panic: free: size too small NUM <= NUM / NUM (ADDR) type rtable

Status: upstream: reported on 2026/09/16 07:13
Reported-by: syzbot+1d541b1f981283ce5398@syzkaller.appspotmail.com
First crash: 4d02h, last: 4d02h

Sample crash report:
panic: free: size too small 8 <= 32 / 2 (0xffff800001625380) type rtable
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 199656  80041      0           0          0    1  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83536012) at panic+0x1e5 sys/kern/subr_prf.c:198
free(ffff800001625380,5,8) at free+0x690 sys/kern/kern_malloc.c:387
rtfree(fffff2006cc5add0) at rtfree+0x347 sys/net/route.c:641
rt_ifa_purge(ffff800001626a00) at rt_ifa_purge+0x1a0 sys/net/route.c:1481
in6_unlink_ifa(ffff800001626a00,ffff80000160a000) at in6_unlink_ifa+0x83f sys/netinet6/in6.c:938
in6_ifdetach(ffff80000160a000) at in6_ifdetach+0x9e sys/netinet6/in6_ifattach.c:416
if_detach(ffff80000160a000) at if_detach+0x30f sys/net/if.c:1314
tun_clone_destroy(ffff80000160a000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a2ec0c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d02,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a2ec180) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff200783c77c8,7,fffff200097fd2d8,ffff800045ffd9f8) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff2006cecc400,ffff800045ffd9f8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff2006cecc400,ffff800045ffd9f8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
end trace frame: 0xffff80002a2ec2a0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: free: size too small 8 <= 32 / 2 (0xffff800001625380) type rtable
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83536012) at panic+0x1e5 sys/kern/subr_prf.c:198
free(ffff800001625380,5,8) at free+0x690 sys/kern/kern_malloc.c:387
rtfree(fffff2006cc5add0) at rtfree+0x347 sys/net/route.c:641
rt_ifa_purge(ffff800001626a00) at rt_ifa_purge+0x1a0 sys/net/route.c:1481
in6_unlink_ifa(ffff800001626a00,ffff80000160a000) at in6_unlink_ifa+0x83f sys/netinet6/in6.c:938
in6_ifdetach(ffff80000160a000) at in6_ifdetach+0x9e sys/netinet6/in6_ifattach.c:416
if_detach(ffff80000160a000) at if_detach+0x30f sys/net/if.c:1314
tun_clone_destroy(ffff80000160a000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a2ec0c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d02,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a2ec180) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff200783c77c8,7,fffff200097fd2d8,ffff800045ffd9f8) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff2006cecc400,ffff800045ffd9f8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff2006cecc400,ffff800045ffd9f8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff2006cecc400,ffff800045ffd9f8) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff2006cecc400,ffff800045ffd9f8) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045ffd9f8) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045ffd9f8,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045ffd9f8,ffff80002a2ec4f0,ffff80002a2ec440) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a2ec4f0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2ec4f0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x785a4b85db70, count: -21
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a2ebcf0
rbx               0xffffffff8398be0f    cpu_info_full_primary+0x2e0f
rdx                                0
rcx               0xffff800045ffd9f8
rax               0xffffffff8398aff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xcf2f1baa0c2ea57e
r11                 0x2cab435918e26a
r12               0xffffffff8398bc10    cpu_info_full_primary+0x2c10
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff8261c3b5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a2ebce0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=308681 pid=63359 tcnt=0 stat=onproc
    flags process=a<EXEC,EXITING> proc=2000<WEXIT>
    runpri=32, usrpri=76, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80002a22c2a8,0xffff800045ffdca0
    process=0xffff800045ff5818 user=0xffff80002a2e7000, vmspace=0xfffff2000b1f7d58
    estcpu=26, cpticks=12, pctcpu=0.6, user=0, sys=2, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 52605  126754  17799     0  2  0x10100002          0           sh
  9808   90690  41509     0  3         0x2          0 clonelk   ifconfig
 41509  254779  14263     0  3    0x100002       0x88 sigsusp   sh
 80041  199656  67910     0  7           0          0           syz-executor
 80041   73804  67910     0  3           0  0x4000080 ttyin     syz-executor
 14263   57732  17422     0  3         0x2       0x80 wait      syz-executor
 68752  329910  93590     0  3           0       0x80 nanoslp   syz-executor
 68752  319365  93590     0  3           0  0x4000080 fsleep    syz-executor
