syzbot


pool: cpu free list modified: mbufpl (5)

Status: upstream: reported on 2026/02/12 22:25
Reported-by: syzbot+3c938cb8b47df8e82ebc@syzkaller.appspotmail.com
First crash: 62d, last: 23d
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: cpu free list modified: mbufpl -1 syz 15863 2080d 2367d 3/3 fixed on 2020/08/05 06:16
openbsd pool: cpu free list modified: mbufpl (2) -1 1 1391d 1391d 0/3 auto-obsoleted due to no activity on 2022/09/22 19:57
openbsd pool: cpu free list modified: mbufpl (4) -1 5 611d 730d 0/3 auto-obsoleted due to no activity on 2024/11/11 00:29
openbsd pool: cpu free list modified: mbufpl (3) -1 1 905d 905d 0/3 auto-obsoleted due to no activity on 2024/01/22 11:03

Sample crash report:
panic: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr 0xfffffd806cca6e00+16 0x0!=0xe5ed92f6193cb61e
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 458023  93166      0           0          0    1  syz-executor
*257344  90508      0     0x14000      0x200    0  softnet0
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83496177) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_cache_get(ffffffff83992018) at pool_cache_get+0x3d4 sys/kern/subr_pool.c:1906
pool_get(ffffffff83992018,2) at pool_get+0xd6 sys/kern/subr_pool.c:-1
m_get(2,3) at m_get+0x7e sys/kern/uipc_mbuf.c:240
sbappendaddr(ffff800001642fd0,ffff80002a1efca0,fffffd8071fe0e00,0) at sbappendaddr+0x24a sys/kern/uipc_socket2.c:-1
udp_sbappend(fffffd806f978b88,fffffd8071fe0e00,fffffd8071fe0ee4,0,14,fffffd8071fe0ef8,67a913f04388dc4d,14,0) at udp_sbappend+0x4c1 sys/netinet/udp_usrreq.c:705
udp_input(ffff80002a1eff90,ffff80002a1eff9c,11,2,ffffffff83ac9d98) at udp_input+0x1a34 sys/netinet/udp_usrreq.c:-1
ip_deliver(ffff80002a1eff90,ffff80002a1eff9c,11,2,1,ffffffff83ac9d98) at ip_deliver+0x42c sys/netinet/ip_input.c:-1
ip_ours(ffff80002a1eff90,ffff80002a1eff9c,0,0,ffffffff83ac9d98) at ip_ours+0xd7 sys/netinet/ip_input.c:259
ip_input_if(ffff80002a1eff90,ffff80002a1eff9c,0,0,ffff800000c31000,ffffffff83ac9d98) at ip_input_if+0x45c sys/netinet/ip_input.c:-1
ipv4_input(ffff800000c31000,fffffd8071fe0e00,ffffffff83ac9d98) at ipv4_input+0x5a sys/netinet/ip_input.c:344
if_input_process(ffff800000c31000,ffff80002a1f0078,0) at if_input_process+0x495 sys/net/if.c:1080
ifiq_process(ffff800000c314b0) at ifiq_process+0xcd sys/net/ifq.c:864
end trace frame: 0xffff80002a1f0160, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr 0xfffffd806cca6e00+16 0x0!=0xe5ed92f6193cb61e
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83496177) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_cache_get(ffffffff83992018) at pool_cache_get+0x3d4 sys/kern/subr_pool.c:1906
pool_get(ffffffff83992018,2) at pool_get+0xd6 sys/kern/subr_pool.c:-1
m_get(2,3) at m_get+0x7e sys/kern/uipc_mbuf.c:240
sbappendaddr(ffff800001642fd0,ffff80002a1efca0,fffffd8071fe0e00,0) at sbappendaddr+0x24a sys/kern/uipc_socket2.c:-1
udp_sbappend(fffffd806f978b88,fffffd8071fe0e00,fffffd8071fe0ee4,0,14,fffffd8071fe0ef8,67a913f04388dc4d,14,0) at udp_sbappend+0x4c1 sys/netinet/udp_usrreq.c:705
udp_input(ffff80002a1eff90,ffff80002a1eff9c,11,2,ffffffff83ac9d98) at udp_input+0x1a34 sys/netinet/udp_usrreq.c:-1
ip_deliver(ffff80002a1eff90,ffff80002a1eff9c,11,2,1,ffffffff83ac9d98) at ip_deliver+0x42c sys/netinet/ip_input.c:-1
ip_ours(ffff80002a1eff90,ffff80002a1eff9c,0,0,ffffffff83ac9d98) at ip_ours+0xd7 sys/netinet/ip_input.c:259
ip_input_if(ffff80002a1eff90,ffff80002a1eff9c,0,0,ffff800000c31000,ffffffff83ac9d98) at ip_input_if+0x45c sys/netinet/ip_input.c:-1
ipv4_input(ffff800000c31000,fffffd8071fe0e00,ffffffff83ac9d98) at ipv4_input+0x5a sys/netinet/ip_input.c:344
if_input_process(ffff800000c31000,ffff80002a1f0078,0) at if_input_process+0x495 sys/net/if.c:1080
ifiq_process(ffff800000c314b0) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0x157 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -15
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a1ef890
rbx               0xffffffff8391de07    cpu_info_full_primary+0x2e07
rdx                                0
rcx               0xffff8000ffffe7c8
rax               0xffffffff8391cff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xfe125ca559036b37
r11               0xd2b5fa0606d5b48f
r12               0xffffffff8391dc08    cpu_info_full_primary+0x2c08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff827a3b95    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a1ef880
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (softnet0) tid=257344 pid=90508 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=32, usrpri=51, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffffe530,0xffff8000ffffea70
