executor
  941     1   763     0  S       uwait   0xfffffe005858f000  syz-executor
  940     1   763     0  S       uwait   0xfffffe005830a500  syz-executor
  905     1   763     0  S       uwait   0xfffffe005830a080  syz-executor
  879     0     0     0  DL      -       0xffffffff83cd3200  [soaiod4]
  878     0     0     0  DL      -       0xffffffff83cd3200  [soaiod3]
  877     0     0     0  DL      -       0xffffffff83cd3200  [soaiod2]
  876     0     0     0  DL      -       0xffffffff83cd3200  [soaiod1]
  875     1   763     0  S       uwait   0xfffffe005830b400  syz-executor
  860     1   860     0  Ss+     ttyin   0xfffffe00583274b0  getty
  856     1   856     0  Ss+     ttyin   0xfffffe00583278b0  getty
  855     1   855     0  R                                   syz-executor
  851     1   851     0  Ss+     ttyin   0xfffffe00583270b0  getty
  849     1   763     0  S       uwait   0xfffffe005858eb00  syz-executor
  846     1   846     0  Ss+     ttyin   0xfffffe00542678b0  getty
  842     1   842     0  Ss+     ttyin   0xfffffe00542670b0  getty
  838     1   838     0  Ss+     ttyin   0xfffffe0058327cb0  getty
  836     1   764 60928  S       uwait   0xfffffe005830b600  syz-executor
  835     1   835     0  Ss+     ttyin   0xfffffe00542674b0  getty
  834     1   834     0  Rs+                                 getty
  833     1   833     0  Ss+     ttyin   0xfffffe0054266cb0  getty
  825     0     0     0  DL      aiordy  0xfffffe0058707568  [aiod4]
  824     0     0     0  DL      aiordy  0xfffffe0058707ac0  [aiod3]
  823     0     0     0  DL      aiordy  0xfffffe00586fe560  [aiod2]
  822     0     0     0  DL      aiordy  0xfffffe0058705000  [aiod1]
  819   805   819     0  Ss      select  0xfffffe0007787bc0  dhclient
  818     0     0     0  DL      (threaded)                  [KTLS]
100130                   D       -       0xfffffe0059709100  [thr_0]
100131                   D       -       0xfffffe0059709180  [thr_1]
100132                   D       -       0xffffffff83cd4a28  [reclaim_0]
  805   784   423    65  S       select  0xfffffe0007787f40  dhclient
  784     1   423     0  S       wait    0xfffffe00586cc570  sh
  765     1   765     0  R                                   syz-executor
  763     1   763     0  R                                   syz-executor
  758     1   758     0  REs     CPU 0                       sshd
  736     1    17     0  S+      nanslp  0xffffffff83bb3000  sleep
   16     0     0     0  DL      syncer  0xffffffff83ce0c20  [syncer]
   15     0     0     0  DL      vlruwt  0xfffffe0058602558  [vnlru]
   14     0     0     0  DL      (threaded)                  [bufdaemon]
100079                   D       psleep  0xffffffff83cdf160  [bufdaemon]
100082                   D       -       0xffffffff83001ec0  [bufspacedaemon-0]
100095                   D       getblk  0xfffffe0007c02ba0  [/ worker]
    9     0     0     0  DL      psleep  0xffffffff83d204c0  [vmdaemon]
    8     0     0     0  DL      (threaded)                  [pagedaemon]
100077                   D       psleep  0xffffffff83d06588  [dom0]
100080                   D       launds  0xffffffff83d06594  [laundry: dom0]
100081                   D       umarcl  0xffffffff81e2eb00  [uma]
    7     0     0     0  RL                                  [rand_harvestq]
    6     0     0     0  DL      pftm    0xffffffff8485ef60  [pf purge]
    5     0     0     0  DL      waiting 0xffffffff8455d700  [sctp_iterator]
    4     0     0     0  DL      (threaded)                  [cam]
100045                   D       -       0xffffffff838f5340  [doneq0]
100046                   D       -       0xffffffff838f52c0  [async]
100075                   D       -       0xffffffff838f5140  [scanner]
    3     0     0     0  DL      (threaded)                  [crypto]
100042                   D       crypto_ 0xffffffff83d01e20  [crypto]
100043                   D       crypto_ 0xfffffe0007b17030  [crypto returns 0]
100044                   D       crypto_ 0xfffffe0007b17080  [crypto returns 1]
   13     0     0     0  DL      (threaded)                  [geom]
100037                   D       -       0xffffffff83b5b5e0  [g_event]
100038                   D       -       0xffffffff83b5b600  [g_up]
100039                   D       -       0xffffffff83b5b620  [g_down]
    2     0     0     0  LL      (threaded)                  [clock]
100031                   L      *in6_mul 0xfffffe0007805a80  [clock (0)]
100032                   I                                   [clock (1)]
   12     0     0     0  WL      (threaded)                  [intr]
100013                   I                                   [swi6: task queue]
100014                   I                                   [swi6: Giant taskq]
100016                   I                                   [swi5: fast taskq]
100033                   I                                   [swi1: netisr 0]
100034                   I                                   [swi1: hpts]
100035                   I                                   [swi1: hpts]
100047                   I                                   [irq24: virtio_pci0]
100048                   I                                   [irq25: virtio_pci0]
100049                   I                                   [irq26: virtio_pci0]
100050                   I                                   [irq27: virtio_pci0]
100051                   I                                   [irq28: virtio_pci1]
100052                   I                                   [irq29: virtio_pci1]
100053                   I                                   [irq30: virtio_pci1]
100054                   I                                   [irq31: virtio_pci1]
100055                   I                                   [irq32: virtio_pci1]
100060                   I                                   [irq10: virtio_pci2]
100062                   I                                   [irq1: atkbd0]
100063                   I                                   [irq12: psm0]
100064                   I                                   [swi0: uart uart++]
100068                   I                                   [swi1: pf send]
   11     0     0     0  RL      (threaded)                  [idle]
100003                   CanRun                              [idle: cpu0]
100004                   CanRun                              [idle: cpu1]
    1     0     1     0  SLs     wait    0xfffffe0007809010  [init]
   10     0     0     0  DL      audit_w 0xffffffff83d028c0  [audit]
    0     0     0     0  DLs     (threaded)                  [kernel]
100000                   D       parked  0xffffffff84c57ff0  [swapper]
100005                   D       -       0xfffffe00077f7a00  [softirq_0]
100006                   D       -       0xfffffe00077f7800  [softirq_1]
100007                   D       -       0xfffffe00077f7600  [if_io_tqg_0]
100008                   D       -       0xfffffe00077f7400  [if_io_tqg_1]
