syzbot


panic: thread NUM p_stat is NUM (4)

Status: upstream: reported on 2026/05/20 11:27
Reported-by: syzbot+39fb0d2c2137c688a8f4@syzkaller.appspotmail.com
First crash: 6d19h, last: 4d06h
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: thread NUM p_stat is NUM (2) 2 3 554d 620d 0/3 auto-obsoleted due to no activity on 2025/02/16 11:25
openbsd panic: thread NUM p_stat is NUM 2 1 773d 773d 0/3 auto-obsoleted due to no activity on 2024/07/12 13:03
openbsd panic: thread NUM p_stat is NUM (3) 2 1 108d 108d 0/3 auto-obsoleted due to no activity on 2026/05/08 22:54

Sample crash report:
panic: thread 0 p_stat is 0
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83507a4c) at panic+0x1cf sys/kern/subr_prf.c:198
wakeup_n(ffff80000002c000,1) at wakeup_n+0x3af
task_add(ffff80000002c000,ffff8000002a24d8) at task_add+0x15a sys/kern/kern_task.c:372
ifiq_input(ffff8000002a2490,ffff8000314b7180) at ifiq_input+0x4af sys/net/ifq.c:784
vio_rxeof(ffff80000002fc00) at vio_rxeof+0x429 sys/dev/pv/if_vio.c:1626
vio_rx_intr(ffff8000002a3000) at vio_rx_intr+0x98 sys/dev/pv/if_vio.c:1642
intr_handler(ffff8000314b72c0,ffff8000002a1600) at intr_handler+0xcb sys/arch/amd64/amd64/intr.c:-1
Xintr_ioapic_edge25_untramp() at Xintr_ioapic_edge25_untramp+0x18f
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x9e sys/dev/kcov.c:158
uvm_objtree_RBT_COMPARE(ffff8000314b7428,fffffd800773b700) at uvm_objtree_RBT_COMPARE+0x27 sys/uvm/uvm_page.c:-1
_rb_find(ffffffff838729c8,fffffd805feaf990,ffff8000314b7428) at _rb_find+0x68 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd805feaf980,c9a000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd805feaf980,c9a000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214
buf_map(fffffd805feaf8c0) at buf_map+0x2a6 sys/kern/vfs_biomem.c:-1
end trace frame: 0xffff8000314b76b0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: thread 0 p_stat is 0
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83507a4c) at panic+0x1cf sys/kern/subr_prf.c:198
wakeup_n(ffff80000002c000,1) at wakeup_n+0x3af
task_add(ffff80000002c000,ffff8000002a24d8) at task_add+0x15a sys/kern/kern_task.c:372
ifiq_input(ffff8000002a2490,ffff8000314b7180) at ifiq_input+0x4af sys/net/ifq.c:784
vio_rxeof(ffff80000002fc00) at vio_rxeof+0x429 sys/dev/pv/if_vio.c:1626
vio_rx_intr(ffff8000002a3000) at vio_rx_intr+0x98 sys/dev/pv/if_vio.c:1642
intr_handler(ffff8000314b72c0,ffff8000002a1600) at intr_handler+0xcb sys/arch/amd64/amd64/intr.c:-1
Xintr_ioapic_edge25_untramp() at Xintr_ioapic_edge25_untramp+0x18f
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x9e sys/dev/kcov.c:158
uvm_objtree_RBT_COMPARE(ffff8000314b7428,fffffd800773b700) at uvm_objtree_RBT_COMPARE+0x27 sys/uvm/uvm_page.c:-1
_rb_find(ffffffff838729c8,fffffd805feaf990,ffff8000314b7428) at _rb_find+0x68 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd805feaf980,c9a000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd805feaf980,c9a000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1214
buf_map(fffffd805feaf8c0) at buf_map+0x2a6 sys/kern/vfs_biomem.c:-1
buf_get(0,0,ffd000) at buf_get+0x5be sys/kern/vfs_bio.c:1163
geteblk(ffd000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff83064980,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d01,84946467,ffff800001583000,3,ffff8000300b0548) at sdioctl+0x959 sys/scsi/sd.c:919
VOP_IOCTL(fffffd80767511f0,84946467,ffff800001583000,3,fffffd8007ffd820,ffff8000300b0548) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd8075d34530,84946467,ffff800001583000,ffff8000300b0548) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff8000300b0548,ffff8000314b7b80,ffff8000314b7ad0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff8000314b7b80) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff8000314b7b80) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa9ad67e9e80, count: -23
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000314b6f80
rbx               0xffff80002a6ec298
rdx               0xffff8000015e7a00
rcx                                0
rax               0xffff8000300b0548
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xde43fb36aeb99011
r11               0xb93766e3992f2c2e
r12                                0
r13                             0xfd
r14                                0
r15                              0x1
rip               0xffffffff82b64e75    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff8000314b6f70
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb> show proc
