syzbot


protection_fault: sysctl_doproc (2)

Status: upstream: reported on 2026/01/19 23:16
Reported-by: syzbot+0529e9d056e2020c1553@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: sysctl_doproc -1 1 175d 175d 0/3 auto-obsoleted due to no activity on 2025/10/30 17:26

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      sysctl_doproc+0x260:    movq    0x320(%rbx),%r14
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
sysctl_doproc(ffff80003c969268,4,200000000100,ffff80003c969298) at sysctl_doproc+0x260 sys/kern/kern_sysctl.c:1933
kern_sysctl_dirs(42,ffff80003c969268,4,200000000100,ffff80003c969298,0,62f5c9f2ab1f92b2,ffff80003c969268) at kern_sysctl_dirs+0x681 sys/kern/kern_sysctl.c:442
kern_sysctl(ffff80003c969264,5,200000000100,ffff80003c969298,0,37,347e4260b066d32b) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff8000320f7250,ffff80003c9693c0,ffff80003c969310) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80003c9693c0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9693c0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x46839134960, count: -6
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80003c968f90
rbx               0xdeadbeefdeadbeef
rdx                                0
rcx                                0
rax               0xffff8000320f7250
r8                    0x7f7fffffc000
r9                                 0
r10               0x52cfc80e989f3218
r11               0xa87c4f4964ebbbd2
r12                           0x190f    __ALIGN_SIZE+0x90f
r13                              0x9
r14                              0x9
r15                              0x5
rip               0xffffffff81a5f8f0    sysctl_doproc+0x260
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80003c968ee0
ss                              0x10
sysctl_doproc+0x260:    movq    0x320(%rbx),%r14
ddb> show proc
PROC (syz-executor) tid=436653 pid=28553 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=76, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000320f67f0,0xffff80002a7bcfb8
    process=0xffff8000ffffa898 user=0xffff80003c964000, vmspace=0xfffffd806c9472f0
    estcpu=26, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 28553   29962  57194      0  2           0                syz-executor
 28553   51365  57194      0  2   0x4000000                syz-executor
*28553  436653  57194      0  7   0x4000000                syz-executor
 34317   33109  74504      0  2           0                syz-executor
 34317  500812  74504      0  3   0x4000080  sysctllk      syz-executor
 34317   22280  74504      0  3   0x4000080  fsleep        syz-executor
 99157   64343  27631      0  2           0                syz-executor
 99157  139324  27631      0  2   0x4000000                syz-executor
 99157   11326  27631      0  3   0x4000080  fsleep        syz-executor
 99157  381997  27631      0  3   0x4000080  fsleep        syz-executor
 55519  112113  27054      0  4     0x82004                syz-executor
 55519  236609  27054      0  4   0x4082004                syz-executor
 55519  412570  27054      0  2   0x4002004                syz-executor
 55519  489708  27054      0  4   0x4082004                syz-executor
 61773  379981      0      0  3     0x14200  acct          acct
 16343   31934  35418      0  2         0x2                syz-executor
 27054  255761  35418      0  3        0x82  nanoslp       syz-executor
 57194  313340  35418      0  3        0x82  nanoslp       syz-executor
 57901  302492  35418      0  2         0x2                syz-executor
 27631  139581  35418      0  3        0x82  nanoslp       syz-executor
  2225  113707  35418      0  2         0x2                syz-executor
  3539  432526  35418      0  2         0x2                syz-executor
 74504  413693  35418      0  3        0x82  nanoslp       syz-executor
 35418  418272  23932      0  3        0x82  kqread        syz-executor
 23932  398570  49285      0  3    0x10008a  sigsusp       ksh
 49285  353650  74600      0  3        0x98  kqread        sshd-session
 74600  276415  62137      0  3        0x92  kqread        sshd-session
 93090  226483      1      0  3    0x100083  ttyin         getty
 62137  347674      1      0  3        0x88  kqread        sshd
  1561  271937  29727     73  3   0x1100090  kqread        syslogd
 29727  239243      1      0  3    0x100082  sbwait        syslogd
 32048   26672      1      0  3    0x100080  kqread        resolvd
 18259  121699  95475     77  3    0x100092  kqread        dhcpleased
 94061  114408  95475     77  3    0x100092  kqread        dhcpleased
 95475  312538      1      0  3        0x80  kqread        dhcpleased
 53611  372073      0      0  3     0x14200  bored         smr
 21371  101815      0      0  2     0x14200                zerothread
 84328   51336      0      0  3     0x14200  aiodoned      aiodoned
 30460  418980      0      0  3     0x14200  syncer        update
 29102  518854      0      0  3     0x14200  cleaner       cleaner
 98672  231448      0      0  3     0x14200  reaper        reaper
 36804   34186      0      0  3     0x14200  pgdaemon      pagedaemon
 53425  265374      0      0  3     0x14200  bored         viomb