100009                   D       -       0xfffffe00077f7200  [if_config_tqg_0]
100010                   D       -       0xfffffe00077f7000  [kqueue_ctx taskq]
100011                   D       -       0xfffffe00077f6d00  [jail_remove taskq]
100012                   D       -       0xfffffe00077f6b00  [bus taskq]
100015                   D       -       0xfffffe00077f6500  [thread taskq]
100017                   D       -       0xfffffe00077f6100  [aiod_kick taskq]
100018                   D       -       0xfffffe00077f5e00  [deferred_unmount ta]
100019                   D       -       0xfffffe00077f5c00  [inm_free taskq]
100020                   D       -       0xfffffe00077f5a00  [in6m_free taskq]
100021                   D       -       0xfffffe00077f5800  [linuxkpi_irq_wq]
100022                   D       -       0xfffffe00077f5600  [linuxkpi_short_wq_0]
100023                   D       -       0xfffffe00077f5600  [linuxkpi_short_wq_1]
100024                   D       -       0xfffffe00077f5600  [linuxkpi_short_wq_2]
100025                   D       -       0xfffffe00077f5600  [linuxkpi_short_wq_3]
100026                   D       -       0xfffffe00077f5100  [linuxkpi_long_wq_0]
100027                   D       -       0xfffffe00077f5100  [linuxkpi_long_wq_1]
100028                   D       -       0xfffffe00077f5100  [linuxkpi_long_wq_2]
100029                   D       -       0xfffffe00077f5100  [linuxkpi_long_wq_3]
100036                   D       -       0xfffffe00077f4400  [firmware taskq]
100040                   D       -       0xfffffe0007bcc100  [crypto_0]
100041                   D       -       0xfffffe0007bcc100  [crypto_1]
100056                   D       -       0xfffffe00077f8200  [vtnet0 rxq 0]
100057                   D       -       0xfffffe00541f6500  [vtnet0 txq 0]
100058                   D       -       0xfffffe00541f6400  [vtnet0 rxq 1]
100059                   D       -       0xfffffe00541f6300  [vtnet0 txq 1]
100061                   D       vtbslp  0xfffffe00580bf000  [virtio_balloon]
100065                   D       -       0xffffffff828362c0  [deadlkres]
100069                   D       -       0xfffffe0058595000  [acpi_task_0]
100070                   D       -       0xfffffe0058595000  [acpi_task_1]
100071                   D       -       0xfffffe0058595000  [acpi_task_2]
100073                   D       -       0xfffffe00077f8100  [mca taskq]
100074                   D       -       0xfffffe0007bcba00  [CAM taskq]
100076                   D       -       0xfffffe0007bcc700  [ipsec_offload]
100274                   D       -       0xfffffe006e81b000  [netlink_socket (PID]
db> show all locks
Process 979 (syz-executor) thread 0xfffffe005870d780 (100314)
exclusive lockmgr bufwait (bufwait) r = 0 (0xfffffe0007c02ba0) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_bio.c:4024
exclusive lockmgr ufs (ufs) r = 0 (0xfffffe0076d75598) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_vnops.c:1315
Process 972 (syz-executor) thread 0xfffffe00586c6780 (100302)
exclusive sleep mutex mld_mtx (mld_mtx) r = 0 (0xffffffff83cfd560) locked @ /syzkaller/managers/main/kernel/sys/netinet6/mld6.c:1901
exclusive sleep mutex in6_multi_list_mtx (in6_multi_list_mtx) r = 0 (0xffffffff83cfd140) locked @ /syzkaller/managers/main/kernel/sys/netinet6/in6_mcast.c:1387
exclusive sx in6_multi_sx (in6_multi_sx) r = 0 (0xffffffff83cfd180) locked @ /syzkaller/managers/main/kernel/sys/netinet6/in6_mcast.c:1330
Process 971 (syz-executor) thread 0xfffffe0058716780 (100125)
shared lockmgr devfs (devfs) r = 0 (0xfffffe00596f8908) locked @ /syzkaller/managers/main/kernel/sys/fs/devfs/devfs_vnops.c:386
Process 758 (sshd) thread 0xfffffe0058611000 (100089)
exclusive rw pmap pv list (pmap pv list) r = 0 (0xfffffe00074c7580) locked @ /syzkaller/managers/main/kernel/sys/amd64/amd64/pmap.c:8616
exclusive sleep mutex pmap (pmap) r = 0 (0xfffffe0007811358) locked @ /syzkaller/managers/main/kernel/sys/amd64/amd64/pmap.c:8526
Process 14 (bufdaemon) thread 0xfffffe00586ba000 (100095)
exclusive lockmgr ufs (ufs) r = 0 (0xfffffe006e059598) locked @ /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:3395
Process 2 (clock) thread 0xfffffe000781a780 (100031)
shared rw vnet_rwlock (vnet_rwlock) r = 0 (0xffffffff83ce5240) locked @ /syzkaller/managers/main/kernel/sys/netinet6/mld6.c:1307
db> show malloc
              Type        InUse        MemUse     Requests
           pf_hash            6        12804K            6
            linker          408         5598K          688
          tcp_hpts            8         4865K            8
            devbuf         4187         4324K         4212
         sysctloid        35270         2078K        35345
             vtbuf           24         1968K           46
              kobj          335         1340K          501
            newblk            5         1025K         2046
          vfscache            3         1025K            3
               pcb           33          678K          127
          inodedep           11          516K          340
         ufs_quota            1          512K            1
          vfs_hash            1          512K            1
           callout            2          512K            2
              intr            4          472K            4
           subproc          126          258K         1049
          filedesc           32          257K          361
         vnet_data            2          224K            2
          acpitask            1          224K            1
            KTRACE          101          201K         8310
            acpica         1674          184K        56983
              vmem            5          144K            7
           tidhash            3          141K            3
           pagedep            8          130K          152
        tfo_ccache            1          128K            1
          IP reass            1          128K            1
            DEVFS1          107          107K          141
               sem            4          106K            4
        gtaskqueue           18           98K           18
               LRO           32           95K           42
               bus         1016           83K         5174
          mtx_pool            3           74K            3
          syncache            1           68K            1
     NFSD srvcache            3           68K            3
            module          528           66K          533
       ddb_capture            1           64K            1
           kdtrace          197           39K         1297
              umtx          304           38K          304
         hostcache            1           32K            1
               shm            1           32K            3
            DEVFS3          126           32K          141
               msg            4           30K            4
            kbdmux            6           28K            6
          routetbl          392           25K         1122
