KASAN: invalid memory access in knote_processfork

Status: upstream: reported on 2026/08/14 10:23
Reported-by: syzbot+114d7893c5502e911555@syzkaller.appspotmail.com
Fix commit: kqueue: don't use the knote after knote_processfork() releases ps_mtx
Patched on: [ci-openbsd-kasan], missing on: [ci-openbsd-main ci-openbsd-multicore ci-openbsd-setuid]
First crash: 57d, last: 24d

Sample crash report:
panic: Caught invalid memory access at ffff800001b03742 size 2 op 0
Stopped at      db_enter+0x17:  popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*442205  96078      0         0x1  0x4000000    0K syz-executor
 441598  89551      0         0x2          0    1  syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84640da7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load2_noabort(ffff800001b03742) at __asan_load2_noabort+0x107
knote_processfork(ffffffff85450480,48a5) at knote_processfork+0x603 sys/kern/kern_event.c:2289
fork1(ffffffff85450120,f0,ffffffff837d8160,0,0,ffff8000312e2c00) at fork1+0x1225 sys/kern/kern_fork.c:511
kthread_create(ffffffff837d8160,0,0,ffffffff84c180c0) at kthread_create+0xa8 sys/kern/kern_kthread.c:61
nfs_getset_niothreads(1) at nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
nfs_sysctl(ffff8000312e2e08,1,0,ffff8000312e2de0,200000000200,0,ffff8000312e3060) at nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:894
sys_sysctl(ffff800039f3a550,ffff8000312e3060,ffff8000312e2fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000312e3060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000312e3060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x809a884de70, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff800001b03742 size 2 op 0
ddb{0}> show kasan
KASAN: invalid read of 2 bytes at 0xffff800001b03742 from pc 0xffffffff8174aac3
KASAN: first bad byte at 0xffff800001b03742 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff800001b03742 is 50 bytes inside the 120-byte item [0xffff800001b03710..0xffff800001b03788) in pool 'knotepl'
KASAN: allocated at:
#0  pool_get+0x770 sys/kern/subr_pool.c:834
#1  kqueue_register+0x2f2 sys/kern/kern_event.c:1431
#2  sys_kevent+0x409 sys/kern/kern_event.c:1301
#3  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
KASAN: freed at:
#0  pool_put+0x79 sys/kern/subr_pool.c:1019
#1  kqueue_scan+0x1191 sys/kern/kern_event.c:1797
#2  sys_kevent+0x997 sys/kern/kern_event.c:1336
#3  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
KASAN: pc: knote_processfork+0x603
KASAN: call trace:
#0  __asan_load2_noabort+0xe6 kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0  __asan_load2_noabort+0xe6 sys/kern/subr_kasan.c:1097
#1  knote_processfork+0x603 sys/kern/kern_event.c:2289
#2  fork1+0x1225 sys/kern/kern_fork.c:511
#3  kthread_create+0xa8 sys/kern/kern_kthread.c:61
#4  nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
#5  nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:894
#6  sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#7  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#7  syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#8  Xsyscall+0x128
KASAN: shadow of 0xffff800001b03600..0xffff800001b03880 (1 cell = 8 bytes):
 0xffff800001b03600: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
 0xffff800001b03680: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
>0xffff800001b03700: 08 08 fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
 0xffff800001b03780: fd 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
 0xffff800001b03800: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 fd
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84640da7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load2_noabort(ffff800001b03742) at __asan_load2_noabort+0x107
knote_processfork(ffffffff85450480,48a5) at knote_processfork+0x603 sys/kern/kern_event.c:2289
fork1(ffffffff85450120,f0,ffffffff837d8160,0,0,ffff8000312e2c00) at fork1+0x1225 sys/kern/kern_fork.c:511
kthread_create(ffffffff837d8160,0,0,ffffffff84c180c0) at kthread_create+0xa8 sys/kern/kern_kthread.c:61
nfs_getset_niothreads(1) at nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
nfs_sysctl(ffff8000312e2e08,1,0,ffff8000312e2de0,200000000200,0,ffff8000312e3060) at nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:894
sys_sysctl(ffff800039f3a550,ffff8000312e3060,ffff8000312e2fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000312e3060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000312e3060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x809a884de70, count: -11
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000312e27b0
rbx               0xffff8000312e2820
rdx                                0
rcx               0xffffffff85337ff0    cpu_info_full_primary+0x1ff0
rax               0xffff80000015d100
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xffff8000312e2598
r11               0xffffffff836a5650    x86_bus_space_io_read_1
r12               0xffffffff84640da7    __rodata_start+0x9dda7
r13               0xffffffff85338c10    cpu_info_full_primary+0x2c10
