panic: chgproccnt: procs < NUM

Status: upstream: reported on 2025/02/22 06:58
Reported-by: syzbot+265d5006dac2f45c9e9d@syzkaller.appspotmail.com
First crash: 544d, last: 28d

Sample crash report:
panic: chgproccnt: procs < 0
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 289807  86510      0           0        0x1    0  syz-executor
*485495  88099      0        0x10  0x4000000    1K syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83548cc9) at panic+0x1e5 sys/kern/subr_prf.c:198
chgproccnt(ee01,ffffffff) at chgproccnt+0xcc
sys_setresuid(ffff80003a3b82b8,ffff80003c3cb8a0,ffff80003c3cb7f0) at sys_setresuid+0x577 sys/kern/kern_prot.c:421
syscall(ffff80003c3cb8a0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3cb8a0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc5c75db370, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: chgproccnt: procs < 0
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83548cc9) at panic+0x1e5 sys/kern/subr_prf.c:198
chgproccnt(ee01,ffffffff) at chgproccnt+0xcc
sys_setresuid(ffff80003a3b82b8,ffff80003c3cb8a0,ffff80003c3cb7f0) at sys_setresuid+0x577 sys/kern/kern_prot.c:421
syscall(ffff80003c3cb8a0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3cb8a0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc5c75db370, count: -6
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003c3cb660
rbx               0xffff80002999ee07
rdx                                0
rcx               0xffff80003a3b82b8
rax               0xffff80002999dff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xec890c28fda47f8c
r11               0x2a344ea465399734
r12               0xffff80002999ec08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff820cded5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c3cb650
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=485495 pid=88099 tcnt=4 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003a3b9ca8,0xffff80003a3b8560
    process=0xffff80002a37d828 user=0xffff80003c3c6000, vmspace=0xffffee000f1ad7c0
    estcpu=0, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 63188  138267  77748     0  2           0          0           syz-executor
 63188  474905  77748     0  3           0  0x4000080 fsleep    syz-executor
 63188  311760  77748     0  2           0  0x4000000           syz-executor
 96221  433127  56778     0  2           0          0           syz-executor
 37164  314445  59903     0  2           0          0           syz-executor
 73768  390248      1     0  3         0x2       0x80 nanoslp   getty
 17904  496430   4179     0  3        0x10       0x80 nanoslp   syz-executor
 17904  102451   4179     0  3        0x10  0x4000080 fsleep    syz-executor
 86510  289807  60111     0  7           0        0x1           syz-executor
 86510  320428  60111     0  2           0  0x4000080           syz-executor
 86510  236469  60111     0  3           0  0x4000080 fsleep    syz-executor
 88099  433695  29446     0  2        0x10        0x1           syz-executor
 88099  350051  29446     0  2        0x10  0x4000000           syz-executor
*88099  485495  29446     0  7        0x10  0x4000000           syz-executor
 88099  201147  29446     0  3        0x10  0x4000080 fsleep    syz-executor
 23952   17136  83528     0  2           0        0x1           syz-executor
 23952  215409  83528     0  3           0  0x4000080 fifow     syz-executor
 23952  258131  83528     0  3           0  0x4000080 fsleep    syz-executor
 23952  460099  83528     0  2           0  0x4000000           syz-executor
 29446  250285    446     0  3         0x2       0x80 nanoslp   syz-executor
 83528   64034    446     0  3         0x2       0x80 nanoslp   syz-executor
 60111  454437    446     0  3         0x2       0x80 nanoslp   syz-executor
 15509  212559    446     0  2         0x2          0           syz-executor
 77748   96660    446     0  3         0x2       0x80 nanoslp   syz-executor
  4179  114878    446     0  3         0x2       0x80 nanoslp   syz-executor
 56778  473957    446     0  3         0x2       0x80 nanoslp   syz-executor
 59903  237606    446     0  3         0x2       0x80 nanoslp   syz-executor
   446  504100      1     0  3         0x2       0x80 kqread    syz-executor
 89767  149127      1     0  2    0x100800     0x2000           resolvd
 88037  227272      0     0  3     0x14000      0x200 bored     smr
 11916  380767      0     0  2     0x14000      0x200           zerothread
 52971  331406      0     0  3     0x14000      0x200 aiodoned  aiodoned
 34737   13656      0     0  3     0x14000      0x200 syncer    update
  9297  332080      0     0  3     0x14000      0x200 cleaner   cleaner
 76244   67861      0     0  3     0x14000      0x200 reaper    reaper
 89796  374393      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 95700  365948      0     0  3     0x14000      0x200 bored     viomb
 99282  516942      0     0  3     0x14000 0x40000200 acpi0     acpi0