    process=0xffff8000ffff84d0 user=0xffff80002a1eb000, vmspace=0xffffffff839ce468
    estcpu=1, cpticks=29, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 93166  458023  44849      0  7           0                syz-executor
 93166   48036  44849      0  2   0x4000000                syz-executor
 14968  504324  97198      0  2           0                syz-executor
  8022  104558   8250      0  2           0                syz-executor
  8022    3383   8250      0  3   0x4000080  fsleep        syz-executor
 83165  424283  80640  60929  2        0x10                syz-executor
 83165   97404  80640  60929  3   0x4000090  fsleep        syz-executor
 83165   50698  80640  60929  3   0x4000090  fsleep        syz-executor
 83165  127151  80640  60929  3   0x4000090  fsleep        syz-executor
 17022  366950  92529      0  2   0x1000000                syz-executor
 17022  338899  92529      0  3   0x5000080  fsleep        syz-executor
 58195   67482  74224  60929  2        0x10                syz-executor
 58195  309602  74224  60929  3   0x4000090  fsleep        syz-executor
 16580  509097  36175  60929  2        0x10                syz-executor
 16580  377811  36175  60929  3   0x4000090  fsleep        syz-executor
 16580  166408  36175  60929  3   0x4000090  fsleep        syz-executor
 34108  155207  22321      0  2           0                syz-executor
 34108  189913  22321      0  3   0x4000080  fsleep        syz-executor
 34108  317340  22321      0  2   0x4000000                syz-executor
 36175  178220  99228      0  2       0xc82                syz-executor
 92529   83454  99228      0  2       0xc82                syz-executor
  6424  208053      1      0  3    0x100083  ttyopn        getty
  8250  506213  99228      0  3        0x82  nanoslp       syz-executor
 44849  216070  99228      0  3        0x82  nanoslp       syz-executor
 80640  449782  99228      0  2       0xc82                syz-executor
 74224  410503  99228      0  2       0xc82                syz-executor
 97198  198739  99228      0  3        0x82  nanoslp       syz-executor
 22321   64851  99228      0  2       0xc82                syz-executor
 99228  104363  50912      0  3        0x82  kqread        syz-executor
 50912  328845  69928      0  3    0x10008a  sigsusp       ksh
 69928  450790  13201      0  3        0x98  kqread        sshd-session
 13201  451783  60468      0  3        0x92  kqread        sshd-session
 60468  458466      1      0  3        0x88  kqread        sshd
 51521  107556  67774     74  3   0x1100092  bpf           pflogd
 67774  174164      1      0  3        0x80  sbwait        pflogd
 82570  392927  22118     73  3   0x1100090  kqread        syslogd
 22118   68710      1      0  3    0x100082  sbwait        syslogd
 26954  308563      1      0  3    0x100080  kqread        resolvd
 15971  251364  41631     77  3    0x100092  kqread        dhcpleased
 29876   20163  41631     77  3    0x100092  kqread        dhcpleased
 41631   49074      1      0  3        0x80  kqread        dhcpleased
 83430  201142      0      0  3     0x14200  bored         smr
 72746  340572      0      0  2     0x14200                zerothread
   580  403204      0      0  3     0x14200  aiodoned      aiodoned
 92817  468457      0      0  3     0x14200  syncer        update
 49704  223083      0      0  3     0x14200  cleaner       cleaner
 38396  241540      0      0  3     0x14200  reaper        reaper
  1980  163442      0      0  3     0x14200  pgdaemon      pagedaemon
 26817  260426      0      0  3     0x14200  bored         viomb
 79233  265433      0      0  3  0x40014200  acpi0         acpi0
 82753  214821      0      0  3  0x40014200                idle1
 51673   86726      0      0  3     0x14200  bored         softnet1
*90508  257344      0      0  7     0x14200                softnet0
 22857  508408      0      0  3     0x14200  bored         systqmp
 57054  523130      0      0  3     0x14200  bored         systq
 45118  484156      0      0  3     0x14200  tmoslp        softclockmp
 21824   93201      0      0  3  0x40014200  tmoslp        softclock
   166   50492      0      0  3  0x40014200                idle0
     1  417448      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex sbrcv r = 0 (0xffff800001643028)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  udp_sbappend+0x4a6 sys/netinet/udp_usrreq.c:705
#3  udp_input+0x1a34 sys/netinet/udp_usrreq.c:-1
#4  ip_deliver+0x42c sys/netinet/ip_input.c:-1
#5  ip_ours+0xd7 sys/netinet/ip_input.c:259
#6  ip_input_if+0x45c sys/netinet/ip_input.c:-1
#7  ipv4_input+0x5a sys/netinet/ip_input.c:344
