syzbot


uvm_fault: arp_rtrequest (3)

Status: upstream: reported on 2025/02/05 13:53
Reported-by: syzbot+4d8933b9545402ed0c6b@syzkaller.appspotmail.com
First crash: 139d, last: 7h23m
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: arp_rtrequest (2) 18 261d 434d 0/3 auto-obsoleted due to no activity on 2025/01/04 11:42
openbsd uvm_fault: arp_rtrequest C 79 2213d 2223d 3/3 fixed on 2019/06/14 04:59

Sample crash report:
uvm_fault(0xffffffff839da988, 0xffff8000014a906a, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      arp_rtrequest+0x66f:    movzwl  0xc(%r15,%rbx,1),%ecx
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 23248  37423      0           0  0x4000000    0  syz-executor
 353845  31843      0         0x2          0    1  syz-executor
arp_rtrequest(ffff800000039058,1,fffffd8068a20de8) at arp_rtrequest+0x66f arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff800000039058,1,fffffd8068a20de8) at arp_rtrequest+0x66f sys/netinet/if_ether.c:184
rtrequest(1,ffff8000343eeae0,0,ffff8000343eea60,0) at rtrequest+0xc5c sys/net/route.c:1117
rtm_output(ffff8000014a7d00,ffff8000343eeb88,ffff8000343eeae0,0,0) at rtm_output+0x876 sys/net/rtsock.c:973
route_output(fffffd806ebbe800,ffff8000014c99b0) at route_output+0x9a1 sys/net/rtsock.c:878
route_send(ffff8000014c99b0,fffffd806ebbe800,0,0) at route_send+0xd7 sys/net/rtsock.c:342
sosend(ffff8000014c99b0,0,ffff8000343eed28,0,0,808) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff80002a2979c0,6,ffff8000343eee20,808,ffff8000343eeed0) at sendit+0x721 sys/kern/uipc_syscalls.c:779
sys_sendto(ffff80002a2979c0,ffff8000343eef80,ffff8000343eeed0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557
syscall(ffff8000343eef80) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000343eef80) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3fe80d33a90, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff839da988, 0xffff8000014a906a, 0, 1) -> e
ddb{0}> trace
arp_rtrequest(ffff800000039058,1,fffffd8068a20de8) at arp_rtrequest+0x66f arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff800000039058,1,fffffd8068a20de8) at arp_rtrequest+0x66f sys/netinet/if_ether.c:184
rtrequest(1,ffff8000343eeae0,0,ffff8000343eea60,0) at rtrequest+0xc5c sys/net/route.c:1117
rtm_output(ffff8000014a7d00,ffff8000343eeb88,ffff8000343eeae0,0,0) at rtm_output+0x876 sys/net/rtsock.c:973
route_output(fffffd806ebbe800,ffff8000014c99b0) at route_output+0x9a1 sys/net/rtsock.c:878
route_send(ffff8000014c99b0,fffffd806ebbe800,0,0) at route_send+0xd7 sys/net/rtsock.c:342
sosend(ffff8000014c99b0,0,ffff8000343eed28,0,0,808) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff80002a2979c0,6,ffff8000343eee20,808,ffff8000343eeed0) at sendit+0x721 sys/kern/uipc_syscalls.c:779
sys_sendto(ffff80002a2979c0,ffff8000343eef80,ffff8000343eeed0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557
syscall(ffff8000343eef80) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000343eef80) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3fe80d33a90, count: -10
ddb{0}> show registers
rdi               0xffff80002a7d8000
rsi                            0x997
rbp               0xffff8000343ee930
rbx                             0xde
rdx               0xffff80002a7d8000
rcx                0x100040600080100
rax               0xfffffd807ecd35e0
r8                              0x10
r9                0xfffffd8068a20de8
r10               0x7c86a2926657d092
r11               0x45240cfcc4643aaa
r12                             0x16
r13               0xfffffd807ecd3500
r14               0xfffffd8068a20de8
r15               0xffff8000014a8f80
rip               0xffffffff82e6a03f    arp_rtrequest+0x66f
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000343ee8b0
ss                              0x10
arp_rtrequest+0x66f:    movzwl  0xc(%r15,%rbx,1),%ecx
ddb{0}> show proc
PROC (syz-executor) tid=23248 pid=37423 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=54, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffff39b0,0xffff80002a296d00
    process=0xffff8000327e4020 user=0xffff8000343ea000, vmspace=0xfffffd806c22f5b8
    estcpu=4, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  8693  328727  31843      0  2           0                syz-executor
 87185  505597  13891      0  2           0                syz-executor
 87185   10345  13891      0  3   0x4000080  fsleep        syz-executor
  1367  402006  20511      0  2           0                syz-executor
  1367  141608  20511      0  2   0x4000000                syz-executor
  1367  112473  20511      0  2   0x4000c80                syz-executor
 93591   83707  11419     -1  2        0x10                syz-executor
 93591  509526  11419     -1  3   0x4000090  kqsel         syz-executor
 93591  477356  11419     -1  3   0x4000090  fsleep        syz-executor
 95858   55595  70978      0  3        0x80  nanoslp       syz-executor