 68403  181202      0     0  3     0x14000 0x40000200           idle1
 83671  228141      0     0  3     0x14000      0x200 bored     softnet1
 35555  399074      0     0  3     0x14000      0x200 bored     softnet0
 73390  378291      0     0  3     0x14000      0x200 bored     systqmp
 16762  278698      0     0  3     0x14000      0x200 bored     systq
 56232  247518      0     0  3     0x14000      0x200 tmoslp    softclockmp
 43380  255248      0     0  3     0x14000 0x40000200 tmoslp    softclock
 30131  384361      0     0  3     0x14000 0x40000200           idle0
     1  488355      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 37164 (syz-executor) thread 0xffff800045fee018 (314445)
exclusive rwlock vmmaplk r = 0 (0xffffee000f1adc90)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3  uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5  upageflttrap+0xa9 sys/arch/amd64/amd64/trap.c:192
#6  usertrap+0x430 sys/arch/amd64/amd64/trap.c:640
#7  recall_trap+0x8
Process 88099 (syz-executor) thread 0xffff80003a3b82b8 (485495)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b0ffc0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
#2  malloc+0xe3 sys/kern/kern_malloc.c:175
#3  uid_find+0xab sys/kern/kern_proc.c:136
#4  chgproccnt+0x39 sys/kern/kern_proc.c:-1
#5  sys_setresuid+0x577 sys/kern/kern_prot.c:421
#6  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
Process 23952 (syz-executor) thread 0xffff80002a223c98 (460099)
exclusive rrwlock inode r = 0 (0xffffee006f5f2118)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vget+0x2a2 sys/kern/vfs_subr.c:692
#6  cache_lookup+0x351 sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x1e3 sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x963 sys/kern/vfs_lookup.c:580
#10 namei+0x7c5 sys/kern/vfs_lookup.c:250
#11 ptmioctl+0x4db sys/kern/tty_pty.c:1144
#12 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#13 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#14 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#15 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#15 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#16 Xsyscall+0x128
Process 89767 (resolvd) thread 0xffff80002a223768 (149127)
exclusive rrwlock inode r = 0 (0xffffee007644e930)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vn_rdwr+0xd1 sys/kern/vfs_vnops.c:326
#6  coredump_write+0x101 sys/kern/kern_sig.c:2040
#7  coredump_elf+0x350 sys/kern/exec_elf.c:-1
#8  coredump+0x73a sys/kern/kern_sig.c:2011
#9  sigexit+0xd7 sys/kern/kern_sig.c:1833
#10 postsig+0x68b sys/kern/kern_sig.c:1763
#11 userret+0x23e sys/kern/kern_sig.c:2207
#12 syscall+0x9ce mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
#12 syscall+0x9ce sys/arch/amd64/amd64/trap.c:804
#13 Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11044  12023K   12281K 166960K     12176        0
            pcb    17     12K      12K 166960K        23        0
         rtable   239      6K       7K 166960K       353        0
             pf    34     17K      19K 166960K        49        0
         ifaddr    43      7K       7K 166960K        46        0
        ifgroup    55      2K       2K 166960K        57        0
         sysctl     3      1K       9K 166960K         7        0
       counters    70     37K      37K 166960K        72        0
       ioctlops     0      0K       4K 166960K      1488        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1288     81K      81K 166960K      1378        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     3      0K       0K 166960K         4        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     61K      85K 166960K       164        0
           proc    27     49K     164K 166960K       565        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         7        0
       in_multi    99      7K       7K 166960K       101        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    43    201K     201K 166960K        43        0
           exec     0      0K       1K 166960K       386        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   138     90K     161K 166960K      3456        0
       UVM aobj     3      2K       2K 166960K         3        0
     pinsyscall    21     42K     105K 166960K      1324        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    12      0K       2K 166960K        29        0
           temp    36   9118K    9150K 166960K      6299        0
         kqueue     2      4K      25K 166960K        31        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       34    0       32     1     0     1     1     0     8    0
rtentry    176      112    0        1     6     0     6     6     0     8    0
unpcb      144       60    0       56     1     0     1     1     0     8    0
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736       15    0       13     1     0     1     1     0     8    0
arp        136       18    0        0     1     0     1     1     0     8    0
