syzbot


assert "sc->sc_dev == NUM" failed in if_tun.c (6)

Status: upstream: reported on 2025/02/10 06:39
Reported-by: syzbot+171f3fbee35ba6030ee9@syzkaller.appspotmail.com
First crash: 9d13h, last: 5d12h
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c 24 1100d 1132d 3/3 fixed on 2022/02/16 17:50
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (2) 1 1096d 1096d 3/3 fixed on 2022/02/26 07:36
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (5) 358 92d 362d 0/3 auto-obsoleted due to no activity on 2025/01/08 15:50
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (3) 68 599d 1088d 0/3 auto-obsoleted due to no activity on 2023/09/29 16:10
openbsd assert "sc->sc_dev == NUM" failed in if_tun.c (4) 1 499d 499d 0/3 auto-obsoleted due to no activity on 2024/01/09 18:17

Sample crash report:
panic: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/net/if_tun.c", line 322
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*415566  78809      0         0x2          0    1K ifconfig
 393051  92768     77    0x100012        0x1    0  dhcpleased
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83437184) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e7c54,ffffffff833be4e8,142,ffffffff833c7d23) at __assert+0x29
tun_clone_destroy(ffff80000147f000) at tun_clone_destroy+0x38a sys/net/if_tun.c:322
if_clone_destroy(ffff80003c4f3eb0) at if_clone_destroy+0x1d7 sys/net/if.c:1383
ifioctl(ffff80000153ab98,80206979,ffff80003c4f3eb0,ffff80002a498558) at ifioctl+0x5c5
sys_ioctl(ffff80002a498558,ffff80003c4f4090,ffff80003c4f3fe0) at sys_ioctl+0x5c3
syscall(ffff80003c4f4090) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4f4090) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a1fe5b24680, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "sc->sc_dev == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/net/if_tun.c", line 322
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83437184) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e7c54,ffffffff833be4e8,142,ffffffff833c7d23) at __assert+0x29
tun_clone_destroy(ffff80000147f000) at tun_clone_destroy+0x38a sys/net/if_tun.c:322
if_clone_destroy(ffff80003c4f3eb0) at if_clone_destroy+0x1d7 sys/net/if.c:1383
ifioctl(ffff80000153ab98,80206979,ffff80003c4f3eb0,ffff80002a498558) at ifioctl+0x5c5
sys_ioctl(ffff80002a498558,ffff80003c4f4090,ffff80003c4f3fe0) at sys_ioctl+0x5c3
syscall(ffff80003c4f4090) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4f4090) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a1fe5b24680, count: -9
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003c4f3c60
rbx               0xffff800029aacdc7
rdx                                0
rcx               0xffff80002a498558
rax               0xffff800029aabff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xc7b0786b0b85eabf
r11               0x2fc586b9e7c5661a
r12               0xffff800029aacbc8
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff821de0f5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c4f3c50
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (ifconfig) tid=415566 pid=78809 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=86, usrpri=86, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a499c68,0xffffffff838b7b48
    process=0xffff80003c4edda8 user=0xffff80003c4ef000, vmspace=0xfffffd806ae7e908
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*78809  415566  12597      0  7         0x2                ifconfig
 12597  378254  42044      0  3    0x10008a  sigsusp       sh
 42044    3214  26994      0  3        0x82  wait          syz-executor
 27297  359366  44898      0  3        0x90  nanoslp       syz-executor
 27297   94504  44898      0  3   0x4000090  kqread        syz-executor
 27297  446189  44898      0  3   0x4000090  fsleep        syz-executor
 37253  441804  35607      0  3        0x80  nanoslp       syz-executor
 37253  523573  35607      0  3   0x4000080  kqsel         syz-executor
 37253  299028  35607      0  3   0x4000080  kqsel         syz-executor
 37253  233467  35607      0  3   0x4000080  fsleep        syz-executor
 99200  497720  64337      0  3        0x80  nanoslp       syz-executor
 99200   82607  64337      0  3   0x4000080  pppxread      syz-executor
 99200  127792  64337      0  3   0x4000000  inode         syz-executor
 99200  117710  64337      0  3   0x4000080  fsleep        syz-executor
 14864  484631      0      0  3     0x14200  acct          acct
 84135   42432      0      0  3     0x14280  nfsidl        nfsio
