assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c

Status: upstream: reported on 2026/05/11 02:50
Reported-by: syzbot+0a311e96d7ced7bea566@syzkaller.appspotmail.com
First crash: 107d, last: 1d12h

Sample crash report:
login: panic: kernel diagnostic assertion "(p->pfik_flagrefs == 0) || (p->pfik_flagrefs == 1)" failed: file "/syzkaller/managers/multicore/kernel/sys/net/pf_if.c", line 907
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  99042  75889      0           0          0    0  syz-executor
*283545   8434      0           0  0x4000000    1K syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834badb9) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834fe6b8,ffffffff83557b05,38b,ffffffff8347481e) at __assert+0x29 sys/kern/subr_prf.c:-1
pfi_clear_flags(ffff80003c3d5330,ffffdfff) at pfi_clear_flags+0x41d sys/net/pf_if.c:893
pfioctl(14900,c028445a,ffff80003c3d5330,2,ffff80003c3c9a18) at pfioctl+0xf6a sys/net/pf_ioctl.c:3913
VOP_IOCTL(fffff3806dde2a20,c028445a,ffff80003c3d5330,2,fffff380097fd7b8,ffff80003c3c9a18) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff3806e087240,c028445a,ffff80003c3d5330,ffff80003c3c9a18) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c3c9a18,ffff80003c3d5510,ffff80003c3d5460) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3d5510) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3d5510) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8c14d187550, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "(p->pfik_flagrefs == 0) || (p->pfik_flagrefs == 1)" failed: file "/syzkaller/managers/multicore/kernel/sys/net/pf_if.c", line 907
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834badb9) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834fe6b8,ffffffff83557b05,38b,ffffffff8347481e) at __assert+0x29 sys/kern/subr_prf.c:-1
pfi_clear_flags(ffff80003c3d5330,ffffdfff) at pfi_clear_flags+0x41d sys/net/pf_if.c:893
pfioctl(14900,c028445a,ffff80003c3d5330,2,ffff80003c3c9a18) at pfioctl+0xf6a sys/net/pf_ioctl.c:3913
VOP_IOCTL(fffff3806dde2a20,c028445a,ffff80003c3d5330,2,fffff380097fd7b8,ffff80003c3c9a18) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff3806e087240,c028445a,ffff80003c3d5330,ffff80003c3c9a18) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c3c9a18,ffff80003c3d5510,ffff80003c3d5460) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3d5510) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3d5510) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8c14d187550, count: -10
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003c3d4ed0
rbx               0xffff80002999ee07
rdx               0xffff8000015d7f40
rcx               0xffff80003c3c9a18
rax               0xffff80002999dff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x3c54a380c7be5dde
r11               0xfad426b7dbcc3a0d
r12               0xffff80002999ec08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff81418d75    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c3d4ec0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=283545 pid=8434 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800045fef240,0xffff80003c3c8a98
    process=0xffff80003c3ce1d0 user=0xffff80003c3d0000, vmspace=0xfffff3806cdd5208
    estcpu=36, cpticks=3, pctcpu=0.0, user=0, sys=3, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 75889   99042  90340     0  7           0          0           syz-executor
 75889  143202  90340     0  2           0  0x4000000           syz-executor
  8434  483401  63230     0  2           0          0           syz-executor
* 8434  283545  63230     0  7           0  0x4000000           syz-executor
 19465  262320  42981     0  2           0          0           syz-executor
 19465  504338  42981     0  3           0  0x4000080 fsleep    syz-executor
 19465  444869  42981     0  2           0  0x4000000           syz-executor
 56023  419079  17974     0  2           0          0           syz-executor
 56023  260341  17974     0  2           0  0x4000000           syz-executor
 56023  434571  17974     0  3           0  0x4000080 fsleep    syz-executor
 46023   86288  30055     0  2           0          0           syz-executor
 46023  242611  30055     0  3           0  0x4000080 fsleep    syz-executor
 46023  222771  30055     0  3           0  0x4000080 fsleep    syz-executor
 46023  456532  30055     0  3           0  0x4000080 fsleep    syz-executor
 11794   10648  86723     0  2           0          0           syz-executor
 11794  123943  86723     0  3           0  0x4000080 fsleep    syz-executor
 11794  361610  86723     0  3           0  0x4000080 fsleep    syz-executor
 14146   61243      1     0  3    0x100003       0x80 ttyin     getty
 33537  184294  94986     0  3    0x100002       0x80 sbwait    ndp
 94986  268197  60684     0  3    0x100002       0x88 sigsusp   sh
 86723  171049  40049     0  3         0x2       0x80 nanoslp   syz-executor
 73464    8296  40049     0  3         0x2       0x80 nanoslp   syz-executor
 17974  480558  40049     0  3         0x2       0x80 nanoslp   syz-executor
 90340  462195  40049     0  3         0x2       0x80 nanoslp   syz-executor
 30055  457238  40049     0  3         0x2       0x80 nanoslp   syz-executor
 60684   28413  40049     0  3         0x2       0x80 wait      syz-executor
