syzbot
malloc: free list modified: vnodes
Status:
upstream: reported on 2026/09/02 16:21
Reported-by: syzbot+12bcbd7b90c0daa8710f@syzkaller.appspotmail.com
First crash: 16d, last: 16d
Sample crash report:
panic: Data modified on freelist: word 4 of object 0xffff8000015eaac0 size 0x38 previous type vnodes (0x0 != 0xdead4110)
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*472128 51461 77 0x100012 0x1 0 dhcpleased
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834550b1) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(38,7f,1) at malloc+0xdb6 sys/kern/kern_malloc.c:357
ktrsyscall(ffff80002a737c90,48,30,ffff80002a791780) at ktrsyscall+0x199 sys/kern/kern_ktrace.c:174
syscall(ffff80002a791780) at syscall+0x2bc mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002a791780) at syscall+0x2bc sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7cf839298a90, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: Data modified on freelist: word 4 of object 0xffff8000015eaac0 size 0x38 previous type vnodes (0x0 != 0xdead4110)
ddb> show kasan
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834550b1) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(38,7f,1) at malloc+0xdb6 sys/kern/kern_malloc.c:357
ktrsyscall(ffff80002a737c90,48,30,ffff80002a791780) at ktrsyscall+0x199 sys/kern/kern_ktrace.c:174
syscall(ffff80002a791780) at syscall+0x2bc mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002a791780) at syscall+0x2bc sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7cf839298a90, count: -6
ddb> show registers
rdi 0
rsi 0x1
rbp 0xffff80002a791450
rbx 0xffff8000015eaac0
rdx 0
rcx 0
rax 0xffff80002a737c90
r8 0x101010101010101
r9 0x8080808080808080
r10 0x10276eb659d18ec8
r11 0x9b4b153efdce9825
r12 0
r13 0xffffffff83aee960 kmemstats+0x1fc0
r14 0
r15 0x1
rip 0xffffffff83139585 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80002a791440
ss 0x10
db_enter+0x25: addq $0x8,%rsp
ddb> show proc
PROC (dhcpleased) tid=472128 pid=51461 tcnt=1 stat=onproc
flags process=100012<EXEC,SUGID,PLEDGE> proc=1<INKTR>
runpri=24, usrpri=51, slppri=24, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a7367d0,0xffff80002a760550
process=0xffff80002a745208 user=0xffff80002a78c000, vmspace=0xfffff0807f22cb80
estcpu=1, cpticks=3, pctcpu=0.0, user=0, sys=3, intr=0
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
91286 454672 6705 0 3 0x2 0 clonelk ifconfig
61822 495099 97529 0 3 0x2 0 clonelk ifconfig
6705 35026 75428 0 3 0x100002 0x88 sigsusp sh
97529 244327 31015 0 3 0x100002 0x88 sigsusp sh
31015 151232 82547 0 3 0x2 0x80 wait syz-executor
75428 447062 82547 0 3 0x2 0x80 wait syz-executor
96220 2304 82547 0 3 0x2 0 clonelk syz-executor
15984 128031 82547 0 3 0x2 0x80 piperd syz-executor
53104 416131 82547 0 3 0x2 0x80 piperd syz-executor
16984 208360 82547 0 3 0x2 0x80 nanoslp syz-executor
82547 302868 92786 0 3 0x2 0x80 wait syz-executor
92786 456384 56252 0 3 0x100002 0x88 sigsusp ksh
56252 59682 4136 0 3 0x10 0x88 kqread sshd-session
4136 217313 73520 0 3 0x12 0x80 kqread sshd-session
14935 473128 1 0 3 0x100003 0x80 ttyin getty
73520 124577 1 0 3 0 0x88 kqread sshd
