uvm_fault: kpageflttrap

Status: upstream: reported on 2026/08/11 10:26
Reported-by: syzbot+4c939b68dcd9e7f2dc55@syzkaller.appspotmail.com
First crash: 8d22h, last: 4d21h

Sample crash report:
uvm_fault(fffff8006b30dd78,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003c3e04f0,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80003c3e04f0) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(24900,c4504441,ffff80000161b000,1,ffff800035f934f8) at pfioctl+0x13ff sys/net/pf_ioctl.c:3241
VOP_IOCTL(fffff80073503cd8,c4504441,ffff80000161b000,1,fffff800097fd3a8,ffff800035f934f8) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff80068df78b0,c4504441,ffff80000161b000,ffff800035f934f8) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800035f934f8,ffff80003c3e10a0,ffff80003c3e0ff0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3e10a0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3e10a0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf27897e42b0, count: -18
ddb{1}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80003c3dfe10
rbx                                0
rdx               0xffff80000002a740
rcx               0xffff800035f934f8
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80003c3dfcf0
r9                0x8080808080808080
r10               0xcd91a1a7d9e2e359
r11               0x6b7e46a16da50afb
r12               0xfffff800040c12c0
r13               0xfffff800048af3e8
r14                              0x3
r15               0xffffffff83528d5f    substchar+0x436e
rip               0xffffffff82b08775    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c3dfe00
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=3239 pid=80976 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800035f93260,0xffff800035f92810
    process=0xffff80003c3b61d8 user=0xffff80003c3dc000, vmspace=0xfffff8006b30dd78
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 23279  432597  15497     0  7           0          0           syz-executor
 61260  268950  31132     0  2           0          0           syz-executor
 61260  292285  31132     0  3           0  0x4000080 fsleep    syz-executor
 71349  132318  31278     0  2           0          0           syz-executor
 71349  513463  31278     0  3           0  0x4000080 fsleep    syz-executor
 71349  282432  31278     0  3           0  0x4000080 fsleep    syz-executor
 80976  251445  91393     0  2           0          0           syz-executor
*80976    3239  91393     0  7           0  0x4000000           syz-executor
 39232  404631  75912     0  2           0          0           syz-executor
 39232  476255  75912     0  3           0  0x4000080 fsleep    syz-executor
 39232    1329  75912     0  3           0  0x4000080 fsleep    syz-executor
 97855  139855  46585     0  2           0          0           syz-executor
 97855  126601  46585     0  3           0  0x4000080 ttyopn    syz-executor
 97855  480004  46585     0  3           0  0x4000080 ttyopn    syz-executor
 97855  304680  46585     0  2           0  0x4000000           syz-executor
 85255  428458   1174     0  2           0          0           syz-executor
 85255  417672   1174     0  3           0  0x4000080 fsleep    syz-executor
 14399  497089  50704     0  2           0          0           syz-executor
 14399  391376  50704     0  3           0  0x4000080 kqsel     syz-executor
 14399   40476  50704     0  3           0  0x4000080 fsleep    syz-executor
 31132  158502  85147     0  3         0x2       0x80 nanoslp   syz-executor
 70689  104152      0     0  3     0x14000      0x280 nfsidl    nfsio
 45946  411795      0     0  3     0x14000      0x280 nfsidl    nfsio
 22994   51121      0     0  3     0x14000      0x280 nfsidl    nfsio
 66066   93622      0     0  3     0x14000      0x280 nfsidl    nfsio
 94408  431163      0     0  3     0x14000      0x280 nfsidl    nfsio
 97600  364058      0     0  3     0x14000      0x280 nfsidl    nfsio
 34726  380952      0     0  3     0x14000      0x280 nfsidl    nfsio
 36856  464995      0     0  3     0x14000      0x280 nfsidl    nfsio
  1601  264621      0     0  3     0x14000      0x280 nfsidl    nfsio
 66587  234201      0     0  3     0x14000      0x280 nfsidl    nfsio
 81503  406706      0     0  3     0x14000      0x280 nfsidl    nfsio
 15453  344568      0     0  3     0x14000      0x280 nfsidl    nfsio
 13836  272564      0     0  3     0x14000      0x280 nfsidl    nfsio
 59743  436604      0     0  3     0x14000      0x280 nfsidl    nfsio
 63140  354955      0     0  3     0x14000      0x280 nfsidl    nfsio
 22829  243287      0     0  3     0x14000      0x280 nfsidl    nfsio
  9685  213703      0     0  3     0x14000      0x280 nfsidl    nfsio
 99663  209363      0     0  3     0x14000      0x280 nfsidl    nfsio
 92559  472552      0     0  3     0x14000      0x280 nfsidl    nfsio
  4121  154936      0     0  3     0x14000      0x280 nfsidl    nfsio
 75912  422060  85147     0  3         0x2       0x80 nanoslp   syz-executor
 15497  131664  85147     0  3         0x2       0x80 nanoslp   syz-executor