#8  if_input_process+0x495 sys/net/if.c:1080
#9  ifiq_process+0xcd sys/net/ifq.c:864
#10 taskq_thread+0x157 sys/kern/kern_task.c:446
#11 proc_trampoline+0x10
Process 90508 (softnet0) thread 0xffff8000ffffe7c8 (257344)
shared rwlock netlock r = 0 (0xffffffff83962840)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  if_input_process+0x1c9 sys/net/if.c:1061
#3  ifiq_process+0xcd sys/net/ifq.c:864
#4  taskq_thread+0x157 sys/kern/kern_task.c:446
#5  proc_trampoline+0x10
shared rwlock softnet0 r = 0 (0xffff80000002c078)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
exclusive mutex sbrcv r = 0 (0xffff800001643028)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  udp_sbappend+0x4a6 sys/netinet/udp_usrreq.c:705
#3  udp_input+0x1a34 sys/netinet/udp_usrreq.c:-1
#4  ip_deliver+0x42c sys/netinet/ip_input.c:-1
#5  ip_ours+0xd7 sys/netinet/ip_input.c:259
#6  ip_input_if+0x45c sys/netinet/ip_input.c:-1
#7  ipv4_input+0x5a sys/netinet/ip_input.c:344
#8  if_input_process+0x495 sys/net/if.c:1080
#9  ifiq_process+0xcd sys/net/ifq.c:864
#10 taskq_thread+0x157 sys/kern/kern_task.c:446
#11 proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11110  12104K   13041K 166960K     14574        0
            pcb    17     16K      18K 166960K       752        0
         rtable   238     20K      22K 166960K      1011        0
             pf    46     20K      83K 166960K       268        0
         ifaddr    41      7K       8K 166960K       171        0
        ifgroup    60      2K       2K 166960K       253        0
         sysctl     4      1K       9K 166960K        24        0
       counters    74     37K      38K 166960K       260        0
       ioctlops     0      0K       4K 166960K      1935        0
            iov     0      0K      24K 166960K       113        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1505     95K      95K 166960K      3513        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        26        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       180        0
        dirhash    12      2K       2K 166960K        48        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     240K 166960K      2252        0
          sigio     0      0K       0K 166960K        73        0
           proc    73    115K     164K 166960K      1010        0
        subproc    72      4K       4K 166960K       153        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       322        0
       in_multi    76      5K       7K 166960K       317        0
    ether_multi     1      0K       0K 166960K        32        0
            mrt     1      0K       0K 166960K        49        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   241   1076K    1076K 166960K       241        0
           exec     0      0K       1K 166960K       885        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   240    151K     175K 166960K     22227        0
       UVM aobj    59     18K      18K 166960K        65        0
     pinsyscall    43     86K     106K 166960K      3622        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       194        0
            NDP    14      0K       1K 166960K       113        0
           temp    80   9084K    9152K 166960K     94603        0
         kqueue    14     22K      33K 166960K       403        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      346    0      343     5     4     1     3     0     8    0
rtentry    176      288    0      208     7     2     5     6     0     8    0
unpcb      144     1461    0     1440    12    10     2     5     0     8    1
syncache   336        8    0        8     5     5     0     1     0     8    0
tcpqe       32       11    0       11     3     3     0     1     0     8    0
tcpcb      736      806    0      799    20    19     1     7     0     8    0
arp        136       47    0       33     1     0     1     1     0     8    0
inpcb      328     3077    0     3066    34    21    13    13     0     8   11
nd6        152       61    0       41     1     0     1     1     0     8    0
pkpcb       40        8    0        8     6     6     0     1     0     8    0
kcovpl      48       17    0        9     1     0     1     1     0     8    0
ppxss      1192      66    0       66     6     5     1     1     0     8    1
pppxif     1576      10    0       10     5     4     1     1     0     8    1
pfstscr     40        1    0        1     1     1     0     1     0     8    0
pffrag     232       16    0        5     1     0     1     1     0   482    0
pffrnode    88       14    0        5     1     0     1     1     0     8    0