 91127   88882      0      0  3     0x14280  nfsidl        nfsio
 72079  518765      0      0  3     0x14280  nfsidl        nfsio
 33310   21332      0      0  3     0x14280  nfsidl        nfsio
 15121  110283      0      0  3     0x14280  nfsidl        nfsio
  1079  261990      0      0  3     0x14280  nfsidl        nfsio
 28759   79354      0      0  3     0x14280  nfsidl        nfsio
 73701   79961      0      0  3     0x14280  nfsidl        nfsio
 98253  390824      0      0  3     0x14280  nfsidl        nfsio
  6111  312889      0      0  3     0x14280  nfsidl        nfsio
 21868  364433      0      0  3     0x14280  nfsidl        nfsio
 60643  183496      0      0  3     0x14280  nfsidl        nfsio
 52361  136317      0      0  3     0x14280  nfsidl        nfsio
 60495  195863      0      0  3     0x14280  nfsidl        nfsio
 65283  271725      0      0  3     0x14280  nfsidl        nfsio
 12925  327520      0      0  3     0x14280  nfsidl        nfsio
 86092   13433      0      0  3     0x14280  nfsidl        nfsio
 83627  261511      0      0  3     0x14280  nfsidl        nfsio
 66377  319143      0      0  3     0x14280  nfsidl        nfsio
 72409   85334      0      0  3     0x14280  nfsidl        nfsio
 64337   40025  26994      0  3        0x82  nanoslp       syz-executor
 96860  172823      1      0  3    0x100083  ttyin         getty
 57757  184086  26994      0  3        0x82  wait          syz-executor
 96472  309783  26994      0  3        0x82  nanoslp       syz-executor
 66141  401899      0      0  3     0x14200  bored         sosplice
 98654  330881  26994      0  3         0x2  inode         syz-executor
 31490  440203  26994      0  3        0x82  wait          syz-executor
 44898  472165  26994      0  3        0x82  nanoslp       syz-executor
 35607  275309  26994      0  3        0x82  nanoslp       syz-executor
 26994  169640  46040      0  3        0x82  kqread        syz-executor
 46040  330579  26111      0  3    0x10008a  sigsusp       ksh
 26111  253086  49286      0  3        0x98  kqread        sshd-session
 49286  503575   4739      0  3        0x92  kqread        sshd-session
  4739   49925      1      0  3        0x88  kqread        sshd
 29688  134953   1197     74  3   0x1100092  bpf           pflogd
  1197   22842      1      0  3        0x80  sbwait        pflogd
 31010   46869  42239     73  3   0x1100090  kqread        syslogd
 42239  316581      1      0  3    0x100082  sbwait        syslogd
 35176  330463      1      0  3    0x100080  kqread        resolvd
 92768  393051  17828     77  7    0x100013                dhcpleased
 49669  490465  17828     77  3    0x100092  kqread        dhcpleased
 17828  411408      1      0  3        0x80  kqread        dhcpleased
 28484   21179      0      0  3     0x14200  bored         smr
 81102  232324      0      0  3     0x14200  pgzero        zerothread
 34057  336795      0      0  3     0x14200  aiodoned      aiodoned
 95761  264907      0      0  3     0x14200  syncer        update
  8346   71182      0      0  3     0x14200  cleaner       cleaner
  3851  474160      0      0  3     0x14200  reaper        reaper
 45382  203848      0      0  3     0x14200  pgdaemon      pagedaemon
 46617  409892      0      0  3     0x14200  bored         viomb
 88589  273173      0      0  3  0x40014200  acpi0         acpi0
 80302  224658      0      0  3  0x40014200                idle1
 61264  510361      0      0  3     0x14200  bored         softnet3
 23089  276856      0      0  3     0x14200  bored         softnet2
 13614  128574      0      0  3     0x14200  bored         softnet1
 36404  243240      0      0  3     0x14200  bored         softnet0
  5805  233248      0      0  3     0x14200  bored         systqmp
 33974  198791      0      0  3     0x14200  bored         systq
 26428   77231      0      0  3     0x14200  tmoslp        softclockmp
   474  425172      0      0  3  0x40014200  tmoslp        softclock
 40675   29481      0      0  3  0x40014200                idle0
     1  315031      0      0  3     0x80082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 78809 (ifconfig) thread 0xffff80002a498558 (415566)
Process 99200 (syz-executor) thread 0xffff8000318aef88 (82607)
Process 99200 (syz-executor) thread 0xffff8000318aecf8 (127792)
Process 98654 (syz-executor) thread 0xffff8000ffffd1f8 (330881)
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10206  11042K   12660K 166960K     13213        0