PROC () tid=342070 pid=0 tcnt=0 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=81, usrpri=82, slppri=32, nice=0
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000300b1a08,0xffff8000300b07f0
    process=0xffff80002a866420 user=0xffff8000314b2000, vmspace=0xfffffd806c976e78
    estcpu=32, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11059  12104K   12432K 166960K     13096        0
            pcb    17     14K      22K 166960K       239        0
         rtable   163      4K       7K 166960K       455        0
             pf    33     13K      21K 166960K        73        0
         ifaddr    33      5K       7K 166960K        62        0
        ifgroup    50      2K       2K 166960K        83        0
         sysctl     3      1K       9K 166960K        13        0
       counters    33     17K      18K 166960K        43        0
       ioctlops     1      2K       4K 166960K       346        0
            iov     0      0K      16K 166960K        29        0
          mount     1      1K       1K 166960K         1        0
            log     2      0K       0K 166960K         6        0
         vnodes  1413     89K      89K 166960K      1969        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         8        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K        84        0
        dirhash    12      2K       2K 166960K        21        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    15     57K     232K 166960K       633        0
          sigio     0      0K       0K 166960K         4        0
           proc    20     25K     108K 166960K       583        0
        subproc    72      4K       4K 166960K        83        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        88        0
       in_multi    66      5K       7K 166960K       140        0
    ether_multi     1      0K       0K 166960K         8        0
            mrt     1      0K       0K 166960K        28        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   235   1049K    1049K 166960K       235        0
           exec     0      0K       1K 166960K       456        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   113     81K     167K 166960K      7152        0
       UVM aobj    14      2K       2K 166960K        15        0
     pinsyscall    19     38K      93K 166960K      1761        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K        51        0
            NDP    11      0K       2K 166960K        42        0
           temp    75   9116K    9180K 166960K     25970        0
         kqueue     1      2K      32K 166960K       143        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      101    0      101     2     1     1     2     0     8    1
rtentry    136      143    0       73     4     0     4     4     0     8    0
unpcb      144      344    0      344     4     3     1     4     0     8    1
syncache   336        6    0        6     1     1     0     1     0     8    0
tcpcb      736      176    0      174     7     6     1     7     0     8    0
arp         96       21    0        7     1     0     1     1     0     8    0
inpcb      328      646    0      643    12    10     2    12     0     8    1
nd6        112       31    0       16     1     0     1     1     0     8    0
pkpcb       40        3    0        3     2     1     1     1     0     8    1
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1072       5    0        5     1     1     0     1     0     8    0
pfstscr     40        2    0        0     1     0     1     1     0     8    0
pffrag     232        3    0        1     1     0     1     1     0   482    0
pffrnode    88        3    0        1     1     0     1     1     0     8    0
pffrent     40        8    0        6     1     0     1     1     0     8    0
pfanchor   1288       3    0        0     1     0     1     1     0     8    0
pfstitem    24        2    0        0     1     0     1     1     0     8    0
pfstkey    128        2    0        0     1     0     1     1     0     8    0
pfstate    384        1    0        0     1     0     1     1     0     8    0
pfrule     1360       6    0        5     1     0     1     1     0     8    0
rttmr      136        4    0        4     2     1     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      678    0      372    30     0    30    30     0     8    4
art_table   40      679    0      372     5     0     5     5     0     8    0
art_node    32      143    0       79     1     0     1     1     0     8    0