 63230    3377  40049     0  3         0x2       0x80 nanoslp   syz-executor
 42981  507156  40049     0  3         0x2       0x80 nanoslp   syz-executor
 40049  301963      1     0  3         0x2       0x80 kqread    syz-executor
 90733  397305      1    74  3   0x1100012       0x80 bpf       pflogd
 23920   63539      1    73  3   0x1100010       0x80 kqread    syslogd
 20580  289894      0     0  3     0x14000      0x200 bored     smr
 29934  501357      0     0  2     0x14000      0x200           zerothread
 97204  398908      0     0  3     0x14000      0x200 aiodoned  aiodoned
 69109  407856      0     0  3     0x14000      0x200 syncer    update
 80025  441573      0     0  3     0x14000      0x200 cleaner   cleaner
  3401  434252      0     0  3     0x14000      0x200 reaper    reaper
 33277  451213      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 32364  115200      0     0  3     0x14000      0x200 bored     viomb
 51764  275160      0     0  3     0x14000 0x40000200 acpi0     acpi0
 84815  416634      0     0  3     0x14000 0x40000200           idle1
 16342   75192      0     0  3     0x14000      0x200 bored     softnet1
 84320   50889      0     0  3     0x14000      0x200 bored     softnet0
 43260   93564      0     0  3     0x14000      0x200 bored     systqmp
 72939   70136      0     0  3     0x14000      0x200 bored     systq
 38141   93763      0     0  3     0x14000      0x200 tmoslp    softclockmp
 10842  223411      0     0  3     0x14000 0x40000200 tmoslp    softclock
 92329  447807      0     0  3     0x14000 0x40000200           idle0
     1  412215      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 75889 (syz-executor) thread 0xffff80003c3c82c0 (143202)
exclusive rwlock vmmaplk r = 0 (0xfffff3806cdd58c0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3  uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:194
#6  usertrap+0x430 sys/arch/amd64/amd64/trap.c:648
#7  recall_trap+0x8
Process 8434 (syz-executor) thread 0xffff80003c3c9a18 (283545)
exclusive rwlock pf_lock r = 0 (0xffffffff8399f2e8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0xf56 sys/net/pf_ioctl.c:3913
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff8399f378)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2075
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a78640)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11054  12091K   12425K 166960K     12500        0
            pcb    17     12K      12K 166960K        51        0
         rtable   223      6K       7K 166960K       390        0
             pf    36     18K      21K 166960K        59        0
         ifaddr    42      7K       7K 166960K        47        0
        ifgroup    55      2K       2K 166960K        62        0
         sysctl     4      1K       9K 166960K         9        0
       counters    70     37K      37K 166960K        74        0
       ioctlops     0      0K       4K 166960K      1513        0
            iov     0      0K      12K 166960K        38        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1328     84K      84K 166960K      1538        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         6        0
         VM map     2      1K       1K 166960K         2        0
            sem    16      1K       1K 166960K        23        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    19     69K      89K 166960K       330        0
          sigio     0      0K       0K 166960K         3        0
           proc    21     33K     147K 166960K       586        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        18        0
       in_multi    95      6K       6K 166960K       101        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     1      0K       0K 166960K        13        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       464        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   169     94K     179K 166960K      4727        0
       UVM aobj    12      2K       2K 166960K        12        0
     pinsyscall    26     52K     105K 166960K      1510        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         5        0
            NDP    12      0K       2K 166960K        30        0
           temp    38   9115K    9130K 166960K     18165        0
         kqueue     3      4K      22K 166960K        53        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       50    0       49     1     0     1     1     0     8    0
rtentry    176      119    0       19     6     0     6     6     0     8    0
unpcb      144      119    0      114     1     0     1     1     0     8    0
syncache   336        5    0        5     1     1     0     1     0     8    0
tcpcb      736       47    0       46     1     0     1     1     0     8    0
arp        136       19    0        3     1     0     1     1     0     8    0
inpcb      328      200    0      198     2     1     1     2     0     8    0
nd6        152       29    0        0     2     0     2     2     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       1    0        1     1     1     0     1     0     8    0
pfstscr     40        2    0        2     1     1     0     1     0     8    0
pffrag     232        6    0        1     1     0     1     1     0   482    0
pffrnode    88        6    0        1     1     0     1     1     0     8    0