 95858  264952  70978      0  3   0x4000080  fsleep        syz-executor
 40518  387952  77477      0  2           0                syz-executor
 40518  334295  77477      0  3   0x4000080  fsleep        syz-executor
 37423  500020  31183      0  2           0                syz-executor
*37423   23248  31183      0  7   0x4000000                syz-executor
 70978  299840  39947      0  2       0xc82                syz-executor
 90164  260308  39947      0  2         0x2                syz-executor
 20511  389652  39947      0  2       0xc82                syz-executor
 77477  459654  39947      0  2       0xc82                syz-executor
 31843  353845  39947      0  7         0x2                syz-executor
 31183   64773  39947      0  2       0xc82                syz-executor
 11419   91701  39947      0  2         0x2                syz-executor
 13891  498017  39947      0  2       0xc82                syz-executor
 39947  168611  76227      0  3        0x82  kqread        syz-executor
 76227  268086  19017      0  3    0x10008a  sigsusp       ksh
 19017  328546   9094      0  3        0x98  kqread        sshd-session
  9094  278637  49159      0  3        0x92  kqread        sshd-session
 27263  100711      1      0  3    0x100083  ttyin         getty
 49159  488163      1      0  3        0x88  kqread        sshd
 79486  259034  74738     74  3   0x1100092  bpf           pflogd
 74738  338026      1      0  3        0x80  sbwait        pflogd
 36810  331340  93487     73  3   0x1100090  kqread        syslogd
 93487  129539      1      0  3    0x100082  sbwait        syslogd
 37757  494109      1      0  3    0x100080  kqread        resolvd
 63518   42686  29028     77  3    0x100092  kqread        dhcpleased
 63159  495299  29028     77  3    0x100092  kqread        dhcpleased
 29028  464860      1      0  3        0x80  kqread        dhcpleased
  4102  312156      0      0  3     0x14200  pause         smr
 35278  187904      0      0  2     0x14200                zerothread
 11178  316088      0      0  3     0x14200  aiodoned      aiodoned
 11693  484987      0      0  3     0x14200  syncer        update
 69871  115207      0      0  3     0x14200  cleaner       cleaner
 87532   66948      0      0  3     0x14200  reaper        reaper
 52480  237121      0      0  3     0x14200  pgdaemon      pagedaemon
 74396  373745      0      0  3     0x14200  bored         viomb
 55028  520363      0      0  3  0x40014200  acpi0         acpi0
 29632   51050      0      0  3  0x40014200                idle1
 90213  377555      0      0  3     0x14200  bored         softnet3
 47470  460873      0      0  3     0x14200  bored         softnet2
 33531  178498      0      0  3     0x14200  bored         softnet1
 59320   55720      0      0  3     0x14200  bored         softnet0
 65383  112546      0      0  2     0x14200                systqmp
 38590  410692      0      0  3     0x14200  bored         systq
 20923  485003      0      0  3     0x14200  tmoslp        softclockmp
  5481  336362      0      0  2  0x40014200                softclock
 66245  483857      0      0  3  0x40014200                idle0
     1  499699      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 37423 (syz-executor) thread 0xffff80002a2979c0 (23248)
exclusive rwlock netlock r = 0 (0xffffffff8389b1e0)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rtm_output+0x78c sys/net/rtsock.c:969
#3  route_output+0x9a1 sys/net/rtsock.c:878
#4  route_send+0xd7 sys/net/rtsock.c:342
#5  sosend+0x804 sys/kern/uipc_socket.c:-1
#6  sendit+0x721 sys/kern/uipc_syscalls.c:779
#7  sys_sendto+0x8d sys/kern/uipc_syscalls.c:557
#8  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
#9  Xsyscall+0x128
exclusive rwlock sbufsnd r = 0 (0xffff8000014c9b88)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  sblock+0xb7 sys/kern/uipc_socket2.c:536
#3  sosend+0x2e2 sys/kern/uipc_socket.c:630
#4  sendit+0x721 sys/kern/uipc_syscalls.c:779
#5  sys_sendto+0x8d sys/kern/uipc_syscalls.c:557
#6  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
#7  Xsyscall+0x128
Process 90164 (syz-executor) thread 0xffff8000ffffd9a8 (260308)
exclusive rrwlock inode r = 0 (0xfffffd806bffe880)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vget+0x2bd sys/kern/vfs_subr.c:693
#6  ufs_ihashget+0x185 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1203
#8  ufs_lookup+0x19f8 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#11 namei+0x7aa sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1864
#13 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806bffeac0)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vget+0x2bd sys/kern/vfs_subr.c:693
#6  cache_lookup+0x36e sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x21b sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#10 namei+0x7aa sys/kern/vfs_lookup.c:250