 68752  312233  93590     0  3           0  0x4000080 fsleep    syz-executor
 68752  461715  93590     0  3           0  0x4000080 lockf     syz-executor
 17799  184986  17422     0  3         0x2       0x80 wait      syz-executor
 67910  473579  17422     0  3         0x2       0x80 nanoslp   syz-executor
 36724  126441  17422     0  3         0x2       0x80 piperd    syz-executor
 93590  503145  17422     0  3         0x2       0x80 nanoslp   syz-executor
 40430   44147  17422     0  3         0x2       0x80 piperd    syz-executor
 17422  375653  26603     0  3         0x2       0x80 wait      syz-executor
 26603  160327   3690     0  3    0x100002       0x88 sigsusp   ksh
  3690  378646  57710     0  3        0x10       0x88 kqread    sshd-session
 57710  447381  33180     0  3        0x12       0x80 kqread    sshd-session
 17177   37313      1     0  3    0x100003       0x80 ttyin     getty
 33180  367657      1     0  3           0       0x88 kqread    sshd
 89660  125484  54325    74  3   0x1100012       0x80 bpf       pflogd
 54325  389314      1     0  3           0       0x80 sbwait    pflogd
 31109  312075  17210    73  3   0x1100010       0x80 kqread    syslogd
 17210  116292      1     0  3    0x100002       0x80 sbwait    syslogd
 31844  506867      1     0  3    0x100000       0x80 kqread    resolvd
  4862   89590  79157    77  3    0x100012       0x80 kqread    dhcpleased
 23002  365736  79157    77  3    0x100012       0x80 kqread    dhcpleased
 79157  181085      1     0  3           0       0x80 kqread    dhcpleased
 24030  510812      0     0  3     0x14000      0x200 bored     smr
 63351  463865      0     0  2     0x14000      0x200           zerothread
 82321  270470      0     0  3     0x14000      0x200 aiodoned  aiodoned
  2637   95833      0     0  3     0x14000      0x200 syncer    update
 98360  310415      0     0  3     0x14000      0x200 cleaner   cleaner
  8265    6495      0     0  3     0x14000      0x200 reaper    reaper
 98811  486202      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 45393  182235      0     0  3     0x14000      0x200 bored     viomb
 20386   22788      0     0  3     0x14000 0x40000200 acpi0     acpi0
 99061  428143      0     0  3     0x14000 0x40000200           idle1
 93699   32162      0     0  3     0x14000      0x200 bored     softnet1
 77239  390599      0     0  3     0x14000      0x200 bored     softnet0
 13301  164331      0     0  3     0x14000      0x200 smrbar    systqmp
 50634  383993      0     0  3     0x14000      0x200 bored     systq
 53931  345331      0     0  3     0x14000      0x200 tmoslp    softclockmp
 28367  391197      0     0  3     0x14000 0x40000200 tmoslp    softclock
  5215  303565      0     0  3     0x14000 0x40000200           idle0
     1  309731      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff839a7bb8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  free+0x9f sys/kern/kern_malloc.c:393
#3  rtfree+0x347 sys/net/route.c:641
#4  rt_ifa_purge+0x1a0 sys/net/route.c:1481
#5  in6_unlink_ifa+0x83f sys/netinet6/in6.c:938
#6  in6_ifdetach+0x9e sys/netinet6/in6_ifattach.c:416
#7  if_detach+0x30f sys/net/if.c:1314
#8  tun_clone_destroy+0x2ce sys/net/if_tun.c:343
#9  if_clone_destroy+0x205 sys/net/if.c:1479
#10 tun_dev_close+0x1d9 sys/net/if_tun.c:526
#11 spec_close+0x417 sys/kern/spec_vnops.c:-1
#12 VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
#13 vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
#13 vn_closefile+0x12b sys/kern/vfs_vnops.c:621
#14 fdrop+0x121 sys/kern/kern_descrip.c:1281
#15 closef+0x192 sys/kern/kern_descrip.c:1265
#16 fdfree+0x116 sys/kern/kern_descrip.c:1196
#17 exit1+0x595 sys/kern/kern_exit.c:215
#18 sys_exit+0x1a sys/kern/kern_exit.c:-1
Process 13301 (systqmp) thread 0xffff800045ffe298 (164331)
shared rwlock systqmp r = 0 (0xffffffff838f5ba8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11052  12083K   12158K 166960K     12314        0
            pcb    17     12K      12K 166960K        26        0
         rtable   222      9K       9K 166960K       631        0
             pf    32     17K      21K 166960K        69        0
         ifaddr    38      6K       7K 166960K        81        0
        ifgroup    51      2K       2K 166960K        92        0
         sysctl     3      1K       9K 166960K         8        0
       counters    68     36K      37K 166960K        90        0
       ioctlops     0      0K       4K 166960K      1501        0
            iov     0      0K      16K 166960K        41        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1381     87K      87K 166960K      1725        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     2      0K       0K 166960K         4        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    15     53K      97K 166960K       325        0