pffrent     40       24    0       13     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344      10    0        7     3     2     1     1     0     8    0
pfanchor   1288       1    0        0     1     0     1     1     0     8    0
pftag       88        4    0        0     1     0     1     1     0     8    0
pfstitem    24      188    0      103     1     0     1     1     0     8    0
pfstkey    128      192    0      107     3     0     3     3     0     8    0
pfstate    448      190    0      105    13     3    10    13     0     8    0
pfrule     1360      39    0       26     3     1     2     2     0     8    0
rttmr      136        3    0        3     3     3     0     1     0     8    0
art_heap8  4096       6    0        0     6     0     6     6     0     8    0
art_heap4  256     1247    0      896    40    14    26    29     0     8    1
art_table   40     1253    0      896     5     0     5     5     0     8    0
art_node    32      283    0      216     1     0     1     1     0     8    0
sysvmsgpl   40       43    0        3     2     1     1     1     0     8    0
semupl     112        3    0        3     3     3     0     1     0     8    0
semapl     112      173    0      163     1     0     1     1     0     8    0
shmpl      112       54    0        5     2     0     2     2     0     8    0
dirhash    1024      41    0       24     3     0     3     3     0     8    0
dino2pl    256     5607    0     4126    94     0    94    94     0     8    0
ffsino     296     5607    0     4126   116     1   115   115     0     8    0
nchpl      144     8537    0     6811    65     0    65    65     0     8    0
rtmask      32       10    0       10     5     4     1     1     0     8    1
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   30054    0    30054     6     5     1     2     0     8    1
percpumem   16      145    0       93     1     0     1     1     0     8    0
vcpupl     3968       8    0        1     1     0     1     1     0     8    0
vmpool     848        8    0        1     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        0     1     0     1     1     0     8    0
kstatmem   264      158    0      124     4     1     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        9    0        9     5     4     1     1     0     8    1
scxspl     216    77374    0    77374    13    12     1     8     1     8    1
plimitpl   152      719    0      700     1     0     1     1     0     8    0
sigapl     424     2542    0     2494     8     2     6     8     0     8    0
knotepl    120      801    0        0    24     0    24    24     0     8    0
kqueuepl   224      743    0      732    12    10     2     5     0     8    1
pipepl     344      392    0      364     3     0     3     3     0     8    0
fdescpl    528     2504    0     2472     3     0     3     3     0     8    0
filepl     160    16589    0    16358    33    17    16    16     0     8    3
lockfpl    104     1057    0     1053     3     2     1     2     0     8    0
lockfspl    48      413    0      409     1     0     1     1     0     8    0
sessionpl  144       36    0       27     1     0     1     1     0     8    0
pgrppl      48       83    0       66     1     0     1     1     0     8    0
ucredpl    104     2594    0     2578     1     0     1     1     0     8    0
zombiepl   144     3142    0     3142     2     1     1     1     0     8    1
processpl  1232    2542    0     2494     6     1     5     6     0     8    0
procpl     664     6154    0     6095     9     3     6     8     0     8    0
sosppl     176       16    0       15     7     6     1     1     0     8    0
sockpl     752     4976    0     4940    56    39    17    18     0     8   12
mcl64k     65536     11    0        0     2     0     2     2     0     8    0
mcl16k     16384      7    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     117    0        0    15     0    15    15     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      52    0        0     6     0     6     6     0     8    0
mtagpl      96       10    0        0     1     0     1     1     0     8    0
mbufpl     256     1879    0        0   115     0   115   115     0     8    0
bufpl      280    32362    0    26232   440     1   439   439     0     8    0
anonpl      32    14840    0        0   120     0   120   120     0   246    0
amapchunkpl 152   76944    0    76447    72    46    26    48     0   158    2
amappl16   200    10927    0    10894   102    93     9    35     0     8    0
amappl15   192        8    0        8     2     2     0     1     0     8    0
amappl14   184      537    0      536     1     0     1     1     0     8    0