r14               0xffffffff85338e0f    cpu_info_full_primary+0x2e0f
r15                              0x1
rip               0xffffffff82df8707    db_enter+0x17
cs                               0x8
rflags                         0x246
rsp               0xffff8000312e27b0
ss                              0x10
db_enter+0x17:  popq    %rbp
ddb{0}> show proc
PROC (syz-executor) tid=442205 pid=96078 tcnt=3 stat=onproc
    flags process=1<CONTROLT> proc=4000000<THREAD>
    runpri=32, usrpri=60, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000298f2a78,0xffff800039f3b258
    process=0xffff800029aca1c8 user=0xffff8000312d8000, vmspace=0xffff800001bbd018
    estcpu=10, cpticks=24, pctcpu=0.17, user=0, sys=24, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 18597  118841      0     0  2     0x14000      0x200           swapper
 58613  251333  89551     0  2           0          0           syz-executor
 58613   48359  89551     0  2           0  0x4000000           syz-executor
 91023  121842  60322     0  2           0          0           syz-executor
 91023  196536  60322     0  2           0  0x4000000           syz-executor
 23487  359494  81604     0  2           0          0           syz-executor
 23487  435435  81604     0  3           0  0x4000080 fsleep    syz-executor
 96078  485873  89800     0  2         0x1          0           syz-executor
 96078   84636  89800     0  3         0x1  0x4000080 fsleep    syz-executor
*96078  442205  89800     0  7         0x1  0x4000000           syz-executor
 99997  210348  43957     0  2        0x10          0           syz-executor
 99997  143896  43957     0  2        0x10  0x4000000           syz-executor
 20383  212965  25188     0  2           0          0           syz-executor
 20383  245840  25188     0  3           0  0x4000080 fsleep    syz-executor
 71731   99719   6659     0  2           0          0           syz-executor
 71731  210940   6659     0  3           0  0x4000080 piperd    syz-executor
 71731   55478   6659     0  2           0  0x4000000           syz-executor
 18522  339732    650     0  2    0x100002          0           ndp
   650  328073  22465     0  3    0x100002       0x88 sigsusp   sh
 43957  367599  79954     0  2         0x2      0xc80           syz-executor
 60322  197991  79954     0  2         0x2      0xc80           syz-executor
 81604  241038  79954     0  2         0x2      0xc80           syz-executor
 89800  238837  79954     0  2         0x2      0xc80           syz-executor
  6659  191491  79954     0  2         0x2      0xc80           syz-executor
 22465  396886  79954     0  3         0x2       0x80 wait      syz-executor
 25188   68762  79954     0  2         0x2      0xc80           syz-executor
 89551  441598  79954     0  7         0x2          0           syz-executor
 79954  188751  14801     0  3         0x2       0x80 kqread    syz-executor
 14801  350786  68987     0  3    0x100002       0x88 sigsusp   ksh
 68987  214399  30996     0  3        0x10       0x88 kqread    sshd-session
 30996  186455  39597     0  3        0x12       0x80 kqread    sshd-session
 74430  212775      1     0  3    0x100003       0x80 ttyin     getty
 39597  363057      1     0  3           0       0x88 kqread    sshd
 86161  282669  82544    74  3   0x1100012       0x80 bpf       pflogd
 82544  107194      1     0  3           0       0x80 sbwait    pflogd
 42883  496396  51259    73  2   0x1100010       0x80           syslogd
 51259  491215      1     0  3    0x100002       0x80 sbwait    syslogd
 94854   31755      1     0  3    0x100000       0x80 kqread    resolvd
 66655  227834  48713    77  3    0x100012       0x80 kqread    dhcpleased
 35142   63824  48713    77  3    0x100012       0x80 kqread    dhcpleased
 48713  106922      1     0  3           0       0x80 kqread    dhcpleased
 62659  335576      0     0  3     0x14000      0x200 bored     smr
 16618  335096      0     0  2     0x14000      0x200           zerothread
 10572  197192      0     0  3     0x14000      0x200 aiodoned  aiodoned
 99199  208783      0     0  3     0x14000      0x200 syncer    update
 41247   27731      0     0  3     0x14000      0x200 cleaner   cleaner
 71642  161084      0     0  3     0x14000      0x200 reaper    reaper
 13791  277702      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 29749  382328      0     0  3     0x14000      0x200 bored     viomb
 61111  348054      0     0  3     0x14000 0x40000200 acpi0     acpi0
 45855  134400      0     0  3     0x14000 0x40000200           idle1
 73736  442201      0     0  3     0x14000      0x200 bored     softnet1
 51021   19345      0     0  3     0x14000      0x200 bored     softnet0
 75167  306275      0     0  3     0x14000      0x200 bored     systqmp
 28310  395264      0     0  3     0x14000      0x200 bored     systq
 85224  459362      0     0  2     0x14000      0x200           softclockmp
 51298  224443      0     0  2     0x14000 0x40000200           softclock
  6219  362526      0     0  3     0x14000 0x40000200           idle0
     1  110410      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