          sigio     0      0K       0K 166960K         1        0
           proc    78    131K     164K 166960K       792        0
        subproc    72      4K       4K 166960K       153        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K        15        0
       in_multi    83      5K       6K 166960K       189        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    55    254K     254K 166960K        55        0
           exec     0      0K       1K 166960K       503        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   200    160K     167K 166960K      4347        0
       UVM aobj     4      2K       2K 166960K         5        0
     pinsyscall    40     80K     105K 166960K      1733        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         5        0
            NDP    19      1K       2K 166960K        53        0
           temp    37   9122K    9142K 166960K     10450        0
         kqueue    13     20K      24K 166960K        42        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       89    0       86     2     0     2     2     0     8    1
rtentry    176      202    0      107     6     0     6     6     0     8    0
unpcb      144       71    0       53     1     0     1     1     0     8    0
syncache   336        5    0        5     1     0     1     1     0     8    1
tcpcb      736       32    0       26     1     0     1     1     0     8    0
arp        136       34    0       20     1     0     1     1     0     8    0
inpcb      328      159    0      149     2     0     2     2     0     8    0
nd6        152       48    0       28     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48       17    0        9     1     0     1     1     0     8    0
ppxss      1192       1    0        1     1     0     1     1     0     8    1
pppxif     1576       1    0        1     1     0     1     1     0     8    1
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        2    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       36    0        0     1     0     1     1     0     8    0
pfstkey    128       36    0        0     2     0     2     2     0     8    0
pfstate    448       36    0        0     4     0     4     4     0     8    0
pfrule     1360      22    0       16     2     0     2     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      822    0      410    29     0    29    29     0     8    1
art_table   40      824    0      410     5     0     5     5     0     8    0
art_node    32      202    0      108     1     0     1     1     0     8    0
shmpl      112        2    0        1     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1696    0      213    93     0    93    93     0     8    0
ffsino     296     1696    0      213   115     0   115   115     0     8    0
nchpl      144     1977    0      247    65     0    65    65     0     8    0
vnodes     216     2128    0        0   119     0   119   119     0     8    0
namei      1024    8148    0     8148     3     1     2     2     0     8    2
percpumem   16       61    0       11     1     0     1     1     0     8    0
kstatmem   264       45    0       20     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216     6720    0     6720     4     3     1     3     1     8    1
plimitpl   152      184    0      166     1     0     1     1     0     8    0
sigapl     424      636    0      590     7     0     7     7     0     8    1
knotepl    120      275    0        0     9     0     9     9     0     8    0
kqueuepl   224      142    0      132     1     0     1     1     0     8    0
pipepl     344      161    0      134     4     0     4     4     0     8    1
fdescpl    528      620    0      591     3     0     3     3     0     8    0
filepl     160     2476    0     2226    13     0    13    13     0     8    2
lockfpl    104       38    0       34     1     0     1     1     0     8    0
lockfspl    48       17    0       14     1     0     1     1     0     8    0
sessionpl  144       35    0       26     1     0     1     1     0     8    0
pgrppl      48       53    0       36     1     0     1     1     0     8    0
ucredpl    104      187    0      174     1     0     1     1     0     8    0
zombiepl   144      593    0      590     1     0     1     1     0     8    0
processpl  1232     636    0      590     5     0     5     5     0     8    1
procpl     664      780    0      730     6     0     6     6     0     8    1
sockpl     752      325    0      294     7     0     7     7     0     8    3
mcl64k     65536      1    0        0     1     0     1     1     0     8    0
mcl9k128   9344       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     113    0        0    15     0    15    15     0     8    0