amappl13   176      153    0      141     1     0     1     1     0     8    0
amappl12   168     2798    0     2768     2     0     2     2     0     8    0
amappl11   160       29    0       29     1     1     0     1     0     8    0
amappl10   152       67    0       53     1     0     1     1     0     8    0
amappl9    144      255    0      255     1     1     0     1     0     8    0
amappl8    136      163    0      160     1     0     1     1     0     8    0
amappl7    128      178    0      165     1     0     1     1     0     8    0
amappl6    120      249    0      247     1     0     1     1     0     8    0
amappl5    112      107    0       96     1     0     1     1     0     8    0
amappl4    104      347    0      324     1     0     1     1     0     8    0
amappl3     96    15463    0    15349     5     1     4     4     0     8    0
amappl2     88      622    0      561     2     0     2     2     0     8    0
amappl1     80    19720    0    19107    19     5    14    17     0     8    0
amappl      88    20984    0    20814     5     0     5     5     0    92    0
uvmvnodes   80      184    0        0     4     0     4     4     0     8    0
dma32768   32768      1    0        1     1     1     0     1     0     8    0
dma8192    8192       1    0        1     1     1     0     1     0     8    0
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma2048    2048       1    0        1     1     1     0     1     0     8    0
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma512     512        1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      259    0      259     5     4     1     1     0     8    1
dma64       64        8    0        8     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       64    0        6     2     0     2     2     0     8    0
uaddrrnd    24     2504    0     2472     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2504    0     2472     1     0     1     1     0     8    0
vmmpekpl   168    20543    0    20493     3     0     3     3     0     8    0
vmmpepl    168   166045    0   164072   142    38   104   117     0   357    0
vmsppl     488     2503    0     2472     6     1     5     5     0     8    0
rwobjpl     80    46975    0    45785    42     5    37    38     0     8    0
pdppl      4096    5031    0     4953   126    47    79    85     0     8    1
pvpl        32    25480    0        0   206     1   205   205     0   265    0
pmappl     256     2511    0     2473     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      467    0      101    11     0    11    11     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83496177) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_cache_get(ffffffff83992018) at pool_cache_get+0x3d4 sys/kern/subr_pool.c:1906
pool_get(ffffffff83992018,2) at pool_get+0xd6 sys/kern/subr_pool.c:-1
m_get(2,3) at m_get+0x7e sys/kern/uipc_mbuf.c:240
sbappendaddr(ffff800001642fd0,ffff80002a1efca0,fffffd8071fe0e00,0) at sbappendaddr+0x24a sys/kern/uipc_socket2.c:-1
udp_sbappend(fffffd806f978b88,fffffd8071fe0e00,fffffd8071fe0ee4,0,14,fffffd8071fe0ef8,67a913f04388dc4d,14,0) at udp_sbappend+0x4c1 sys/netinet/udp_usrreq.c:705
udp_input(ffff80002a1eff90,ffff80002a1eff9c,11,2,ffffffff83ac9d98) at udp_input+0x1a34 sys/netinet/udp_usrreq.c:-1
ip_deliver(ffff80002a1eff90,ffff80002a1eff9c,11,2,1,ffffffff83ac9d98) at ip_deliver+0x42c sys/netinet/ip_input.c:-1
ip_ours(ffff80002a1eff90,ffff80002a1eff9c,0,0,ffffffff83ac9d98) at ip_ours+0xd7 sys/netinet/ip_input.c:259
ip_input_if(ffff80002a1eff90,ffff80002a1eff9c,0,0,ffff800000c31000,ffffffff83ac9d98) at ip_input_if+0x45c sys/netinet/ip_input.c:-1
ipv4_input(ffff800000c31000,fffffd8071fe0e00,ffffffff83ac9d98) at ipv4_input+0x5a sys/netinet/ip_input.c:344
if_input_process(ffff800000c31000,ffff80002a1f0078,0) at if_input_process+0x495 sys/net/if.c:1080
ifiq_process(ffff800000c314b0) at ifiq_process+0xcd sys/net/ifq.c:864
taskq_thread(ffff80000002c000) at taskq_thread+0x157 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -15
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299bdff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x747fbbf3bcd0, count: 12
ddb{1}> trace
x86_ipi_db(ffff8000299bdff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x747fbbf3bcd0, count: -3

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/24 03:33 openbsd 2084961b940b baf8bf12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: cpu free list modified: mbufpl
2026/02/12 22:24 openbsd 829f23bb157c 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: cpu free list modified: mbufpl
* Struck through repros no longer work on HEAD.