 31278  222492  85147     0  3         0x2       0x80 nanoslp   syz-executor
 50704  327322  85147     0  2         0x2          0           syz-executor
 46585  473054  85147     0  3         0x2       0x80 nanoslp   syz-executor
 91393  159713  85147     0  3         0x2       0x80 nanoslp   syz-executor
  1174  333896  85147     0  3         0x2       0x80 nanoslp   syz-executor
 85147  155900  57667     0  3         0x2       0x80 kqread    syz-executor
 57667  299113  39876     0  3    0x100002       0x88 sigsusp   ksh
 39876  313710  92750     0  3        0x10       0x88 kqread    sshd-session
 92750  191689  92355     0  3        0x12       0x80 kqread    sshd-session
 26421   34393      1     0  3    0x100003       0x80 ttyin     getty
 92355  168164      1     0  3           0       0x88 kqread    sshd
 74618  327202   7505    74  3   0x1100012       0x80 bpf       pflogd
  7505   42941      1     0  3           0       0x80 sbwait    pflogd
  2468  505702  76210    73  3   0x1100010       0x80 kqread    syslogd
 76210  110535      1     0  3    0x100002       0x80 sbwait    syslogd
 28415  312067      1     0  3    0x100000       0x80 kqread    resolvd
 88724  429946  80933    77  3    0x100012       0x80 kqread    dhcpleased
 80847  344288  80933    77  3    0x100012       0x80 kqread    dhcpleased
 80933  350053      1     0  3           0       0x80 kqread    dhcpleased
  1187   63171      0     0  3     0x14000      0x200 bored     smr
 46549  514390      0     0  2     0x14000      0x200           zerothread
 42230  418801      0     0  3     0x14000      0x200 aiodoned  aiodoned
 85081   73937      0     0  3     0x14000      0x200 syncer    update
 67291  456531      0     0  3     0x14000      0x200 cleaner   cleaner
  6465  407166      0     0  3     0x14000      0x200 reaper    reaper
 45554  137519      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 74568  128707      0     0  3     0x14000      0x200 bored     viomb
 41559  321942      0     0  3     0x14000 0x40000200 acpi0     acpi0
 68998  380487      0     0  3     0x14000 0x40000200           idle1
 32241  451472      0     0  3     0x14000      0x200 bored     softnet1
 92263  176840      0     0  3     0x14000      0x200 bored     softnet0
  5298  346976      0     0  3     0x14000      0x200 smrbar    systqmp
  6677  491882      0     0  3     0x14000      0x200 bored     systq
 37229  118508      0     0  3     0x14000      0x200 tmoslp    softclockmp
 86143  519116      0     0  3     0x14000 0x40000200 tmoslp    softclock
 30886   31481      0     0  3     0x14000 0x40000200           idle0
     1  368457      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 80976 (syz-executor) thread 0xffff800035f934f8 (3239)
exclusive rwlock pf_lock r = 0 (0xffffffff839998c8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x13ca sys/net/pf_ioctl.c:3241
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff83999958)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2075
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a23880)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#4  Xsyscall+0x128
Process 5298 (systqmp) thread 0xffff800045ffea60 (346976)
shared rwlock systqmp r = 0 (0xffffffff83990c58)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11067  12182K   12418K 166960K     12354        0
            pcb    17     15K      16K 166960K       105        0
         rtable   227      7K       8K 166960K       420        0
             pf    34     17K      24K 166960K        93        0
         ifaddr    39      6K       7K 166960K        54        0
        ifgroup    51      2K       2K 166960K        68        0
         sysctl     1      1K       9K 166960K         5        0
       counters    68     36K      37K 166960K        82        0
       ioctlops     1      2K       4K 166960K      1600        0
            iov     0      0K      12K 166960K         7        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1325     83K      84K 166960K      1629        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        21        0
        dirhash    12      2K       3K 166960K        21        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    18     65K      97K 166960K       362        0
           proc    75    131K     180K 166960K       604        0
        subproc    72      4K       4K 166960K        81        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K        31        0
       in_multi    90      6K       7K 166960K       121        0
    ether_multi     1      0K       0K 166960K         3        0
            mrt     1      0K       0K 166960K         9        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       431        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   238    167K     177K 166960K      5161        0
       UVM aobj     8      2K       2K 166960K         8        0
     pinsyscall    43     86K     110K 166960K      1584        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K        14        0