pffrent     40        7    0        2     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       35    0        2     1     0     1     1     0     8    0
pfstkey    128       35    0        2     2     0     2     2     0     8    0
pfstate    448       34    0        1     4     0     4     4     0     8    0
pfrule     1360      22    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      493    0       47    31     0    31    31     0     8    1
art_table   40      494    0       47     5     0     5     5     0     8    0
art_node    32      118    0       29     1     0     1     1     0     8    0
sysvmsgpl   40        2    0        0     1     0     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl      72       21    0        7     1     0     1     1     0     8    0
shmpl      112        9    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1902    0      436    93     0    93    93     0     8    0
ffsino     296     1902    0      436   114     0   114   114     0     8    0
nchpl      144     2377    0      675    64     0    64    64     0     8    0
vnodes     216     2113    0        0   118     0   118   118     0     8    0
namei      1024    8223    0     8222     3     2     1     2     0     8    0
percpumem   16       53    0        2     1     0     1     1     0     8    0
kstatmem   264       31    0        4     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     1     0     1     0     8    0
scxspl     216     8476    0     8476    12    10     2     8     1     8    2
plimitpl   152      106    0       93     1     0     1     1     0     8    0
sigapl     424      654    0      615     7     1     6     7     0     8    0
knotepl    120      447    0        0    14     0    14    14     0     8    0
kqueuepl   224      140    0      137     5     4     1     5     0     8    0
pipepl     344      137    0      109     3     0     3     3     0     8    0
fdescpl    528      638    0      615     3     0     3     3     0     8    0
filepl     160     3121    0     2929    13     3    10    12     0     8    0
lockfpl    104      243    0      242     3     1     2     2     0     8    1
lockfspl    48       73    0       72     1     0     1     1     0     8    0
sessionpl  144       99    0       93     1     0     1     1     0     8    0
pgrppl      48      106    0       93     1     0     1     1     0     8    0
ucredpl    104      346    0      339     1     0     1     1     0     8    0
zombiepl   144      636    0      635     2     1     1     1     0     8    0
processpl  1232     654    0      615     5     0     5     5     0     8    0
procpl     664      982    0      932     6     1     5     6     0     8    0
sockpl     752      378    0      370     4     2     2     4     0     8    0
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       6    0        0     1     0     1     1     0     8    0
mcl4k      4096     118    0        0    15     0    15    15     0     8    0
mcl2k      2048      34    0        0     5     0     5     5     0     8    0
mextrefs    64       33    0        0     1     0     1     1     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      231    0        0    15     0    15    15     0     8    0
bufpl      272     2852    0      106   184     0   184   184     0     8    0
anonpl      32     5455    0        0    44     0    44    44     0   247    0
amapchunkpl 152   14210    0    13787    25     4    21    25     0   158    2
amappl16   200     1632    0     1596     6     3     3     5     0     8    0
amappl15   192        2    0        2     1     1     0     1     0     8    0
amappl14   184      437    0      436     1     0     1     1     0     8    0
amappl13   176      128    0      123     1     0     1     1     0     8    0
amappl12   168      890    0      868     2     0     2     2     0     8    0
amappl11   160        5    0        4     2     1     1     1     0     8    0
amappl10   152       67    0       63     1     0     1     1     0     8    0
amappl9    144      274    0      273     1     0     1     1     0     8    0
amappl8    136       99    0       98     1     0     1     1     0     8    0
amappl7    128      151    0      145     1     0     1     1     0     8    0
amappl6    120      159    0      155     1     0     1     1     0     8    0
amappl5    112      100    0       97     1     0     1     1     0     8    0
amappl4    104      300    0      291     1     0     1     1     0     8    0
amappl3     96     2573    0     2495     3     0     3     3     0     8    0
amappl2     88      765    0      728     2     0     2     2     0     8    0
amappl1     80    11582    0    11364    15     2    13    15     0     8    1
amappl      88     3964    0     3826     4     0     4     4     0    92    0
uvmvnodes   80      100    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       11    0        0     1     0     1     1     0     8    0
uaddrrnd    24      638    0      615     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      638    0      615     1     0     1     1     0     8    0
vmmpekpl   168     7165    0     7129     2     0     2     2     0     8    0
vmmpepl    168    48837    0    47704    88    30    58    88     0   357    1