sysvmsgpl   40       10    0        0     1     0     1     1     0     8    0
semapl      64       82    0       72     1     0     1     1     0     8    0
shmpl      112       12    0        1     1     0     1     1     0     8    0
dirhash    1024      23    0        6     3     0     3     3     0     8    0
dirhash: pool(0xffffffff83a26428:dirhash): free list modified: page 0xffff80002a778000; item ordinal 0; addr 0xffff80002a778800 (p 0xfffffd806ee74000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff80002a778000; item ordinal 0; addr 0xffff80002a778800 (p 0xfffffd806ee74000); offset 0x0=0x0
dirhash: pool(0xffffffff83a26428:dirhash): page inconsistency: page 0xffff80002a778000; item ordinal 1; addr 0xd8aba53c7035b456
dino2pl    256     2540    0     1082    92     0    92    92     0     8    0
ffsino     256     2540    0     1082    92     0    92    92     0     8    0
nchpl      144     3425    0     1731    64     0    64    64     0     8    0
vnodes     216     2964    0        0   165     0   165   165     0     8    0
namei      1024   12274    0    12274     2     1     1     2     0     8    1
namei: pool(0xffffffff83a075c0:namei): free list modified: page 0xffff80002a748000; item ordinal 0; addr 0xffff80002a748800 (p 0xfffffd807f7e2000); offset 0x0=0x0
pool(namei): free list modified: page 0xffff80002a748000; item ordinal 0; addr 0xffff80002a748800 (p 0xfffffd807f7e2000); offset 0x0=0x0
namei: pool(0xffffffff83a075c0:namei): page inconsistency: page 0xffff80002a748000; item ordinal 1; addr 0x8b4cb98696dcebff
kstatmem   264       43    0       20     3     1     2     3     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216    17080    0    17080     8     7     1     8     1     8    1
plimitpl   152      161    0      150     1     0     1     1     0     8    0
sigapl     424      937    0      906     8     2     6     8     0     8    0
knotepl    120    22081    0    22064    16     8     8    10     0     8    6
kqueuepl   184      250    0      249     4     3     1     4     0     8    0
pipepl     304      161    0      134     3     0     3     3     0     8    0
fdescpl    448      905    0      886     5     1     4     5     0     8    0
filepl     120     6083    0     5928    15     5    10    15     0     8    1
lockfpl    104      492    0      492     2     1     1     2     0     8    1
lockfspl    48       70    0       70     1     0     1     1     0     8    1
sessionpl  144       48    0       45     1     0     1     1     0     8    0
pgrppl      48       59    0       48     1     0     1     1     0     8    0
ucredpl    104     1009    0     1006     1     0     1     1     0     8    0
zombiepl   144      981    0      980     1     0     1     1     0     8    0
processpl  1152     938    0      906     5     0     5     5     0     8    0
processpl: pool(0xffffffff83a29188:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002a867f90 (p 0xffff80002a864000)
procpl     664     1694    0     1656     7     1     6     7     0     8    1
procpl: pool(0xffffffff83a28fd0:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a6edf90 (p 0xffff80002a6ec000)
procpl: pool(0xffffffff83a28fd0:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a767f90 (p 0xffff80002a766000)
sosppl     176        1    0        1     1     1     0     1     0     8    0
sockpl     552     1174    0     1171    12    10     2    12     0     8    1
mcl64k     65536     91    0       91     2     1     1     1     0     8    1
mcl9k128   9344       1    0        1     1     1     0     1     0     8    0
mcl8k      8192       7    0        7     1     1     0     1     0     8    0
mcl4k      4096    3170    0     3113    15     6     9    14     0     8    1
mcl2k      2048     659    0      658     4     3     1     4     0     8    0
mtagpl      96        8    0        6     1     0     1     1     0     8    0
mbufpl     256     9626    0     9494    18     1    17    18     0     8    2
bufpl      280     6284    0      105   442     0   442   442     0     8    0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/23 00:01 openbsd dbd5cf8c5e8a c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: thread NUM p_stat is NUM
2026/05/22 10:04 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: thread NUM p_stat is NUM
2026/05/20 11:27 openbsd 4cd34baf9f06 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: thread NUM p_stat is NUM
* Struck through repros no longer work on HEAD.