mcl2k      2048      16    0        0     2     0     2     2     0     8    0
mextrefs    64       12    0        0     1     0     1     1     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      394    0        0    25     0    25    25     0     8    0
bufpl      272     2451    0      105   157     0   157   157     0     8    0
anonpl      32     7489    0        0    61     0    61    61     0   247    0
amapchunkpl 152   12019    0    11647    22     0    22    22     0   158    5
amappl16   200     1756    0     1741    16     3    13    14     0     8   12
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184      539    0      536     1     0     1     1     0     8    0
amappl13   176      141    0      129     1     0     1     1     0     8    0
amappl12   168      912    0      885     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       65    0       50     1     0     1     1     0     8    0
amappl9    144      277    0      277     1     1     0     1     0     8    0
amappl8    136      137    0      134     1     0     1     1     0     8    0
amappl7    128      182    0      168     1     0     1     1     0     8    0
amappl6    120      237    0      233     1     0     1     1     0     8    0
amappl5    112      126    0      116     1     0     1     1     0     8    0
amappl4    104      322    0      304     1     0     1     1     0     8    0
amappl3     96     2158    0     2081     3     0     3     3     0     8    0
amappl2     88      717    0      644     2     0     2     2     0     8    0
amappl1     80    12067    0    11469    15     0    15    15     0     8    2
amappl      88     3436    0     3309     4     0     4     4     0    92    0
uvmvnodes   80      100    0        0     3     0     3     3     0     8    0
dma65536   65536      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     1     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        4    0        1     1     0     1     1     0     8    0
uaddrrnd    24      620    0      591     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      620    0      591     1     0     1     1     0     8    0
vmmpekpl   168     7080    0     7031     3     0     3     3     0     8    0
vmmpepl    168    49189    0    47495    95     0    95    95     0   357   14
vmsppl     488      619    0      591     5     0     5     5     0     8    0
rwobjpl     80    17168    0    16165    27     0    27    27     0     8    2
pdppl      4096    1247    0     1182   111    36    75    87     0     8   10
pvpl        32    14207    0        0   115     0   115   115     0   265    0
pmappl     256      619    0      591     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      457    0       39    12     0    12    12     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83536012) at panic+0x1e5 sys/kern/subr_prf.c:198
free(ffff800001625380,5,8) at free+0x690 sys/kern/kern_malloc.c:387
rtfree(fffff2006cc5add0) at rtfree+0x347 sys/net/route.c:641
rt_ifa_purge(ffff800001626a00) at rt_ifa_purge+0x1a0 sys/net/route.c:1481
in6_unlink_ifa(ffff800001626a00,ffff80000160a000) at in6_unlink_ifa+0x83f sys/netinet6/in6.c:938
in6_ifdetach(ffff80000160a000) at in6_ifdetach+0x9e sys/netinet6/in6_ifattach.c:416
if_detach(ffff80000160a000) at if_detach+0x30f sys/net/if.c:1314
tun_clone_destroy(ffff80000160a000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a2ec0c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d02,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a2ec180) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff200783c77c8,7,fffff200097fd2d8,ffff800045ffd9f8) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff2006cecc400,ffff800045ffd9f8) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff2006cecc400,ffff800045ffd9f8) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff2006cecc400,ffff800045ffd9f8) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff2006cecc400,ffff800045ffd9f8) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800045ffd9f8) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800045ffd9f8,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800045ffd9f8,ffff80002a2ec4f0,ffff80002a2ec440) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a2ec4f0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2ec4f0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x785a4b85db70, count: -21
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x7eaf38001690, count: 12
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x7eaf38001690, count: -3

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/16 07:12 openbsd bc65308b1c9e 12a0a44a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too small NUM <= NUM / NUM (ADDR) type rtable
* Struck through repros no longer work on HEAD.