              temp           33           21K         3544
        DEVFS_RULE           56           20K           56
            ifaddr           73           20K          120
               BPF           14           19K           30
         ufs_mount            4           17K            5
              proc            3           17K            3
               tty           16           16K           16
           lltable           48           15K           89
           ithread           90           15K           90
            bus-sc           34           15K         1693
             ifnet            8           15K           13
      eventhandler          163           14K          163
       ether_multi          162           13K          324
              kenv           95           12K           95
             shmfd            7           11K            9
              GEOM           49           11K          431
         CAM queue            5           11K         1528
              rman           82           10K          447
               rpc            8            9K            8
         in6_multi           66            9K          117
              cred           23            9K          220
         bmsafemap            2            9K          287
           devstat            4            9K            4
              UART           12            9K           12
              ksem            1            8K            2
       pfs_vncache            1            8K            1
     audit_evclass          240            8K          306
            plimit           20            8K          527
         taskqueue           72            8K           84
            sglist            6            7K            6
           CAM DEV            3            6K          510
          pf_ifnet           15            6K           45
         pfs_nodes           22            6K           22
       ufs_dirhash           24            5K           27
               UMA          270            5K          270
                vt           11            5K           11
           memdesc            1            4K            1
               MCA           32            4K           32
             evdev            4            4K            4
            kqueue           60            4K         1099
           pwddesc           57            4K         1062
           acpisem           28            4K           28
            DEVFSP           53            4K          133
          kcovinfo           45            3K           90
          terminal           11            3K           11
           uidinfo            5            3K           15
           acpidev           20            3K           20
             hhook            8            3K           10
         sctp_atcl            6            3K           24
             clone            9            3K            9
          sctp_ifa           17            3K           24
           netlink            2            3K          171
             lockf           18            3K          107
         sctp_stro            2            2K            2
        local_apic            1            2K            1
           io_apic            1            2K            1
         ipsec-saq            2            2K            2
         proc-args           69            2K         2173
            ip6ndp           13            2K           24
               tun            5            2K           10
           session           15            2K           50
          in_multi            7            2K           16
            Unitno           28            2K           84
           CAM XPT           22            2K          543
         toponodes            6            2K            6
       ipsecpolicy            2            2K            2
               msi            9            2K            9
          freework            5            2K          354
           softdep            1            1K            1
            dirrem            4            1K          207
          freeblks            4            1K          164
            sahead            1            1K            1
          secasvar            1            1K            1
             nhops            6            1K            8
       vnodemarker            2            1K           42
      NFSD session            1            1K            1
               mld            7            1K           12
        CAM periph            4            1K          271
          sctp_ifn            6            1K           24
             ipsec            3            1K            3
            diradd            6            1K          250
              igmp            6            1K           11
              pfil            6            1K            6
               iov            2            1K        15105
            isadev            6            1K            8
             mount           16            1K          163
          pci_link           10            1K           10
            crypto            4            1K           26
            CC Mem            5            1K           59
 encap_export_host           12            1K           12
               osd           10            1K           76
       inpcbpolicy           17            1K          372
          freefile            4            1K          178
            ip6opt            2            1K           13
              cdev            2            1K            2
       lkpikmalloc            8            1K            9
      counter_rate           13            1K           13
    chacha20random            1            1K            1
            biobuf            1            1K            1
         sctp_atky            8            1K           26
             frag6            4            1K            4
             selfd            5            1K        23660
         newdirblk            2            1K          128
             mkdir            2            1K          256
          freefrag            2            1K          344
            vnodes            1            1K            5
              ktls            1            1K           10
            select            2            1K           39
      NFSD lckfile            1            1K            1
     NFSD V4client            1            1K            1
             DEVFS            9            1K           10
           CAM SIM            2            1K            2
           tcpfunc            3            1K            3
        in_mfilter            4            1K            6
        loginclass            3            1K            5
            prison            6            1K            6
         cryptodev            2            1K           79
         sctp_aadr            2            1K            7
          nexusdev            8            1K            8