inpcb      328       84    0       80     3     1     2     2     0     8    1
nd6        152       25    0        0     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       1    0        1     1     0     1     1     0     8    1
pffrent     40        1    0        1     1     1     0     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       22    0        0     1     0     1     1     0     8    0
pfstkey    128       22    0        0     1     0     1     1     0     8    0
pfstate    448       22    0        0     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      466    0        0    30     0    30    30     0     8    0
art_table   40      467    0        0     5     0     5     5     0     8    0
art_node    32      112    0       11     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl      72        1    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1632    0      155    93     0    93    93     0     8    0
ffsino     296     1632    0      155   114     0   114   114     0     8    0
nchpl      144     1862    0      156    64     0    64    64     0     8    0
vnodes     216     1726    0        0    96     0    96    96     0     8    0
namei      1024    5710    0     5708     9     0     9     9     0     8    8
percpumem   16       52    0        1     1     0     1     1     0     8    0
kstatmem   264       29    0        2     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     1     0     1     0     8    0
scxspl     216     7750    0     7747     4     3     1     3     1     8    0
plimitpl   152       32    0       21     1     0     1     1     0     8    0
sigapl     424      482    0      446     6     0     6     6     0     8    0
knotepl    120       59    0        0     2     0     2     2     0     8    0
kqueuepl   224       27    0       25     1     0     1     1     0     8    0
pipepl     344      127    0      100     3     0     3     3     0     8    0
fdescpl    528      466    0      446     3     0     3     3     0     8    0
filepl     160     1716    0     1545    10     0    10    10     0     8    0
lockfpl    104       15    0       14     1     0     1     1     0     8    0
lockfspl    48        8    0        7     1     0     1     1     0     8    0
sessionpl  144       25    0       22     1     0     1     1     0     8    0
pgrppl      48       33    0       22     1     0     1     1     0     8    0
ucredpl    104      130    0      120     1     0     1     1     0     8    0
zombiepl   144      452    0      452     2     1     1     1     0     8    1
processpl  1232     482    0      446     5     1     4     5     0     8    0
procpl     664      541    0      494     5     0     5     5     0     8    0
sockpl     752      180    0      170     5     0     5     5     0     8    2
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     139    0        0    18     0    18    18     0     8    0
mcl2k      2048      27    0        0     4     0     4     4     0     8    0
mextrefs    64       33    0        0     1     0     1     1     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      152    0        0    10     0    10    10     0     8    0
bufpl      272     3739    0      105   243     0   243   243     0     8    0
anonpl      32     5312    0        0    43     0    43    43     0   247    0
amapchunkpl 152    9473    0     9031    24     1    23    23     0   158    3
amappl16   200     1474    0     1460     6     4     2     5     0     8    0
amappl15   192        6    0        6     1     1     0     1     0     8    0
amappl14   184      430    0      430     1     0     1     1     0     8    1
amappl13   176      123    0      121     1     0     1     1     0     8    0
amappl12   168      717    0      698     2     0     2     2     0     8    0
amappl11   160        9    0        9     1     0     1     1     0     8    1
amappl10   152       79    0       79     1     0     1     1     0     8    1
amappl9    144      287    0      287     1     1     0     1     0     8    0
amappl8    136      103    0      103     1     0     1     1     0     8    1
amappl7    128      151    0      148     1     0     1     1     0     8    0
amappl6    120      157    0      157     1     0     1     1     0     8    1
amappl5    112       93    0       92     1     0     1     1     0     8    0
amappl4    104      306    0      301     1     0     1     1     0     8    0
amappl3     96     1628    0     1550     3     0     3     3     0     8    0
amappl2     88      549    0      542     2     0     2     2     0     8    0
amappl1     80    10500    0    10381    15     1    14    15     0     8    6
amappl      88     2669    0     2551     4     0     4     4     0    92    0
uvmvnodes   80       99    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      466    0      446     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      466    0      446     1     0     1     1     0     8    0