            pcb    17     14K      16K 166960K       260        0
         rtable   175      7K       9K 166960K       544        0
             pf    40     18K      21K 166960K       128        0
         ifaddr    38      6K       7K 166960K        91        0
        ifgroup    57      2K       2K 166960K       145        0
         sysctl     3      1K       1K 166960K         3        0
       counters    66     36K      37K 166960K       120        0
       ioctlops     0      0K       4K 166960K      1645        0
            iov     0      0K      16K 166960K        74        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1453     91K      91K 166960K      2292        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K      13K 166960K        22        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        47        0
        dirhash    12      2K       2K 166960K        33        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     232K 166960K      1201        0
          sigio     0      0K       0K 166960K        25        0
           proc    79    103K     128K 166960K       708        0
        subproc    72      4K       4K 166960K       108        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       154        0
       in_multi    73      5K       7K 166960K       173        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     0      0K       0K 166960K         3        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   103    466K     466K 166960K       103        0
           exec     0      0K       1K 166960K       540        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   228     73K      81K 166960K     12602        0
       UVM aobj    70      5K       5K 166960K        75        0
     pinsyscall    43     86K     104K 166960K      2367        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        51        0
            NDP    13      0K       1K 166960K        59        0
           temp    80   8644K    8717K 166960K     48490        0
         kqueue    14     20K      28K 166960K       211        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      244    0      241     5     4     1     3     0     8    0
rtentry    112      163    0       89     4     0     4     4     0     8    0
unpcb      144     1005    0      981    10     8     2     6     0     8    0
syncache   336        7    0        7     5     4     1     1     0     8    1
tcpqe       32        1    0        1     1     1     0     1     0     8    0
tcpcb      808      388    0      383    15    14     1     8     0     8    0
arp        120       25    0       12     1     0     1     1     0     8    0
inpcb      376     1397    0     1385    21    19     2     8     0     8    0
ip6q        72        1    0        1     1     1     0     1     0     8    0
ip6af       40        2    0        2     1     1     0     1     0     8    0
nd6        136       36    0       20     1     0     1     1     0     8    0
pkpcb       40        5    0        5     2     2     0     1     0     8    0
kcovpl      48       12    0        4     1     0     1     1     0     8    0
ppxss      1168      10    0        9     1     0     1     1     0     8    0
pppxif     1472       5    0        5     3     3     0     1     0     8    0
pfstscr     40        1    0        1     1     1     0     1     0     8    0
pffrag     232        6    0        2     2     1     1     1     0   482    0
pffrnode    88        6    0        2     2     1     1     1     0     8    0
pffrent     40        8    0        4     2     1     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288       4    0        0     1     0     1     1     0     8    0
pftag       88        4    0        0     1     0     1     1     0     8    0
pfqueue    320        2    0        1     1     0     1     1     0     8    0
pfstitem    24       80    0       13     1     0     1     1     0     8    0
pfstkey    128       84    0       17     3     0     3     3     0     8    0
pfstate    376       81    0       15     7     0     7     7     0     8    0
pfrule     1344      35    0       27     2     1     1     2     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      719    0      332    31     5    26    29     0     8    0
art_table   32      722    0      332     4     0     4     4     0     8    0
art_node    16      158    0       92     1     0     1     1     0     8    0
sysvmsgpl   40       45    0       42     1     0     1     1     0     8    0