#11 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1864
#12 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#13 Xsyscall+0x128
Process 31843 (syz-executor) thread 0xffff80002a2bb498 (353845)
exclusive rrwlock inode r = 0 (0xfffffd806bffee20)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x283 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
#9  domkdirat+0x179 sys/kern/vfs_syscalls.c:3109
#10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806cc99798)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3094
#8  syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#9  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83929630)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  syscall+0xae6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#1  syscall+0xae6 sys/arch/amd64/amd64/trap.c:579
#2  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10197  11102K   11232K 166960K     11300        0
            pcb    18     12K      12K 166960K        18        0
         rtable   239      7K       7K 166960K       355        0
             pf    34     17K      18K 166960K        45        0
         ifaddr    43      7K       7K 166960K        45        0
        ifgroup    55      2K       2K 166960K        55        0
         sysctl     1      1K       9K 166960K         5        0
       counters    68     36K      36K 166960K        68        0
       ioctlops     0      0K       4K 166960K      1488        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1340     84K      84K 166960K      1367        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     2      0K       0K 166960K         2        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      93K 166960K       146        0
           proc    70     91K     128K 166960K       529        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         1        0
       in_multi    99      7K       7K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    43    201K     201K 166960K        43        0
           exec     0      0K       1K 166960K       369        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   234    160K     171K 166960K      2956        0
       UVM aobj     3      2K       2K 166960K         3        0
     pinsyscall    42     84K     108K 166960K      1234        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K         3        0
            NDP    12      0K       2K 166960K        28        0
           temp    36   8682K    8746K 166960K      3957        0
         kqueue    16     24K      25K 166960K        26        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       35    0       31     1     0     1     1     0     8    0
rtentry    176      113    0        1     6     0     6     6     0     8    0
unpcb      144       34    0       16     1     0     1     1     0     8    0
syncache   336        3    0        3     1     0     1     1     0     8    1
tcpcb      736       11    0        6     1     0     1     1     0     8    0
arp        128       18    0        0     1     0     1     1     0     8    0
inpcb      328       76    0       62     2     0     2     2     0     8    0
nd6        144       25    0        0     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       20    0        0     1     0     1     1     0     8    0
pfstkey    128       20    0        0     1     0     1     1     0     8    0
pfstate    384       20    0        0     2     0     2     2     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      454    0        0    29     0    29    29     0     8    0
art_table   32      455    0        0     4     0     4     4     0     8    0
art_node    16      112    0       10     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1572    0       60    95     0    95    95     0     8    0
ffsino     288     1572    0       60   109     0   109   109     0     8    0
nchpl      144     1769    0       77    63     0    63    63     0     8    0
uvmvnodes   80     1665    0        0    34     0    34    34     0     8    0
vnodes     216     1665    0        0    93     0    93    93     0     8    0
namei      1024    5421    0     5421     1     0     1     1     0     8    1
percpumem   16       49    0        0     1     0     1     1     0     8    0
kstatmem   264       26    0        0     2     0     2     2     0     8    0
scxspl     216     5689    0     5689     4     2     2     3     1     8    2
plimitpl   152       31    0       14     1     0     1     1     0     8    0
sigapl     424      447    0      398     7     0     7     7     0     8    1
knotepl    120       52    0        0     2     0     2     2     0     8    0
kqueuepl   224       23    0       10     1     0     1     1     0     8    0
pipepl     336      104    0       77     3     0     3     3     0     8    0