 63460  389524      0      0  3  0x40014200  acpi0         acpi0
 63480  253011      0      0  3     0x14200  bored         softnet0
 75364  465562      0      0  3     0x14200  bored         systqmp
 53758   61880      0      0  3     0x14200  bored         systq
 89095  270153      0      0  3  0x40014200  tmoslp        softclock
 30890  448964      0      0  3  0x40014200                idle0
     1   23179      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11037  12107K   12307K 166960K     12303        0
            pcb    17     13K      13K 166960K        69        0
         rtable   229      7K       7K 166960K       392        0
             pf    32     13K      14K 166960K        45        0
         ifaddr    40      6K       7K 166960K        54        0
        ifgroup    54      2K       2K 166960K        69        0
         sysctl     1      1K       9K 166960K         5        0
       counters    34     17K      18K 166960K        40        0
       ioctlops     0      0K       4K 166960K        56        0
            iov     0      0K       4K 166960K         3        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1348     85K      85K 166960K      1450        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K         5        0
         VM map     2      1K       1K 166960K         2        0
            sem     7      0K       0K 166960K         9        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    15     53K      85K 166960K       270        0
          sigio     0      0K       0K 166960K         2        0
           proc    60     59K     108K 166960K       489        0
        subproc    75      4K       4K 166960K        76        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        42        0
       in_multi    88      6K       7K 166960K       112        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     0      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    67    307K     307K 166960K        67        0
           exec     1      0K       1K 166960K       392        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   211    162K     168K 166960K      4255        0
       UVM aobj     7      2K       2K 166960K         7        0
     pinsyscall    36     72K      90K 166960K      1348        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        11        0
            NDP    12      0K       2K 166960K        35        0
           temp    40   8663K    8727K 166960K     17485        0
         kqueue    14     22K      30K 166960K        55        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       47    0       44     1     0     1     1     0     8    0
rtentry    136      112    0       12     4     0     4     4     0     8    0
unpcb      144      177    0      158     4     3     1     4     0     8    0
syncache   336        3    0        3     1     1     0     1     0     8    0
tcpcb      736       53    0       49     2     1     1     2     0     8    0
arp         96       18    0        2     1     0     1     1     0     8    0
inpcb      328      220    0      180     4     0     4     4     0     8    0
nd6        112       24    0        3     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1072       5    0        5     1     0     1     1     0     8    1
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      453    0       44    29     2    27    29     0     8    0
art_table   40      455    0       44     5     0     5     5     0     8    0
art_node    32      112    0       21     1     0     1     1     0     8    0
semapl     112        6    0        1     1     0     1     1     0     8    0
shmpl      112        4    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1806    0      299    95     0    95    95     0     8    0
ffsino     256     1806    0      299    95     0    95    95     0     8    0
nchpl      144     2207    0      520    63     0    63    63     0     8    0
vnodes     216     1948    0        0   109     0   109   109     0     8    0
namei      1024    6656    0     6655     2     1     1     2     0     8    0
kstatmem   264       36    0       12     3     0     3     3     0     8    1
scsiplug    72        2    0        2     2     1     1     1     0     8    1
scxspl     216     9366    0     9366     8     7     1     8     1     8    1
plimitpl   152       56    0       39     1     0     1     1     0     8    0
sigapl     424      560    0      519     6     1     5     6     0     8    0
knotepl    120     8059    0     8008     9     6     3     9     0     8    0
kqueuepl   184       72    0       62     1     0     1     1     0     8    0
pipepl     304      152    0      125     5     0     5     5     0     8    2
fdescpl    448      546    0      519     4     0     4     4     0     8    0
filepl     120     2401    0     2118    10     1     9     9     0     8    0
lockfpl    104       75    0       73     1     0     1     1     0     8    0
lockfspl    48       27    0       25     1     0     1     1     0     8    0
sessionpl  144       21    0       13     1     0     1     1     0     8    0