67720 160121 4642 73 3 0x1100010 0x80 kqread syslogd
4642 137261 1 0 3 0x100002 0x80 sbwait syslogd
78035 87910 1 0 2 0x100000 0x80 resolvd
*51461 472128 54143 77 7 0x100012 0x1 dhcpleased
70245 217495 54143 77 3 0x100012 0x80 kqread dhcpleased
54143 132403 1 0 3 0 0x80 kqread dhcpleased
77520 67554 0 0 3 0x14000 0x200 bored smr
89116 141042 0 0 3 0x14000 0x200 pgzero zerothread
47971 72611 0 0 3 0x14000 0x200 aiodoned aiodoned
33283 376396 0 0 3 0x14000 0x200 syncer update
82695 377424 0 0 3 0x14000 0x200 cleaner cleaner
45781 97100 0 0 3 0x14000 0x200 reaper reaper
41694 17507 0 0 3 0x14000 0x200 pgdaemon pagedaemon
79489 484637 0 0 3 0x14000 0x200 bored viomb
89530 33388 0 0 3 0x14000 0x40000200 acpi0 acpi0
92545 30145 0 0 2 0x14000 0x200 softnet0
41382 233282 0 0 2 0x14000 0x200 systqmp
13279 431360 0 0 3 0x14000 0x200 bored systq
55073 232215 0 0 3 0x14000 0x40000200 tmoslp softclock
61402 386153 0 0 3 0x14000 0x40000200 idle0
1 350330 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10010000 0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11020 12095K 12227K 166960K 12151 0
pcb 17 12K 12K 166960K 18 0
rtable 149 4K 6K 166960K 508 0
pf 22 11K 19K 166960K 47 0
ifaddr 28 5K 7K 166960K 68 0
ifgroup 34 1K 2K 166960K 74 0
sysctl 1 1K 9K 166960K 5 0
counters 29 17K 17K 166960K 40 0
ioctlops 0 0K 4K 166960K 41 0
iov 0 0K 12K 166960K 1 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1293 81K 81K 166960K 1451 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 4 0
VM map 2 1K 1K 166960K 2 0
sem 9 0K 0K 166960K 9 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 15 53K 81K 166960K 267 0
proc 74 75K 100K 166960K 662 0
subproc 72 4K 4K 166960K 144 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 5 0
in_multi 55 3K 6K 166960K 155 0
ether_multi 1 0K 0K 166960K 1 0
mrt 1 0K 0K 166960K 6 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 61 281K 281K 166960K 61 0
exec 0 0K 1K 166960K 443 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 177 159K 165K 166960K 3745 0
UVM aobj 8 2K 2K 166960K 8 0
pinsyscall 36 72K 90K 166960K 1519 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 2 0
NDP 11 0K 2K 166960K 44 0
temp 36 9106K 9126K 166960K 8132 0
kqueue 13 20K 31K 166960K 46 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 49 0 46 1 0 1 1 0 8 0
rtentry 136 166 0 100 4 0 4 4 0 8 0
unpcb 144 73 0 58 1 0 1 1 0 8 0
syncache 336 4 0 4 1 0 1 1 0 8 1
tcpcb 736 81 0 77 4 0 4 4 0 8 3
arp 96 28 0 18 1 0 1 1 0 8 0
inpcb 328 330 0 321 9 0 9 9 0 8 8
nd6 112 39 0 27 1 0 1 1 0 8 0
kcovpl 48 16 0 8 1 0 1 1 0 8 0
ppxss 1072 2 0 2 1 0 1 1 0 8 1
pfrule 1360 1 0 1 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 676 0 352 29 0 29 29 0 8 3
art_table 40 677 0 352 5 0 5 5 0 8 0
art_node 32 166 0 96 1 0 1 1 0 8 0
semupl 112 2 0 2 1 0 1 1 0 8 1
semapl 72 7 0 0 1 0 1 1 0 8 0
shmpl 112 5 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1657 0 174 93 0 93 93 0 8 0
ffsino 256 1657 0 174 93 0 93 93 0 8 0
nchpl 144 1918 0 194 65 0 65 65 0 8 0
vnodes 216 1819 0 0 102 0 102 102 0 8 0
namei 1024 7241 0 7241 2 0 2 2 0 8 2
kstatmem 264 37 0 21 2 0 2 2 0 8 0
scxspl 216 6456 0 6456 3 0 3 3 1 8 3