fdescpl    520      429    0      398     3     0     3     3     0     8    0
filepl     160     1487    0     1257    10     0    10    10     0     8    0
lockfpl    104       10    0        8     1     0     1     1     0     8    0
lockfspl    48        6    0        4     1     0     1     1     0     8    0
sessionpl  144       22    0       13     1     0     1     1     0     8    0
pgrppl      48       30    0       13     1     0     1     1     0     8    0
ucredpl    104       81    0       67     1     0     1     1     0     8    0
zombiepl   144      398    0      398     1     0     1     1     0     8    1
processpl  1240     447    0      398     5     0     5     5     0     8    0
procpl     656      465    0      408     6     0     6     6     0     8    0
sockpl     728      145    0      109     4     0     4     4     0     8    0
mcl64k     65536      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     112    0        0    14     0    14    14     0     8    0
mcl2k      2048      18    0        0     3     0     3     3     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      150    0        0    10     0    10    10     0     8    0
bufpl      280     2303    0      122   156     0   156   156     0     8    0
anonpl      32     4022    0        0    33     0    33    33     0   246    0
amapchunkpl 152    8374    0     7899    21     0    21    21     0   158    0
amappl16   200     2149    0     2134     5     1     4     5     0     8    3
amappl15   192       49    0       49     1     1     0     1     0     8    0
amappl14   184      110    0       98     1     0     1     1     0     8    0
amappl13   176        6    0        6     1     1     0     1     0     8    0
amappl12   168     1074    0     1044     3     1     2     2     0     8    0
amappl11   160       52    0       38     1     0     1     1     0     8    0
amappl10   152        5    0        5     1     1     0     1     0     8    0
amappl9    144      245    0      245     1     1     0     1     0     8    0
amappl8    136       56    0       53     1     0     1     1     0     8    0
amappl7    128      107    0       95     1     0     1     1     0     8    0
amappl6    120      198    0      195     1     0     1     1     0     8    0
amappl5    112      209    0      200     1     0     1     1     0     8    0
amappl4    104      314    0      295     1     0     1     1     0     8    0
amappl3     96     1290    0     1181     4     1     3     3     0     8    0
amappl2     88      629    0      569     2     0     2     2     0     8    0
amappl1     80     8230    0     7632    15     0    15    15     0     8    0
amappl      88     2284    0     2123     4     0     4     4     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      429    0      398     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      429    0      398     1     0     1     1     0     8    0
vmmpekpl   168     5211    0     5173     2     0     2     2     0     8    0
vmmpepl    168    34530    0    32617    88     0    88    88     0   357    1
vmsppl     480      428    0      398     5     0     5     5     0     8    0
rwobjpl     72    14423    0    11853    49     0    49    49     0     8    0
pdppl      4096     865    0      796    99    24    75    85     0     8    6
pvpl        32     9529    0        0    77     0    77    77     0   265    0
pmappl     256      428    0      398     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      377    0       26    11     0    11    11     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
arp_rtrequest(ffff800000039058,1,fffffd8068a20de8) at arp_rtrequest+0x66f arprequest sys/netinet/if_ether.c:281 [inline]
arp_rtrequest(ffff800000039058,1,fffffd8068a20de8) at arp_rtrequest+0x66f sys/netinet/if_ether.c:184
rtrequest(1,ffff8000343eeae0,0,ffff8000343eea60,0) at rtrequest+0xc5c sys/net/route.c:1117
rtm_output(ffff8000014a7d00,ffff8000343eeb88,ffff8000343eeae0,0,0) at rtm_output+0x876 sys/net/rtsock.c:973
route_output(fffffd806ebbe800,ffff8000014c99b0) at route_output+0x9a1 sys/net/rtsock.c:878
route_send(ffff8000014c99b0,fffffd806ebbe800,0,0) at route_send+0xd7 sys/net/rtsock.c:342
sosend(ffff8000014c99b0,0,ffff8000343eed28,0,0,808) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff80002a2979c0,6,ffff8000343eee20,808,ffff8000343eeed0) at sendit+0x721 sys/kern/uipc_syscalls.c:779
sys_sendto(ffff80002a2979c0,ffff8000343eef80,ffff8000343eeed0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557
syscall(ffff8000343eef80) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000343eef80) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3fe80d33a90, count: -10
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83929428) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff83929428) at __mp_lock+0x192 sys/kern/kern_lock.c:165