vmsppl     488      637    0      615     5     0     5     5     0     8    0
rwobjpl     80    16581    0    15976    24     1    23    24     0     8    0
pdppl      4096    1283    0     1230    95    42    53    83     0     8    0
pvpl        32    12522    0        0   101     0   101   101     0   265    0
pmappl     256      637    0      615     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      462    0       48    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff839cbff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 sys/dev/kcov.c:153
__mp_lock(ffffffff83a77e40) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a77e40) at __mp_lock+0x1a3 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x729962df7d10, count: 7
ddb{0}> trace
x86_ipi_db(ffffffff839cbff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 sys/dev/kcov.c:153
__mp_lock(ffffffff83a77e40) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a77e40) at __mp_lock+0x1a3 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x729962df7d10, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834badb9) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834fe6b8,ffffffff83557b05,38b,ffffffff8347481e) at __assert+0x29 sys/kern/subr_prf.c:-1
pfi_clear_flags(ffff80003c3d5330,ffffdfff) at pfi_clear_flags+0x41d sys/net/pf_if.c:893
pfioctl(14900,c028445a,ffff80003c3d5330,2,ffff80003c3c9a18) at pfioctl+0xf6a sys/net/pf_ioctl.c:3913
VOP_IOCTL(fffff3806dde2a20,c028445a,ffff80003c3d5330,2,fffff380097fd7b8,ffff80003c3c9a18) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff3806e087240,c028445a,ffff80003c3d5330,ffff80003c3c9a18) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c3c9a18,ffff80003c3d5510,ffff80003c3d5460) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3d5510) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3d5510) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8c14d187550, count: 5
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834badb9) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff834fe6b8,ffffffff83557b05,38b,ffffffff8347481e) at __assert+0x29 sys/kern/subr_prf.c:-1
pfi_clear_flags(ffff80003c3d5330,ffffdfff) at pfi_clear_flags+0x41d sys/net/pf_if.c:893
pfioctl(14900,c028445a,ffff80003c3d5330,2,ffff80003c3c9a18) at pfioctl+0xf6a sys/net/pf_ioctl.c:3913
VOP_IOCTL(fffff3806dde2a20,c028445a,ffff80003c3d5330,2,fffff380097fd7b8,ffff80003c3c9a18) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff3806e087240,c028445a,ffff80003c3d5330,ffff80003c3c9a18) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c3c9a18,ffff80003c3d5510,ffff80003c3d5460) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3d5510) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3d5510) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8c14d187550, count: -10
ddb{1}> 

Crashes (26):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/25 01:15 openbsd c0485cf4f019 614e416a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/08/01 11:37 openbsd 59ec3ab4d107 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/31 22:40 openbsd ec875f0e6c74 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/20 21:45 openbsd d55fd7dd01df de6a700d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/15 20:39 openbsd 5b4a77182f82 27a8bd60 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/03 03:17 openbsd de19110b06a6 58bf2096 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/01 16:20 openbsd 927838563536 5fb9973c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/01 13:14 openbsd 927838563536 00a5cf1c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/07/01 00:03 openbsd b68bd8e26319 00a5cf1c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/06/30 23:58 openbsd b68bd8e26319 00a5cf1c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/06/27 12:50 openbsd 309f6120392c fb92f11c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/06/26 23:22 openbsd af86e51c5cc8 fb92f11c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/06/04 09:01 openbsd e8e5aa2db9cf 197909be .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/06/01 06:27 openbsd ca362689551c cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/15 07:21 openbsd 9f6962b18ef0 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/15 06:45 openbsd 9f6962b18ef0 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/14 19:42 openbsd 9f6962b18ef0 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/13 13:24 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/13 04:22 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/13 01:11 openbsd 5e6d4834f229 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/12 15:03 openbsd 5e6d4834f229 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/11 21:12 openbsd 9c5367037e8c 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/11 17:51 openbsd 9c5367037e8c 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/05/11 02:50 openbsd bf258236f7c1 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/08/23 23:52 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
2026/08/03 10:31 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan e989b5b1c184 6b7c9f71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan assert "(p->pfik_flagrefs == NUM) || (p->pfik_flagrefs == NUM)" failed in pf_if.c
* Struck through repros no longer work on HEAD.