            apmdev            1            1K            1
          atkbddev            2            1K            2
       in6_mfilter            2            1K            6
        ip_msource            2            1K            2
       ip_moptions            2            1K            5
           VN POLL            1            1K            5
               aio            4            1K            5
          pmchooks            1            1K            1
          CAM path            4            1K         1034
     CAM dev queue            2            1K            2
 CAM I/O Scheduler            1            1K            1
          filecaps            4            1K           76
         sctp_athm            6            1K           24
          sctp_vrf            1            1K            1
          sctp_map            4            1K            4
       ip6_msource            1            1K            3
              vnet            1            1K            1
               pmc            1            1K            1
           entropy            2            1K           39
          acpiintr            1            1K            1
              cpus            2            1K            2
      ip6_moptions            1            1K            4
    vnet_data_free            1            1K            1
           Per-cpu            1            1K            1
          p1003.1b            1            1K            1
        ext2_mount            0            0K            0
         ext2_node            0            0K            0
      ext2_extents            0            0K            0
          pf_table            0            0K            0
                pf            0            0K            0
           pf_rule            0            0K            1
           pf_altq            0            0K            0
           pf_osfp            0            0K            0
     pf_krule_item            0            0K            0
           pf_temp            0            0K            0
      tcp_pcm_rack            0            0K            0
       tcp_do_rack            0            0K            0
      tcp_fsb_rack            0            0K            0
            mqdata            0            0K            0
        sctp_mcore            0            0K            0
        sctp_socko            0            0K            4
         sctp_iter            0            0K           32
         sctp_mvrf            0            0K            0
         sctp_timw            0            0K            0
         sctp_cpal            0            0K            0
         sctp_cmsg            0            0K            0
         sctp_stre            0            0K            0
         sctp_athi            0            0K            0
         sctp_a_it            0            0K           32
         sctp_stri            0            0K            0
           filemon            0            0K            3
            ipcomp            0            0K            0
               esp            0            0K            0
                ah            0            0K            0
        madt_table            0            0K            2
          smartpqi            0            0K            0
               ixl            0            0K            0
        ice-resmgr            0            0K            0
         ice-osdep            0            0K            0
               ice            0            0K            0
              iavf            0            0K            0
             axgbe            0            0K            0
       fpukern_ctx            0            0K            0
          xen_intr            0            0K            0
           xen_hvm            0            0K            0
         legacydrv            0            0K            0
      NMI handlers            0            0K            0
            bounce            0            0K            0
            busdma            0            0K            0
            qpidrv            0            0K            0
      dmar_idpgtbl            0            0K            0
          dmar_dom            0            0K            0
          dmar_ctx            0            0K            0
      amdiommu_dom            0            0K            0
      amdiommu_ctx            0            0K            0
              isci            0            0K            0
      iommu_dmamap            0            0K            0
     hyperv_socket            0            0K            0
           bxe_ilt            0            0K            0
        aesni_data            0            0K            3
            xenbus            0            0K            0
     vm_fictitious            0            0K            0
           UMAHash            0            0K            0
         vm_pgdata            0            0K            0
           jblocks            0            0K            0
          savedino            0            0K          633
          sentinel            0            0K            0
            jfsync            0            0K            0
            jtrunc            0            0K            0
             sbdep            0            0K           20
           jsegdep            0            0K            0
              jseg            0            0K            0
         jfreefrag            0            0K            0
          jfreeblk            0            0K            0
           jnewblk            0            0K            0
            jmvref            0            0K            0
           jremref            0            0K            0
           jaddref            0            0K            0
           freedep            0            0K            0
        allocindir            0            0K            0
          indirdep            0            0K          113
       allocdirect            0            0K            0
          ufs_trim            0            0K            0
           mactemp            0            0K            0
     audit_trigger            0            0K            0
 audit_pipe_presel            0            0K            0
     audit_pipeent            0            0K            0
        audit_pipe            0            0K            0
      audit_evname            0            0K            0
         audit_bsm            0            0K            0
      audit_gidset            0            0K            0
        audit_text            0            0K            0
        audit_path            0            0K            0
        audit_data            0            0K            0
        audit_cred            0            0K            0
          ktls_ocf            0            0K            2
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
      MLX5E_TLS_RX            0            0K            0
        MLX5EEPROM            0            0K            0