            NDP    11      0K       2K 166960K        34        0
           temp    43   9119K    9137K 166960K     15313        0
         kqueue    14     22K      28K 166960K        69        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       48    0       45     1     0     1     1     0     8    0
rtentry    176      127    0       27     6     0     6     6     0     8    0
unpcb      144      243    0      226     6     0     6     6     0     8    5
syncache   336        6    0        6     1     0     1     1     0     8    1
tcpcb      736      123    0      119     7     0     7     7     0     8    6
arp        136       20    0        4     1     0     1     1     0     8    0
inpcb      328      583    0      571    12     3     9    12     0     8    8
nd6        152       31    0        9     2     0     2     2     0     8    0
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1192       4    0        4     1     0     1     1     0     8    1
pfstscr     40        4    0        2     1     0     1     1     0     8    0
pffrag     232        5    0        2     1     0     1     1     0   482    0
pffrnode    88        4    0        2     1     0     1     1     0     8    0
pffrent     40        7    0        4     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfsrclim   320        3    0        3     1     0     1     1     0     8    1
pfanchor   1288       5    0        0     1     0     1     1     0     8    0
pftag       88        7    0        0     1     0     1     1     0     8    0
pfstitem    24       48    0        0     1     0     1     1     0     8    0
pfstkey    128       50    0        2     2     0     2     2     0     8    0
pfstate    448       48    0        1     6     0     6     6     0     8    0
pfrule     1360      31    0       26     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      538    0       68    30     0    30    30     0     8    0
art_table   40      539    0       68     5     0     5     5     0     8    0
art_node    32      126    0       25     1     0     1     1     0     8    0
sysvmsgpl   40       34    0       34     1     0     1     1     0     8    1
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl      72       17    0        7     1     0     1     1     0     8    0
shmpl      112        5    0        0     1     0     1     1     0     8    0
dirhash    1024      23    0        6     3     0     3     3     0     8    0
dino2pl    256     2010    0      542    93     0    93    93     0     8    0
ffsino     296     2010    0      542   114     0   114   114     0     8    0
nchpl      144     2475    0      763    64     0    64    64     0     8    0
rtmask      32        2    0        2     1     0     1     1     0     8    1
vnodes     216     2234    0        0   125     0   125   125     0     8    0
namei      1024    8110    0     8110     2     0     2     2     0     8    2
percpumem   16       57    0        7     1     0     1     1     0     8    0
kstatmem   264       35    0       10     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216     8374    0     8374     4     3     1     3     1     8    1
plimitpl   152       54    0       36     1     0     1     1     0     8    0
sigapl     424      709    0      641     8     0     8     8     0     8    0
knotepl    120      530    0        0    17     0    17    17     0     8    0
kqueuepl   224      157    0      146     5     0     5     5     0     8    4
pipepl     344      209    0      182     9     0     9     9     0     8    6
fdescpl    528      673    0      641     3     0     3     3     0     8    0
filepl     160     3709    0     3484    19     2    17    19     0     8    7
lockfpl    104      226    0      222     1     0     1     1     0     8    0
lockfspl    48       76    0       72     1     0     1     1     0     8    0
sessionpl  144       36    0       27     1     0     1     1     0     8    0
pgrppl      48       47    0       30     1     0     1     1     0     8    0
ucredpl    104      532    0      518     1     0     1     1     0     8    0
zombiepl   144      641    0      641     1     0     1     1     0     8    1
processpl  1232     709    0      641     6     0     6     6     0     8    0
procpl     664     1086    0     1006     8     0     8     8     0     8    0
sosppl     176        1    0        1     1     0     1     1     0     8    1
sockpl     752      878    0      846    22     6    16    17     0     8   12
mcl64k     65536      5    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     116    0        0    15     0    15    15     0     8    0
mcl2k      2048      20    0        0     3     0     3     3     0     8    0
mextrefs    64       14    0        0     1     0     1     1     0     8    0
mtagpl      96        6    0        0     1     0     1     1     0     8    0
mbufpl     256      359    0        0    23     0    23    23     0     8    0
bufpl      272     3036    0      106   196     0   196   196     0     8    0