pgrppl      48       35    0       19     1     0     1     1     0     8    0
ucredpl    104      215    0      203     1     0     1     1     0     8    0
zombiepl   144      575    0      575     2     1     1     1     0     8    1
processpl  1152     560    0      519     4     0     4     4     0     8    0
procpl     664      813    0      762     6     0     6     6     0     8    1
sosppl     176        2    0        2     1     1     0     1     0     8    0
sockpl     552      481    0      419     9     4     5     7     0     8    0
mcl64k     65536      5    0        5     2     1     1     1     0     8    1
mcl8k      8192       6    0        6     2     1     1     1     0     8    1
mcl4k      4096    2656    0     2605    16     9     7    16     0     8    0
mcl2k      2048     393    0      390     1     0     1     1     0     8    0
mtagpl      96        5    0        4     2     1     1     1     0     8    0
mbufpl     256     5595    0     5433    11     0    11    11     0     8    0
bufpl      280     3628    0      119   251     0   251   251     0     8    0
anonpl      24   113785    0   110875    67    28    39    67     0   187    2
amapchunkpl 152   13657    0    13223    26     2    24    24     0   158    3
amappl16   200     2172    0     2146    27    19     8    27     0     8    2
amappl15   192        9    0        9     1     1     0     1     0     8    0
amappl14   184        7    0        7     1     1     0     1     0     8    0
amappl13   176      458    0      457     1     0     1     1     0     8    0
amappl12   168      884    0      849     2     0     2     2     0     8    0
amappl11   160        2    0        2     1     1     0     1     0     8    0
amappl10   152       47    0       35     1     0     1     1     0     8    0
amappl9    144      257    0      257     1     1     0     1     0     8    0
amappl8    136       23    0       22     1     0     1     1     0     8    0
amappl7    128       77    0       76     1     0     1     1     0     8    0
amappl6    120      276    0      265     1     0     1     1     0     8    0
amappl5    112       68    0       60     1     0     1     1     0     8    0
amappl4    104      402    0      380     1     0     1     1     0     8    0
amappl3     96     2043    0     1970     3     0     3     3     0     8    0
amappl2     88      677    0      608     2     0     2     2     0     8    0
amappl1     80     9327    0     8805    13     1    12    13     0     8    0
amappl      88     3529    0     3388     5     0     5     5     0    92    0
uvmvnodes   80      104    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        6    0        0     1     0     1     1     0     8    0
uaddrrnd    24      546    0      519     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      546    0      519     1     0     1     1     0     8    0
vmmpekpl   168     6216    0     6186     2     0     2     2     0     8    0
vmmpepl    168    42628    0    41000   100     9    91   100     0   357   11
vmsppl     368      545    0      519     4     1     3     4     0     8    0
rwobjpl     40    14842    0    13920    15     2    13    15     0     8    1
pdppl      4096    1099    0     1038    93    26    67    77     0     8    6
pvpl        32   266345    0   258658   149    47   102   149     0   265    5
pmappl     216      545    0      519     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      365    0       45    10     0    10    10     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
sysctl_doproc(ffff80003c969268,4,200000000100,ffff80003c969298) at sysctl_doproc+0x260 sys/kern/kern_sysctl.c:1933
kern_sysctl_dirs(42,ffff80003c969268,4,200000000100,ffff80003c969298,0,62f5c9f2ab1f92b2,ffff80003c969268) at kern_sysctl_dirs+0x681 sys/kern/kern_sysctl.c:442
kern_sysctl(ffff80003c969264,5,200000000100,ffff80003c969298,0,37,347e4260b066d32b) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff8000320f7250,ffff80003c9693c0,ffff80003c969310) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80003c9693c0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9693c0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x46839134960, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
sysctl_doproc(ffff80003c969268,4,200000000100,ffff80003c969298) at sysctl_doproc+0x260 sys/kern/kern_sysctl.c:1933
kern_sysctl_dirs(42,ffff80003c969268,4,200000000100,ffff80003c969298,0,62f5c9f2ab1f92b2,ffff80003c969268) at kern_sysctl_dirs+0x681 sys/kern/kern_sysctl.c:442
kern_sysctl(ffff80003c969264,5,200000000100,ffff80003c969298,0,37,347e4260b066d32b) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff8000320f7250,ffff80003c9693c0,ffff80003c969310) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80003c9693c0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9693c0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x46839134960, count: -6

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/19 23:15 openbsd 665aeba05e03 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: sysctl_doproc
* Struck through repros no longer work on HEAD.