syscall(ffff80002a35a860) at syscall+0xae6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a35a860) at syscall+0xae6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7599f9d3df50, count: 9
ddb{1}> trace
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83929428) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff83929428) at __mp_lock+0x192 sys/kern/kern_lock.c:165
syscall(ffff80002a35a860) at syscall+0xae6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a35a860) at syscall+0xae6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7599f9d3df50, count: -6

Crashes (214):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/24 07:05 openbsd 635eaa90b014 e2f27c35 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/24 04:02 openbsd 9729c53212e0 1a7fb460 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/23 23:53 openbsd 9729c53212e0 1a7fb460 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/23 21:20 openbsd 9729c53212e0 1a7fb460 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/23 09:51 openbsd bfd2b5c81cd0 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/23 07:11 openbsd bfd2b5c81cd0 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/23 01:12 openbsd 1d816294a660 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/22 21:24 openbsd 1d816294a660 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/22 20:17 openbsd 1d816294a660 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/22 19:13 openbsd 1d816294a660 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/22 15:17 openbsd cb7d86176520 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/22 05:51 openbsd cb7d86176520 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/22 03:40 openbsd cb7d86176520 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/21 19:51 openbsd b2c92be8430f d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/20 18:56 openbsd 58d1a60550ab e3003213 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/19 16:29 openbsd c7ecc8a6a85e ed3e87f7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/17 01:23 openbsd 07840db5e139 cfebc887 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/16 04:19 openbsd 1a751a5f99c1 5f4b362d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/16 00:09 openbsd 1a751a5f99c1 5f4b362d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/15 19:27 openbsd 1a751a5f99c1 5f4b362d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/14 08:15 openbsd f8007ba64c82 0e8da31f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/13 07:58 openbsd 8ee63da89446 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/13 04:50 openbsd 97ee8abe534f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/13 02:23 openbsd 97ee8abe534f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/12 20:58 openbsd 97ee8abe534f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/12 06:37 openbsd 2de8940ea18f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/12 05:06 openbsd 2de8940ea18f 98683f8f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/11 08:52 openbsd 410743c62795 5d7e17ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/10 21:28 openbsd a3912f8462f6 5d7e17ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/10 19:45 openbsd a3912f8462f6 5d7e17ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/10 17:45 openbsd a3912f8462f6 5d7e17ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/10 05:33 openbsd eb252dbb8be6 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: arp_rtrequest
2025/06/09 12:42 openbsd 1d858eebbab4 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/08 22:03 openbsd 394c376d8c51 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/08 17:30 openbsd 394c376d8c51 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/08 02:51 openbsd 44b12aca1c11 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/07 20:08 openbsd fa628edb87f8 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/07 13:52 openbsd fa628edb87f8 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/06 21:01 openbsd 16c80f155e04 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/06 19:22 openbsd 402b23ce0ef8 3d899f2c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/06 08:52 openbsd 402b23ce0ef8 3d899f2c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/06/05 14:13 openbsd c875838447ad 6b6b5f21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/05/25 02:14 openbsd ae496ce11df0 ed351ea7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/05/22 00:14 openbsd c902741cb17b 0919b50b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/05/21 19:12 openbsd b67b1feba291 dc5d3808 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/05/21 06:50 openbsd 1363fb036962 b47f9e02 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
2025/02/05 13:52 openbsd 9d84dc8a699e 5896748e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: arp_rtrequest
* Struck through repros no longer work on HEAD.