         MLX5E_TLS            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
            MLX5EN            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
          MLX5DUMP            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
       simple_attr            0            0K            0
          seq_file            0            0K            0
           lkpiskb            0            0K            0
             radix            0            0K            0
               idr            0            0K            0
          lkpindev            0            0K            0
           lkpimhi            0            0K            0
            lkpifw            0            0K            0
         lkpi80211            0            0K            0
               NLM            0            0K            0
    ipsec-spdcache            0            0K            0
         ipsec-reg            0            0K            0
        ipsec-misc            0            0K           10
      ipsecrequest            0            0K            0
            tcplog            0            0K            0
        tcp_hwpace            0            0K            0
              ipid            0            0K            0
         80211scan            0            0K            0
      80211ratectl            0            0K            0
        80211power            0            0K            0
       80211nodeie            0            0K            0
         80211node            0            0K            0
      80211mesh_gt            0            0K            0
      80211mesh_rt            0            0K            0
         80211perr            0            0K            0
         80211prep            0            0K            0
         80211preq            0            0K            0
          80211dfs            0            0K            0
       80211crypto            0            0K            0
          80211vap            0            0K            0
             iflib            0            0K            0
              vlan            0            0K            0
               gif            0            0K            0
           ifdescr            0            0K            0
              zlib            0            0K           26
           fadvise            0            0K            2
            statfs            0            0K          186
     namei_tracker            0            0K            0
           inotify            0            0K            9
       export_host            0            0K            0
        cl_savebuf            0            0K          101
               lio            0            0K            3
               acl            0            0K            0
            soname            0            0K         3393
          mbuf_tag            0            0K            0
              accf            0            0K            0
               pts            0            0K            0
           timerfd            0            0K            0
          procdesc            0            0K            8
          ioctlops            0            0K          116
           eventfd            0            0K            0
           Witness            0            0K            0
             stack            0            0K            0
              sbuf            0            0K          394
          firmware            0            0K            0
        compressor            0            0K            0
              SWAP            0            0K            0
         sysctltmp            0            0K          669
            sysctl            0            0K            3
              ekcd            0            0K            0
            dumper            0            0K            0
          sendfile            0            0K            4
              rctl            0            0K            0
             cache            0            0K            0
             kexec            0            0K            0
          jaildesc            0            0K            0
      prison_racct            0            0K            0
       Fail Points            0            0K            0
             sigio            0            0K            3
filedesc_to_leader            0            0K            1
               pwd            0            0K            0
       tty console            0            0K            0
         boottrace            0            0K            0
        isofs_node            0            0K            0
       isofs_mount            0            0K            0
     tr_raid5_data            0            0K            0
    tr_raid1e_data            0            0K            0
     tr_raid1_data            0            0K            0
     tr_raid0_data            0            0K            0
    tr_concat_data            0            0K            0
       md_sii_data            0            0K            0
   md_promise_data            0            0K            0
    md_nvidia_data            0            0K            0
   md_jmicron_data            0            0K            0
     md_intel_data            0            0K            0
       md_ddf_data            0            0K            0
         raid_data            0            0K           72
     geom_flashmap            0            0K            0
         tmpfs dir            0            0K            0
        tmpfs name            0            0K            0
       tmpfs mount            0            0K            0
     tmpfs extattr            0            0K            0
           NFS FHA            0            0K            0
         newnfsmnt            0            0K            0
  newnfsclient_req            0            0K            0
   NFSCL layrecall            0            0K            0
     NFSCL session            0            0K            0
     NFSCL sockreq            0            0K            0
     NFSCL devinfo            0            0K            0
     NFSCL flayout            0            0K            0
      NFSCL layout            0            0K            0
     NFSD rollback            0            0K            0
      NFSCL diroff            0            0K            0
        NEWNFSnode            0            0K            0
         NFSCL lck            0            0K            0
      NFSCL lckown            0            0K            0
      NFSCL client            0            0K            0
       NFSCL deleg            0            0K            0
        NFSCL open            0            0K            0
       NFSCL owner            0            0K            0
            NFS fh            0            0K            0
           NFS req            0            0K            0
     NFSD usrgroup            0            0K            0
       NFSD string            0            0K            0