semapl     112       44    0       34     1     0     1     1     0     8    0
shmpl      112       72    0        5     2     0     2     2     0     8    0
dirhash    1024      31    0       14     3     0     3     3     0     8    0
dino2pl    256     3375    0     1863    95     0    95    95     0     8    0
ffsino     280     3375    0     1863   109     0   109   109     0     8    0
nchpl      144     4998    0     3292    64     0    64    64     0     8    0
uvmvnodes   80     4103    0        0    84     0    84    84     0     8    0
vnodes     216     4103    0        0   228     0   228   228     0     8    0
namei      1024   17190    0    17188     2     1     1     1     0     8    0
percpumem   16       74    0       27     1     0     1     1     0     8    0
kstatmem   264       68    0       42     2     0     2     2     0     8    0
scsiplug    72        6    0        6     4     3     1     1     0     8    1
scxspl     216    15425    0    15425    13    12     1     8     1     8    1
plimitpl   152      298    0      281     1     0     1     1     0     8    0
sigapl     424     1505    0     1433    10     1     9     9     0     8    0
futexpl     64    16294    0    16291     3     2     1     1     0     8    0
knotepl    120      773    0        0    24     0    24    24     0     8    0
kqueuepl   216      474    0      461     5     4     1     5     0     8    0
pipepl     328      232    0      205     5     2     3     5     0     8    0
fdescpl    504     1464    0     1432     5     0     5     5     0     8    0
filepl     152     9728    0     9491    19     8    11    15     0     8    0
lockfpl    104      383    0      381     1     0     1     1     0     8    0
lockfspl    48      141    0      139     1     0     1     1     0     8    0
sessionpl  144       30    0       21     1     0     1     1     0     8    0
pgrppl      48       55    0       37     1     0     1     1     0     8    0
ucredpl    104     1227    0     1211     1     0     1     1     0     8    0
zombiepl   144     1436    0     1433     1     0     1     1     0     8    0
processpl  1168    1505    0     1433     7     1     6     6     0     8    0
procpl     656     3219    0     3139     8     0     8     8     0     8    0
srpgc       96        8    0        8     2     2     0     1     0     8    0
sosppl     168       15    0       15     3     2     1     1     0     8    1
sockpl     688     2730    0     2691    35    30     5    15     0     8    1
mcl64k     65536      4    0        0     1     0     1     1     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       7    0        0     1     0     1     1     0     8    0
mcl4k      4096     122    0        0    16     0    16    16     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      29    0        0     4     0     4     4     0     8    0
mtagpl      96       22    0        0     1     0     1     1     0     8    0
mbufpl     256      623    0        0    39     0    39    39     0     8    0
bufpl      280     4461    0      131   310     0   310   310     0     8    0
anonpl      24   205639    0   202165    90    48    42    70     0   184    0
amapchunkpl 152   39892    0    39393    33    11    22    27     0   158    0
amappl16   200     4219    0     4188    43    37     6    24     0     8    0
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184      123    0      111     1     0     1     1     0     8    0
amappl13   176        7    0        7     2     2     0     1     0     8    0
amappl12   168     2160    0     2128     4     2     2     3     0     8    0
amappl11   160       52    0       38     1     0     1     1     0     8    0
amappl10   152        8    0        8     2     2     0     1     0     8    0
amappl9    144      258    0      258     2     2     0     1     0     8    0
amappl8    136       24    0       21     1     0     1     1     0     8    0
amappl7    128      118    0      106     1     0     1     1     0     8    0
amappl6    120      229    0      223     1     0     1     1     0     8    0
amappl5    112      136    0      125     1     0     1     1     0     8    0
amappl4    104      338    0      317     1     0     1     1     0     8    0
amappl3     96     8163    0     8048     5     1     4     4     0     8    0
amappl2     88      717    0      653     2     0     2     2     0     8    0