vmmpekpl   168     5913    0     5879     2     0     2     2     0     8    0
vmmpepl    168    39105    0    38248    86     0    86    86     0   357   34
vmsppl     488      465    0      446     5     0     5     5     0     8    1
rwobjpl     80    14456    0    14047    25     2    23    25     0     8    4
pdppl      4096     939    0      892    93    24    69    81     0     8   22
pvpl        32    11359    0        0    93     1    92    92     0   265    0
pmappl     256      465    0      446     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      520    0       28    15     0    15    15     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8392dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80002ef88d40,ffff8000002a2900) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
ktrsysret(ffff80003a3b8550,53,0,ffff80002ef88f30) at ktrsysret+0xde ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80003a3b8550,53,0,ffff80002ef88f30) at ktrsysret+0xde sys/kern/kern_ktrace.c:209
syscall(ffff80002ef88fe0) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80002ef88fe0) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f4b5f2fd6f0, count: 5
ddb{0}> trace
x86_ipi_db(ffffffff8392dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80002ef88d40,ffff8000002a2900) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b0f7c0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
ktrsysret(ffff80003a3b8550,53,0,ffff80002ef88f30) at ktrsysret+0xde ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80003a3b8550,53,0,ffff80002ef88f30) at ktrsysret+0xde sys/kern/kern_ktrace.c:209
syscall(ffff80002ef88fe0) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80002ef88fe0) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f4b5f2fd6f0, count: -10
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83548cc9) at panic+0x1e5 sys/kern/subr_prf.c:198
chgproccnt(ee01,ffffffff) at chgproccnt+0xcc
sys_setresuid(ffff80003a3b82b8,ffff80003c3cb8a0,ffff80003c3cb7f0) at sys_setresuid+0x577 sys/kern/kern_prot.c:421
syscall(ffff80003c3cb8a0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3cb8a0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc5c75db370, count: 9
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83548cc9) at panic+0x1e5 sys/kern/subr_prf.c:198
chgproccnt(ee01,ffffffff) at chgproccnt+0xcc
sys_setresuid(ffff80003a3b82b8,ffff80003c3cb8a0,ffff80003c3cb7f0) at sys_setresuid+0x577 sys/kern/kern_prot.c:421
syscall(ffff80003c3cb8a0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3cb8a0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc5c75db370, count: -6
ddb{1}> 

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/23 13:29 openbsd 6c9531571979 71a13572 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/07/11 19:33 openbsd bdda9179e659 d78ea535 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/07/05 21:32 openbsd 549eb3d3b3c2 fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/07/02 22:56 openbsd 5420d8a5f716 2b70b115 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/06/23 12:13 openbsd a7fbd22dd6cd 4b1d8f01 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2026/06/17 11:11 openbsd 2f229140c828 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/06/10 12:48 openbsd 01c8afc2223d f79bac11 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2026/05/23 22:06 openbsd 19a8be4fa5c4 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/05/11 18:40 openbsd 9c5367037e8c 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2026/04/26 21:07 openbsd 443952c09f98 9c2d0995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2026/04/18 09:57 openbsd a9044055e1bf 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/04/17 12:45 openbsd 2dd8b2a80c95 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/03/27 00:28 openbsd 9c6370df4fcd 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2026/03/24 06:56 openbsd 2084961b940b baf8bf12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/03/22 13:46 openbsd 67e6794a9e1c 5b92003d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2026/01/24 12:14 openbsd 652212f689da 40acda8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2025/11/27 22:07 openbsd 7de01a79e4ba e8331348 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2025/11/16 02:48 openbsd 42d4ce758e42 f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: chgproccnt: procs < NUM
2025/08/26 13:20 openbsd d9624900b8bd bf27483f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2025/06/18 01:39 openbsd 7cbb080c3e94 e77fae15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2025/05/17 15:40 openbsd 007267a8c99a f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2025/05/12 09:11 openbsd 1d7d4b26237d 77908e5f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
2025/02/22 06:57 openbsd 6a403588e274 d34966d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: chgproccnt: procs < NUM
* Struck through repros no longer work on HEAD.