       NFSD V4lock            0            0K            0
      NFSD V4state            0            0K            0
       msdosfs_fat            0            0K            0
     msdosfs_mount            0            0K            0
      msdosfs_node            0            0K            0
            DEVFS4            0            0K            0
            DEVFS2            0            0K            0
            gntdev            0            0K            0
       privcmd_dev            0            0K            0
        evtchn_dev            0            0K            0
          xenstore            0            0K            0
               xnb            0            0K            0
          xen_acpi            0            0K            0
              xbbd            0            0K            0
               xbd            0            0K            0
           Balloon            0            0K            0
          sysmouse            0            0K            0
            vtfont            0            0K            0
            pvscsi            0            0K            0
            USBdev            0            0K            0
               USB            0            0K            0
            ufshci            0            0K            0
            twsbuf            0            0K            0
        tpm_buffer            0            0K            0
       tcp_log_dev            0            0K            0
      midi buffers            0            0K            0
             mixer            0            0K            0
            feeder            0            0K            0
              ac97            0            0K            0
             hdacc            0            0K            0
              hdac            0            0K            0
              hdaa            0            0K            0
       SIIS driver            0            0K            0
               PUC            0            0K            0
          ppbusdev            0            0K            0
            sr_iov            0            0K            0
               OCS            0            0K            0
               OCS            0            0K            0
              nvme            0            0K            0
               nvd            0            0K            0
            netmap            0            0K            0
            mwldev            0            0K            0
        MVS driver            0            0K            0
         mpi3mrbuf            0            0K            0
          mrsasbuf            0            0K            0
          mpt_user            0            0K            0
          mps_user            0            0K            0
            MPSSAS            0            0K            0
               mps            0            0K            0
          mpr_user            0            0K            0
            MPRSAS            0            0K            0
               mpr            0            0K            0
            mfibuf            0            0K            0
        md_sectors            0            0K            0
           md_disk            0            0K            0
           malodev            0            0K            0
               LED            0            0K            0
          ix_sriov            0            0K            0
                ix            0            0K            0
            ipsbuf            0            0K            0
         ciss_data            0            0K            0
         BACKLIGHT            0            0K            0
           ath_hal            0            0K            0
            athdev            0            0K            0
           ata_pci            0            0K            0
           ata_dma            0            0K            0
       ata_generic            0            0K            0
       AHCI driver            0            0K            0
               agp            0            0K            0
           acpipwr            0            0K            0
         acpi_perf            0            0K            0
         acpicmbat            0            0K            0
        aacraidcam            0            0K            0
       aacraid_buf            0            0K            0
            aaccam            0            0K            0
            aacbuf            0            0K            0
              zstd            0            0K            0
            XZ_DEC            0            0K            0
            nvlist            0            0K            0
          SCSI ENC            0            0K            0
           SCSI sa            0            0K            0
         scsi_pass            0            0K            0
           scsi_da            0            0K           70
            ata_da            0            0K            0
           scsi_ch            0            0K            0
           scsi_cd            0            0K            0
           nvme_da            0            0K            0
           CAM CCB            0            0K          523
     CAM ccb queue            0            0K            0
db> show uma
              Zone   Size    Used    Free    Requests  Sleeps  Bucket  Total Mem    XFree
   mbuf_jumbo_page   4096    8343    1817       19297       0     254   41615360        0
              mbuf    256    8673    1754       23860       0     254    2669312        0
          BUF TRIE    152     273   11531        2255       0      62    1794208        0
       malloc-4096   4096     395       5        2042       0       2    1638400        0
        malloc-384    384    4165      35        4213       0      30    1612800        0
        malloc-128    128   11872     125       12501       0     126    1535616        0
       UMA Slabs 0    112   11742      24       11742       0     126    1317792        0
           tcp_log    416     138    2913        6396       0     254    1269216        0
         sctp_asoc   2256       2     508           2       0     254    1150560        0
        RADIX NODE    152    7194     315       48290       0      62    1141368        0
      malloc-65536  65536      14       2          20       0       1    1048576        0
      mbuf_cluster   2048     508       0         508       0     254    1040384        0
         vmem btag     56   17585      94       17585       0     254     990024        0
         FFS inode   1168     560      21         745       0       8     678608        0
           sctp_ep   1152       4     507          22       0     254     588672        0
            socket   1024      24     484        1680       0     254     520192        0
          lkpicurr    168       2    3094           2       0      62     520128        0
              pbuf   2664       0     174           0       0       2     463536        0