Process 91023 (syz-executor) thread 0xffff8000298f3ca0 (196536)
exclusive rrwlock inode r = 0 (0xffff800001bc1a30)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0xda sys/ufs/ufs/ufs_ihash.c:146
#5  ffs_vget+0x2e9 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x576 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_makeinode+0x1a1 sys/ufs/ufs/ufs_vnops.c:1759
#8  ufs_create+0xcf sys/ufs/ufs/ufs_vnops.c:147
#9  VOP_CREATE+0x1a2 sys/kern/vfs_vops.c:103
#10 vn_open+0x6d9 sys/kern/vfs_vnops.c:118
#11 doopenat+0x460 sys/kern/vfs_syscalls.c:1163
#12 sys_open+0x86 sys/kern/vfs_syscalls.c:1065
#13 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff800001bc17e0)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4  vn_lock+0xca sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x1f7 sys/kern/vfs_lookup.c:431
#6  namei+0xe19 sys/kern/vfs_lookup.c:250
#7  vn_open+0x319 sys/kern/vfs_vnops.c:109
#8  doopenat+0x460 sys/kern/vfs_syscalls.c:1163
#9  sys_open+0x86 sys/kern/vfs_syscalls.c:1065
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
Process 96078 (syz-executor) thread 0xffff800039f3a550 (442205)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff8545bb40)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  sysctl_vslock+0x72 sys/kern/kern_sysctl.c:197
#2  sys_sysctl+0x460 sys/kern/kern_sysctl.c:304
#3  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
exclusive rwlock sysctllk r = 0 (0xffffffff85349d98)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  sysctl_vslock+0x37 sys/kern/kern_sysctl.c:192
#3  sys_sysctl+0x460 sys/kern/kern_sysctl.c:304
#4  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#5  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11056  12243K   12394K 166960K     12147        0
            pcb    21     24K      24K 166960K        21        0
         rtable   286     31K      31K 166960K       344        0
             pf    41     31K      31K 166960K        52        0
         ifaddr    43     12K      12K 166960K        45        0
        ifgroup    55      2K       2K 166960K        55        0
         sysctl     1      1K      13K 166960K         5        0
       counters    70     42K      42K 166960K        70        0
       ioctlops     9      5K     194K 166960K      1486        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1293     83K      83K 166960K      1364        0
      UFS quota     1     36K      36K 166960K         1        0
      UFS mount     5     44K      44K 166960K         5        0
            shm     2      2K       2K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     2      0K       0K 166960K         2        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     413K 166960K     11964        0
      file desc    19     69K     117K 166960K       143        0
           proc   135    131K     166K 166960K       551        0
        subproc    72      9K       9K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     20K      20K 166960K         1        0
    ip_moptions     2      0K       0K 166960K         2        0
       in_multi    99      7K       7K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         1        0
    ISOFS mount     1     36K      36K 166960K         1        0
  MSDOSFS mount     1     20K      20K 166960K         1        0
           ttys    61    425K     425K 166960K        61        0
           exec    39      9K      17K 166960K       384        0
   fusefs mount     1     36K      36K 166960K         1        0
            tdb     3      1K       1K 166960K         3        0
        VM swap    14    124K     124K 166960K        15        0
       UVM amap   587    357K     363K 166960K      3082        0
       UVM aobj     3      4K       4K 166960K         3        0
     pinsyscall   190    326K     368K 166960K      1306        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    28      2K       2K 166960K        28        0
           temp   369   9376K    9444K 166960K      3937        0
         kqueue    17     42K      84K 166960K        29        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       33    0       29     1     0     1     1     0     8    0
rtentry    176      110    0        1     5     0     5     5     0     8    0
unpcb      144       45    0       26     1     0     1     1     0     8    0
syncache   336        4    0        4     2     1     1     1     0     8    1
tcpcb      736        8    0        4     1     0     1     1     0     8    0
arp        136       18    0        0     1     0     1     1     0     8    0
inpcb      328       74    0       65     2     0     2     2     0     8    1
nd6        152       23    0        0     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
pffrag     232        2    0        0     1     0     1     1     0   482    0
pffrnode    88        2    0        0     1     0     1     1     0     8    0
pffrent     40        2    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       4    0        4     1     0     1     1     0     8    1
