uvm_fault: rtable_lookup

Status: upstream: reported on 2026/08/22 21:13
Reported-by: syzbot+06511ce7aa18f56cee0b@syzkaller.appspotmail.com
First crash: 6d22h, last: 6d22h

Sample crash report:
uvm_fault(0xfffffd806d2e05d8, 0x100000003, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      rtable_lookup+0xd5:     movq    0(%rax,%rcx,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 11062  80401      0    0x100002          0    0  ndp
rtable_lookup(0,ffff80000161e760,0,0,40) at rtable_lookup+0xd5 rtable_get sys/net/rtable.c:260 [inline]
rtable_lookup(0,ffff80000161e760,0,0,40) at rtable_lookup+0xd5 sys/net/rtable.c:440
rtm_output(ffff80000161e700,ffff8000380db718,ffff8000380db670,40,0) at rtm_output+0x135 sys/net/rtsock.c:1189
route_output(fffffd8065c57900,ffff8000016395b8) at route_output+0xa6a sys/net/rtsock.c:862
route_send(ffff8000016395b8,fffffd8065c57900,0,0) at route_send+0xd7 sys/net/rtsock.c:322
sosend(ffff8000016395b8,0,ffff8000380db978,0,0,0) at sosend+0x804 sys/kern/uipc_socket.c:-1
dofilewritev(ffff8000380dc2b8,3,ffff8000380db978,0,ffff8000380dba20) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff8000380dc2b8,ffff8000380dbad0,ffff8000380dba20) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff8000380dbad0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000380dbad0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a5af8351b20, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/22 21:12 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: rtable_lookup
* Struck through repros no longer work on HEAD.