anonpl      32     7399    0        0    60     0    60    60     0   247    0
amapchunkpl 152   15038    0    14525    28     1    27    27     0   158    6
amappl16   200     1708    0     1680    14     4    10    14     0     8    7
amappl15   192        1    0        1     1     1     0     1     0     8    0
amappl14   184      454    0      453     1     0     1     1     0     8    0
amappl13   176      129    0      116     1     0     1     1     0     8    0
amappl12   168      932    0      901     2     0     2     2     0     8    0
amappl11   160        4    0        4     1     1     0     1     0     8    0
amappl10   152       64    0       50     1     0     1     1     0     8    0
amappl9    144      278    0      278     1     1     0     1     0     8    0
amappl8    136      105    0      103     1     0     1     1     0     8    0
amappl7    128      159    0      145     1     0     1     1     0     8    0
amappl6    120      202    0      201     1     0     1     1     0     8    0
amappl5    112      102    0       92     1     0     1     1     0     8    0
amappl4    104      305    0      284     1     0     1     1     0     8    0
amappl3     96     2699    0     2596     3     0     3     3     0     8    0
amappl2     88      803    0      722     2     0     2     2     0     8    0
amappl1     80    11694    0    11079    16     0    16    16     0     8    2
amappl      88     4361    0     4196     5     0     5     5     0    92    1
uvmvnodes   80      107    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        7    0        0     1     0     1     1     0     8    0
uaddrrnd    24      673    0      641     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      673    0      641     1     0     1     1     0     8    0
vmmpekpl   168     7640    0     7594     3     0     3     3     0     8    0
vmmpepl    168    51185    0    49205    95     0    95    95     0   357    8
vmsppl     488      672    0      641     5     0     5     5     0     8    1
rwobjpl     80    17018    0    15961    26     0    26    26     0     8    3
pdppl      4096    1353    0     1282   105    32    73    87     0     8    2
pvpl        32    13262    0        0   107     0   107   107     0   265    0
pmappl     256      672    0      641     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      495    0       35    14     0    14    14     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff83909ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf kd_curproc sys/dev/kcov.c:580 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf sys/dev/kcov.c:153
intr_handler(ffff800033ba6c00,ffff80000006e200) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__mp_lock(ffffffff83a23080) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a23080) at __mp_lock+0x192 sys/kern/kern_lock.c:173
syscall(ffff800033ba6dd0) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff800033ba6dd0) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7543d1c76980, count: -9
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff839d4670,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff839d4658,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffff80062c74b00,ffff80003c3e0058,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(fffff80062c74b00,1000,ffff80003c3e0128,ffff80003c3e010c,0,1,2e796642ad6e1d33,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff80003c3e0340,ffff80003c3e0378,ffff80003c3e01c0,ffff80003c3e01a8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003c3e0340,ffff80003c3e0378,ffff80003c3e02c0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffff8006b30dd78,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003c3e04f0,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80003c3e04f0) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(24900,c4504441,ffff80000161b000,1,ffff800035f934f8) at pfioctl+0x13ff sys/net/pf_ioctl.c:3241
VOP_IOCTL(fffff80073503cd8,c4504441,ffff80000161b000,1,fffff800097fd3a8,ffff800035f934f8) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff80068df78b0,c4504441,ffff80000161b000,ffff800035f934f8) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800035f934f8,ffff80003c3e10a0,ffff80003c3e0ff0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3e10a0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3e10a0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf27897e42b0, count: -18

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/15 11:02 openbsd a536f3ad0739 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: kpageflttrap
2026/08/11 10:26 openbsd 99858244924d 557a89d3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: kpageflttrap
2026/08/15 07:29 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan f02e55361321 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan uvm_fault: kpageflttrap
2026/08/13 20:57 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3be50a05e816 4d118901 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan uvm_fault: kpageflttrap
* Struck through repros no longer work on HEAD.