pfanchor   1288       1    0        1     1     0     1     1     0     8    1
pfstitem    24       32    0        0     1     0     1     1     0     8    0
pfstkey    128       32    0        0     2     0     2     2     0     8    0
pfstate    448       32    0        0     4     0     4     4     0     8    0
pfrule     1360      22    0       17     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      452    0        0    29     0    29    29     0     8    0
art_table   40      453    0        0     5     0     5     5     0     8    0
art_node    32      110    0       11     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1571    0      103    92     0    92    92     0     8    0
ffsino     296     1571    0      103   113     0   113   113     0     8    0
nchpl      144     1774    0       73    64     0    64    64     0     8    0
vnodes     216     1659    0        0    93     0    93    93     0     8    0
namei      1024    6190    0     6189     3     1     2     2     0     8    1
percpumem   16       51    0        0     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        1     1     0     1     1     0     8    1
kstatmem   264       27    0        0     2     0     2     2     0     8    0
scxspl     216     6975    0     6975     4     2     2     2     1     8    2
plimitpl   152       29    0       12     1     0     1     1     0     8    0
sigapl     424      463    0      413     7     0     7     7     0     8    0
knotepl    120       60    0        0     2     0     2     2     0     8    0
kqueuepl   224       25    0       14     1     0     1     1     0     8    0
pipepl     344      128    0      100     3     0     3     3     0     8    0
fdescpl    528      446    0      413     3     0     3     3     0     8    0
filepl     160     1615    0     1385    10     0    10    10     0     8    0
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       26    0       15     1     0     1     1     0     8    0
pgrppl      48       34    0       15     1     0     1     1     0     8    0
ucredpl    104      105    0       91     1     0     1     1     0     8    0
zombiepl   144      413    0      413     1     0     1     1     0     8    1
processpl  1232     463    0      413     5     0     5     5     0     8    1
procpl     664      479    0      420     5     0     5     5     0     8    0
sockpl     752      153    0      121     4     0     4     4     0     8    0
mcl64k     65536      1    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k      2048      19    0        0     3     0     3     3     0     8    0
mextrefs    64       19    0        0     1     0     1     1     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      162    0        0    11     0    11    11     0     8    0
bufpl      272     2323    0      106   148     0   148   148     0     8    0
anonpl      32     3910    0        0    32     0    32    32     0   222    0
amapchunkpl 152    8464    0     7982    20     1    19    19     0   158    0
amappl16   200     1871    0     1857     5     1     4     5     0     8    2
amappl15   192        8    0        8     2     2     0     1     0     8    0
amappl14   184      431    0      429     1     0     1     1     0     8    0
amappl13   176      138    0      125     1     0     1     1     0     8    0
amappl12   168      763    0      732     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       67    0       53     1     0     1     1     0     8    0
amappl9    144      275    0      275     1     1     0     1     0     8    0
amappl8    136      103    0      102     1     0     1     1     0     8    0
amappl7    128      148    0      134     1     0     1     1     0     8    0
amappl6    120      171    0      168     1     0     1     1     0     8    0
amappl5    112      113    0      103     1     0     1     1     0     8    0
amappl4    104      293    0      275     1     0     1     1     0     8    0
amappl3     96     1476    0     1376     3     0     3     3     0     8    0
amappl2     88      578    0      501     2     0     2     2     0     8    0
amappl1     80    10435    0     9800    15     0    15    15     0     8    0
amappl      88     2353    0     2194     4     0     4     4     0    92    0
uvmvnodes   80       98    0        0     2     0     2     2     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      447    0      414     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      447    0      414     1     0     1     1     0     8    0
vmmpekpl   168     5820    0     5789     2     0     2     2     0     8    0
vmmpepl    168    38365    0    36400    88     0    88    88     0   357    1
vmsppl     488      446    0      414     5     0     5     5     0     8    0
rwobjpl     80    14666    0    13621    24     0    24    24     0     8    0
pdppl      4096     903    0      828    99    12    87    87     0     8   12
pvpl        32    11068    0        0    92     2    90    90     0   265    0