plimitpl 152 46 0 30 1 0 1 1 0 8 0
sigapl 424 550 0 510 6 0 6 6 0 8 1
knotepl 120 3837 0 3790 4 0 4 4 0 8 2
kqueuepl 184 51 0 42 1 0 1 1 0 8 0
pipepl 304 151 0 124 3 0 3 3 0 8 0
fdescpl 448 536 0 509 4 0 4 4 0 8 0
filepl 120 2200 0 1997 12 0 12 12 0 8 4
lockfpl 104 33 0 31 1 0 1 1 0 8 0
lockfspl 48 16 0 14 1 0 1 1 0 8 0
sessionpl 144 34 0 26 1 0 1 1 0 8 0
pgrppl 48 50 0 34 1 0 1 1 0 8 0
ucredpl 104 158 0 146 1 0 1 1 0 8 0
zombiepl 144 513 0 510 1 0 1 1 0 8 0
processpl 1152 550 0 510 4 0 4 4 0 8 0
procpl 664 643 0 603 6 0 6 6 0 8 1
sockpl 552 454 0 427 10 0 10 10 0 8 8
mcl8k 8192 4 0 4 1 0 1 1 0 8 1
mcl4k 4096 2537 0 2485 14 0 14 14 0 8 6
mcl2k 2048 266 0 264 1 0 1 1 0 8 0
mextrefs 64 67 0 66 1 0 1 1 0 8 0
mtagpl 96 4 0 4 1 0 1 1 0 8 1
mbufpl 256 5271 0 5173 16 0 16 16 0 8 7
bufpl 272 2396 0 102 153 0 153 153 0 8 0
anonpl 24 96102 0 93249 21 0 21 21 0 187 1
amapchunkpl 152 10152 0 9828 21 0 21 21 0 158 5
amappl16 200 1494 0 1482 5 0 5 5 0 8 4
amappl15 192 75 0 75 1 0 1 1 0 8 1
amappl14 184 482 0 479 1 0 1 1 0 8 0
amappl13 176 165 0 155 1 0 1 1 0 8 0
amappl12 168 822 0 797 2 0 2 2 0 8 0
amappl11 160 7 0 7 1 0 1 1 0 8 1
amappl10 152 57 0 47 1 0 1 1 0 8 0
amappl9 144 289 0 289 1 0 1 1 0 8 1
amappl8 136 183 0 180 1 0 1 1 0 8 0
amappl7 128 156 0 145 1 0 1 1 0 8 0
amappl6 120 201 0 196 1 0 1 1 0 8 0
amappl5 112 92 0 84 1 0 1 1 0 8 0
amappl4 104 277 0 261 1 0 1 1 0 8 0
amappl3 96 1870 0 1808 3 0 3 3 0 8 0
amappl2 88 627 0 564 2 0 2 2 0 8 0
amappl1 80 11123 0 10583 13 0 13 13 0 8 0
amappl 88 2945 0 2833 4 0 4 4 0 92 0
uvmvnodes 80 96 0 0 2 0 2 2 0 8 0
dma16384 16384 1 0 1 1 0 1 1 0 8 1
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 253 0 253 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 7 0 0 1 0 1 1 0 8 0
uaddrrnd 24 536 0 509 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 536 0 509 1 0 1 1 0 8 0
vmmpekpl 168 6293 0 6240 3 0 3 3 0 8 0
vmmpepl 168 43847 0 42332 80 0 80 80 0 357 8
vmsppl 368 535 0 509 4 0 4 4 0 8 1
rwobjpl 40 15619 0 14713 11 0 11 11 0 8 1
pdppl 4096 1078 0 1018 88 20 68 74 0 8 8
pvpl 32 241198 0 233782 73 0 73 73 0 265 3
pmappl 216 535 0 509 2 0 2 2 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 512 0 20 15 0 15 15 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834550b1) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(38,7f,1) at malloc+0xdb6 sys/kern/kern_malloc.c:357
ktrsyscall(ffff80002a737c90,48,30,ffff80002a791780) at ktrsyscall+0x199 sys/kern/kern_ktrace.c:174
syscall(ffff80002a791780) at syscall+0x2bc mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002a791780) at syscall+0x2bc sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7cf839298a90, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834550b1) at panic+0x1cf sys/kern/subr_prf.c:198
malloc(38,7f,1) at malloc+0xdb6 sys/kern/kern_malloc.c:357
ktrsyscall(ffff80002a737c90,48,30,ffff80002a791780) at ktrsyscall+0x199 sys/kern/kern_ktrace.c:174
syscall(ffff80002a791780) at syscall+0x2bc mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002a791780) at syscall+0x2bc sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7cf839298a90, count: -6
Struck through repros no longer work on HEAD.