        256 Bucket   2048     182      10        1089       0       8     393216        0
        sctp_raddr    736       2     515           2       0     254     380512        0
      malloc-16384  16384      19       3         176       0       1     360448        0
         malloc-64     64     138    4713       24160       0     254     310464        0
         VM OBJECT    248    1000     248       15731       0      62     309504        0
             VNODE    440     597      96         790       0      30     304920        0
         malloc-64     64    4412     187        5589       0     254     294336        0
            THREAD   1860     138      14         315       0       8     282720        0
         malloc-16     16   14788     462       17821       0     254     244000        0
       malloc-2048   2048     106       6         130       0       8     229376        0
            DEVCTL   1024      82     138         209       0       0     225280        0
      malloc-65536  65536       0       3          64       0       1     196608        0
      malloc-65536  65536       2       1           3       0       1     196608        0
      malloc-32768  32768       4       2         124       0       1     196608        0
        malloc-256    256      31     719        2561       0      62     192000        0
         malloc-32     32    5489     433        6358       0     254     189504        0
         UMA Zones    768     242       2         242       0      16     187392        0
        malloc-128    128    1138     257       26523       0     126     178560        0
            lkpimm     56       1    3095           1       0     254     173376        0
             unpcb    320       2     514        1239       0     254     165120        0
      malloc-32768  32768       0       5          40       0       1     163840        0
       FFS2 dinode    256     560      70         745       0      62     161280        0
       malloc-4096   4096      28      10         178       0       2     155648        0
       malloc-1024   1024     126      18         169       0      16     147456        0
         MAP ENTRY     96    1039     473       51008       0     126     145152        0
     FPU_save_area    832     140      22         425       0      16     134784        0
       S VFS Cache    104    1024     263        1237       0     126     133848        0
      malloc-65536  65536       0       2         118       0       1     131072        0
      malloc-65536  65536       2       0           2       0       1     131072        0
      malloc-32768  32768       1       3          18       0       1     131072        0
      malloc-32768  32768       2       2          10       0       1     131072        0
       mbuf_packet    256      10     498         322       0     254     130048        0
          ksiginfo    112      54     990         130       0     126     116928        0
      malloc-16384  16384       5       2          10       0       1     114688        0
        malloc-128    128     594     181        1327       0     126      99200        0
      malloc-16384  16384       0       6         207       0       1      98304        0
        malloc-256    256     269     106        1788       0      62      96000        0
             g_bio    440       0     216       14054       0      30      95040        0
              PROC   1368      57       9         980       0       8      90288        0
       malloc-8192   8192       7       4          17       0       1      90112        0
          UMA Kegs    384     228       5         228       0      30      89472        0
          rl_entry     48       4    1844          37       0     254      88704        0
         filedesc0   1072      58      19        1062       0       8      82544        0
       malloc-2048   2048       3      37        1085       0       8      81920        0
         64 Bucket    512     102      58        3823       0      30      81920        0
        malloc-384    384     149      61         712       0      30      80640        0
        128 Bucket   1024      50      17         262       0      16      68608        0
         malloc-64     64     573     498        2649       0     254      68544        0
      malloc-65536  65536       1       0           1       0       1      65536        0
      malloc-32768  32768       2       0           2       0       1      65536        0
       malloc-8192   8192       6       2          89       0       1      65536        0
        malloc-256    256     192      63         626       0      62      65280        0
         32 Bucket    256      80     175         659       0      62      65280        0
            clpbuf   2664       0      20          87       0       4      53280        0
         malloc-64     64     295     524       15177       0     254      52416        0
        malloc-128    128      57     346        3906       0     126      51584        0
        malloc-128    128     324      79         646       0     126      51584        0
        malloc-128    128      84     319         981       0     126      51584        0
        malloc-128    128     204     199         309       0     126      51584        0
           ttyoutq    256      72     123         304       0      62      49920        0
        malloc-256    256      30     165         886       0      62      49920        0
           DIRHASH   1024      34      14          36       0      16      49152        0
             NAMEI   1024       1      47       14902       0      16      49152        0
       malloc-2048   2048      15       9          32       0       8      49152        0
       malloc-2048   2048      11      13          42       0       8      49152        0
       malloc-2048   2048      12      12         168       0       8      49152        0
       malloc-1024   1024      12      36         524       0      16      49152        0
       malloc-1024   1024       6      42        1992       0      16      49152        0
           pcpu-64     64     506     262         506       0     254      49152        0
          syncache    176       1     275           4       0     254      48576        0
        malloc-384    384      11     109         341       0      30      46080        0
             ripcb    376       6     114          98       0      30      45120        0
            pcpu-8      8    4859     773        5790       0     254      45056        0
             Files     80     118     432        8316       0     126      44000        0
         tcp_inpcb   1304       5      28          59       0       8      43032        0
            vnpbuf   2664       0      16           2       0      16      42624        0
       malloc-4096   4096       4       6          33       0       2      40960        0
       malloc-4096   4096       4       6          23       0       2      40960        0