pmappl     256      446    0      414     3     0     3     3     0     8    0
extentpl    40       47    0       29     1     0     1     1     0     8    0
phpool     120      422    0       17    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84640da7) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load2_noabort(ffff800001b03742) at __asan_load2_noabort+0x107
knote_processfork(ffffffff85450480,48a5) at knote_processfork+0x603 sys/kern/kern_event.c:2289
fork1(ffffffff85450120,f0,ffffffff837d8160,0,0,ffff8000312e2c00) at fork1+0x1225 sys/kern/kern_fork.c:511
kthread_create(ffffffff837d8160,0,0,ffffffff84c180c0) at kthread_create+0xa8 sys/kern/kern_kthread.c:61
nfs_getset_niothreads(1) at nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
nfs_sysctl(ffff8000312e2e08,1,0,ffff8000312e2de0,200000000200,0,ffff8000312e3060) at nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:894
sys_sysctl(ffff800039f3a550,ffff8000312e3060,ffff8000312e2fc0) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff8000312e3060) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000312e3060) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x809a884de70, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x19:        leave
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x21 kd_curproc sys/dev/kcov.c:584 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x21 sys/dev/kcov.c:153
__mp_lock(ffffffff8545b340) at __mp_lock+0x290 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff8545b340) at __mp_lock+0x290 sys/kern/kern_lock.c:173
syscall(ffff8000299cacb0) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff8000299cacb0) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f2ebd3fa300, count: 8
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x21 kd_curproc sys/dev/kcov.c:584 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x21 sys/dev/kcov.c:153
__mp_lock(ffffffff8545b340) at __mp_lock+0x290 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff8545b340) at __mp_lock+0x290 sys/kern/kern_lock.c:173
syscall(ffff8000299cacb0) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff8000299cacb0) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f2ebd3fa300, count: -7

Crashes (29):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/16 03:19 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b4b76c1f24bb 12a0a44a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 21:23 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan c8b69c7726dd f41e228a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 17:53 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan c8b69c7726dd f41e228a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 16:38 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan c8b69c7726dd f41e228a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 08:24 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 06:33 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 05:17 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 03:25 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 01:37 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 00:31 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/15 00:03 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 23:37 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 21:22 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 20:50 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 18:41 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 17:49 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 17:24 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 14:01 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 11:22 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 11:13 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 924033e8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 05:50 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/14 05:32 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan ba3d21e4ee62 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/12 07:29 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 2fac54c86f35 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/11 10:43 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 2fac54c86f35 9c29f801 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/11 07:44 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 2fac54c86f35 1fe56c0a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/09/08 21:16 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 06706d23b01e 351387c4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/08/14 16:36 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan f02e55361321 6f9b3e89 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/08/14 14:23 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3be50a05e816 6f9b3e89 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
2026/08/14 10:22 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3be50a05e816 6f9b3e89 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in knote_processfork
* Struck through repros no longer work on HEAD.