amappl1     80    11833    0    11249    16     2    14    14     0     8    0
amappl      88    12106    0    11934     5     0     5     5     0    92    0
dma32768   32768      2    0        2     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     2     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       74    0        5     2     0     2     2     0     8    0
uaddrrnd    24     1464    0     1432     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1464    0     1432     1     0     1     1     0     8    0
vmmpekpl   168    12787    0    12733     3     0     3     3     0     8    0
vmmpepl    168    93823    0    91949   114    23    91   102     0   357    3
vmsppl     456     1463    0     1432     5     0     5     5     0     8    0
rwobjpl     64    30655    0    25518    86     3    83    83     0     8    0
pdppl      4096    2936    0     2864   116    42    74    86     0     8    2
pvpl        32    19557    0        0   160     2   158   158     0   265    0
pmappl     248     1463    0     1432     3     0     3     3     0     8    0
extentpl    40       55    0       38     1     0     1     1     0     8    0
phpool     112      349    0       70     9     0     9     9     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83799ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff838f29a8) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff838f29a8) at __mp_lock+0x199 sys/kern/kern_lock.c:144
softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff838f29a8) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff838f29a8) at __mp_lock+0x192 sys/kern/kern_lock.c:144
ktrstruct(ffff8000ffffb720,ffffffff83449b9a,ffff80002a363e40,20) at ktrstruct+0xe2 sys/kern/kern_ktrace.c:313
sys_kevent(ffff8000ffffb720,ffff80002a3640d0,ffff80002a364020) at sys_kevent+0x80f sys/kern/kern_event.c:1184
syscall(ffff80002a3640d0) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a3640d0) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7423873bf5d0, count: 4
ddb{0}> trace
x86_ipi_db(ffffffff83799ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff838f29a8) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff838f29a8) at __mp_lock+0x199 sys/kern/kern_lock.c:144
softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff838f29a8) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff838f29a8) at __mp_lock+0x192 sys/kern/kern_lock.c:144
ktrstruct(ffff8000ffffb720,ffffffff83449b9a,ffff80002a363e40,20) at ktrstruct+0xe2 sys/kern/kern_ktrace.c:313
sys_kevent(ffff8000ffffb720,ffff80002a3640d0,ffff80002a364020) at sys_kevent+0x80f sys/kern/kern_event.c:1184
syscall(ffff80002a3640d0) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a3640d0) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7423873bf5d0, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83437184) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e7c54,ffffffff833be4e8,142,ffffffff833c7d23) at __assert+0x29
tun_clone_destroy(ffff80000147f000) at tun_clone_destroy+0x38a sys/net/if_tun.c:322
if_clone_destroy(ffff80003c4f3eb0) at if_clone_destroy+0x1d7 sys/net/if.c:1383
ifioctl(ffff80000153ab98,80206979,ffff80003c4f3eb0,ffff80002a498558) at ifioctl+0x5c5
sys_ioctl(ffff80002a498558,ffff80003c4f4090,ffff80003c4f3fe0) at sys_ioctl+0x5c3
syscall(ffff80003c4f4090) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4f4090) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a1fe5b24680, count: 6
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83437184) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e7c54,ffffffff833be4e8,142,ffffffff833c7d23) at __assert+0x29
tun_clone_destroy(ffff80000147f000) at tun_clone_destroy+0x38a sys/net/if_tun.c:322
if_clone_destroy(ffff80003c4f3eb0) at if_clone_destroy+0x1d7 sys/net/if.c:1383
ifioctl(ffff80000153ab98,80206979,ffff80003c4f3eb0,ffff80002a498558) at ifioctl+0x5c5
sys_ioctl(ffff80002a498558,ffff80003c4f4090,ffff80003c4f3fe0) at sys_ioctl+0x5c3
syscall(ffff80003c4f4090) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4f4090) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a1fe5b24680, count: -9

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/14 07:55 openbsd 88a67239acef d9a046cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/02/13 04:48 openbsd eb8501b6f1f9 2afad16e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
2025/02/10 06:38 openbsd 275cd30cffcd ef44b750 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "sc->sc_dev == NUM" failed in if_tun.c
* Struck through repros no longer work on HEAD.