           VMSPACE    584      33      37         956       0      16      40880        0
              pipe    736      16      39         325       0      16      40480        0
            ttyinq    160     135     115         570       0      62      40000        0
        sctp_chunk    152       2     258           2       0     254      39520        0
             AIOCB    552       0      70          71       0      16      38640        0
            da_ccb    544       0      70        3626       0      16      38080        0
         udp_inpcb    408       6      84         206       0      30      36720        0
         malloc-64     64      17     550         325       0     254      36288        0
         malloc-64     64      68     499        1814       0     254      36288        0
         malloc-64     64       2     565        5200       0     254      36288        0
         malloc-64     64     149     418         379       0     254      36288        0
         16 Bucket    144      69     183         387       0      62      36288        0
        malloc-128    128      44     235         362       0     126      35712        0
      ktls_session    256       0     135           2       0      62      34560        0
     routing nhops    256      27     108          54       0      62      34560        0
        malloc-384    384       0      90          11       0      30      34560        0
        malloc-256    256      22     113         255       0      62      34560        0
        malloc-256    256      13     122         568       0      62      34560        0
        malloc-256    256      69      66         146       0      62      34560        0
        malloc-256    256      19     116         420       0      62      34560        0
      malloc-32768  32768       1       0           1       0       1      32768        0
      malloc-32768  32768       0       1           2       0       1      32768        0
       malloc-8192   8192       2       2          28       0       1      32768        0
       malloc-8192   8192       4       0           4       0       1      32768        0
       malloc-2048   2048       3      13          50       0       8      32768        0
       malloc-2048   2048       2      14           3       0       8      32768        0
       malloc-2048   2048       4      12         196       0       8      32768        0
       malloc-1024   1024       4      28          45       0      16      32768        0
       malloc-1024   1024       7      25         208       0      16      32768        0
       malloc-1024   1024       8      24          20       0      16      32768        0
       malloc-1024   1024      17      15          21       0      16      32768        0
        malloc-512    512      15      49          24       0      30      32768        0
        malloc-512    512       2      62          90       0      30      32768        0
        malloc-512    512       0      64          71       0      30      32768        0
        malloc-512    512       9      55          10       0      30      32768        0
              PGRP    120      19     245          60       0     126      31680        0
        sctp_laddr     48      10     578          47       0     254      28224        0
         malloc-32     32     361     521         732       0     254      28224        0
         malloc-32     32     337     545         888       0     254      28224        0
          4 Bucket     48       8     580          17       0     254      28224        0
               AIO    208       0     133          28       0      62      27664        0
     udplite_inpcb    408       0      63           9       0      30      25704        0
         TURNSTILE    136     153      36         153       0      62      25704        0
            cpuset    200       8     120          20       0      62      25600        0
    ertt_txseginfo     40       8     598         688       0     254      24240        0
               PWD     40      20     586         198       0     254      24240        0
           rtentry    168      30     114          54       0      62      24192        0
          8 Bucket     80      48     252         600       0     126      24000        0
            itimer    352       0      66           2       0      30      23232        0
        malloc-384    384      30      30          99       0      30      23040        0
        malloc-384    384      42      18         572       0      30      23040        0
         domainset     40       0     567          10       0     254      22680        0
        SLEEPQUEUE     88     153     103         153       0     126      22528        0
          sackhole     32       0     630           3       0     254      20160        0
         hostcache     64       2     313           2       0     254      20160        0
              ertt     72       5     275          59       0     126      20160        0
         malloc-32     32      32     598         189       0     254      20160        0
         malloc-32     32      87     543         247       0     254      20160        0
         malloc-32     32      28     602         263       0     254      20160        0
         malloc-32     32      23     607        2002       0     254      20160        0
         malloc-32     32      31     599        3796       0     254      20160        0
          2

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/25 21:20 freebsd-src b87f6330013f 64219f15 console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/11/23 13:57 freebsd-src 12ec49d8fac2 4fb8ef37 console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/10/26 12:31 freebsd-src e93db9abc9a6 c0460fcd console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/09/19 03:05 freebsd-src d5984d5f29a7 e2beed91 console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/08/20 10:39 freebsd-src c04fe26aa2f7 79512909 console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/05/30 19:12 freebsd-src 955ab1a8f21e 3d2f584d console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/03/24 14:23 freebsd-src 67c1c4dfd1cc 875573af console log report ci-freebsd-main Fatal trap NUM: page fault in mld_change_state
2025/08/16 22:59 freebsd-src fa085cc78673 1804e95e console log report ci-freebsd-i386 Fatal trap NUM: page fault in mld_change_state
2025/06/17 09:06 freebsd-src 990a088612c3 cfebc887 console log report ci-freebsd-i386 Fatal trap NUM: page fault in mld_change_state
2025/04/15 15:25 freebsd-src 168d873ae41f 85125322 console log report ci-freebsd-i386 Fatal trap NUM: page fault in mld_change_state
2025/03/07 02:03 freebsd-src ecb3a7d43dd6 831e3629 console log report ci-freebsd-i386 Fatal trap NUM: page fault in mld_change_state
2025/03/01 23:45 freebsd-src 7ee310c80ea7 c3901742 console log report ci-freebsd-i386 Fatal trap NUM: page fault in mld_change_state
* Struck through repros no longer work on HEAD.