pool: free list modified: shmpl (6)

Status: upstream: reported on 2025/02/04 10:40
Reported-by: syzbot+640f5b53834a8559e680@syzkaller.appspotmail.com
First crash: 554d, last: 10d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: shmpl (3) -1 1 2260d 2260d 0/4 auto-closed as invalid on 2020/09/01 15:24
openbsd pool: free list modified: shmpl -1 syz, C 22 2625d 2719d 3/4 fixed on 2019/10/29 17:45
openbsd pool: free list modified: shmpl (5) -1 43 632d 724d 0/4 auto-obsoleted due to no activity on 2025/01/07 01:02
openbsd pool: free list modified: shmpl (2) -1 1 2441d 2441d 0/4 auto-closed as invalid on 2020/03/04 23:09
openbsd pool: free list modified: shmpl (4) -1 1 1002d 1002d 0/4 auto-obsoleted due to no activity on 2024/02/11 22:36

Sample crash report:
panic: pool_do_get: shmpl free list modified: page 0xfffffd806f49f000; item addr 0xfffffd806f49fda0; offset 0x40=0x6a6e41c1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  26701  64528      0           0          0    1  syz-executor
*285591  88632  60929        0x10  0x4000000    0K syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834af52a) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_do_get(ffffffff83a84f00,9,ffff80002a260608) at pool_do_get+0x5df
pool_get(ffffffff83a84f00,9) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff80003b7b9cb8,ffff80002a260860,22,ffff80002a2607b0) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff80003b7b9cb8,ffff80002a260860,ffff80002a2607b0) at sys_shmget+0x195 sys/kern/sysv_shm.c:503
syscall(ffff80002a260860) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a260860) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf923b05d9d0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: pool_do_get: shmpl free list modified: page 0xfffffd806f49f000; item addr 0xfffffd806f49fda0; offset 0x40=0x6a6e41c1
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834af52a) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_do_get(ffffffff83a84f00,9,ffff80002a260608) at pool_do_get+0x5df
pool_get(ffffffff83a84f00,9) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff80003b7b9cb8,ffff80002a260860,22,ffff80002a2607b0) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff80003b7b9cb8,ffff80002a260860,ffff80002a2607b0) at sys_shmget+0x195 sys/kern/sysv_shm.c:503
syscall(ffff80002a260860) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a260860) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf923b05d9d0, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a260430
rbx               0xffffffff83957e07    cpu_info_full_primary+0x2e07
rdx                                0
rcx               0xffff80003b7b9cb8
rax               0xffffffff83956ff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x48cd46b90e08822d
r11               0x6e1b2c4cd5f8e656
r12               0xffffffff83957c08    cpu_info_full_primary+0x2c08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff8185e235    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a260420
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=285591 pid=88632 tcnt=3 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a238fc8,0xffff80003b7b8808
    process=0xffff80002a37c9b8 user=0xffff80002a25b000, vmspace=0xfffffd8077c223e8
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 64528   26701  70513     0  7           0          0           syz-executor
 64528  247214  70513     0  2           0  0x4000000           syz-executor
 96958  421304   1302     0  2   0x1000000          0           syz-executor
 96958   34713   1302     0  3   0x1000000  0x4000080 fsleep    syz-executor
 60119  263331  57751     0  2           0          0           syz-executor
 60119  240938  57751     0  3           0  0x4000080 fsleep    syz-executor
  7319  144575   5392     0  2           0          0           syz-executor
  7319  239523   5392     0  3           0  0x4000000 biowait   syz-executor
  7319    9891   5392     0  3           0  0x4000000 inode     syz-executor
  7319  252388   5392     0  3           0  0x4000080 fsleep    syz-executor
 88632  339192  13663 60929  2        0x10          0           syz-executor
*88632  285591  13663 60929  7        0x10  0x4000000           syz-executor
 88632   69641  13663 60929  3        0x10  0x4000080 fsleep    syz-executor
 91362  445709  94891     0  2           0        0x1           syz-executor
 91362  169902  94891     0  3           0  0x4000080 fsleep    syz-executor
 91362  466709  94891     0  3           0  0x4000080 fsleep    syz-executor
 78291  331847  11665     0  2           0          0           syz-executor
 78291  295956  11665     0  2           0  0x4000001           syz-executor
 78291    5727  11665     0  3           0  0x4000080 fsleep    syz-executor
 78291   52684  11665     0  3           0  0x4000080 fsleep    syz-executor
 27928  473768      0     0  3     0x14000      0x280 nfsidl    nfsio
 93995  234338      0     0  3     0x14000      0x280 nfsidl    nfsio
 75482   23516      0     0  3     0x14000      0x280 nfsidl    nfsio
 69911  251548      0     0  3     0x14000      0x280 nfsidl    nfsio
 45486  163446      0     0  3     0x14000      0x280 nfsidl    nfsio
 88929  432324      0     0  3     0x14000      0x280 nfsidl    nfsio
 73262  142485      0     0  3     0x14000      0x280 nfsidl    nfsio
 29449  443485      0     0  3     0x14000      0x280 nfsidl    nfsio
 35250  178924      0     0  3     0x14000      0x280 nfsidl    nfsio
  6181  494631      0     0  3     0x14000      0x280 nfsidl    nfsio
 68224    7223      0     0  3     0x14000      0x280 nfsidl    nfsio
 70047   81321      0     0  3     0x14000      0x280 nfsidl    nfsio
 96433  366967      0     0  3     0x14000      0x280 nfsidl    nfsio
 93606  386844      0     0  3     0x14000      0x280 nfsidl    nfsio
 79271  155549      0     0  3     0x14000      0x280 nfsidl    nfsio
 24040  117652      0     0  3     0x14000      0x280 nfsidl    nfsio
 18070  492934      0     0  3     0x14000      0x280 nfsidl    nfsio
 77597  457952      0     0  3     0x14000      0x280 nfsidl    nfsio
 88683  168972      0     0  3     0x14000      0x280 nfsidl    nfsio
  3823  399704      0     0  3     0x14000      0x280 nfsidl    nfsio
 23922  252778      1     0  3    0x100003       0x80 ttyin     getty
  1302  113122  88694     0  3         0x2       0x80 nanoslp   syz-executor
 11665  398954  88694     0  3         0x2       0x80 nanoslp   syz-executor
  5392  478384  88694     0  3         0x2       0x80 nanoslp   syz-executor
 94891  419152  88694     0  3         0x2       0x80 nanoslp   syz-executor
 57751   59838  88694     0  3         0x2       0x80 nanoslp   syz-executor
 82850   29408  88694     0  3         0x2       0x80 nanoslp   syz-executor
 70513  272640  88694     0  3         0x2       0x80 nanoslp   syz-executor
 13663  277314  88694     0  3         0x2       0x80 nanoslp   syz-executor
 88694  132643      1     0  3         0x2       0x80 kqread    syz-executor
 68061  221197      0     0  3     0x14000      0x200 bored     smr
 40626  312723      0     0  2     0x14000      0x200           zerothread
 71709   56299      0     0  3     0x14000      0x200 aiodoned  aiodoned
 29136   26594      0     0  3     0x14000      0x200 syncer    update
  1376  169036      0     0  3     0x14000      0x200 cleaner   cleaner
 32915  468131      0     0  2     0x14000      0x200           reaper
 20606  405690      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 14402  453682      0     0  3     0x14000      0x200 bored     viomb
 70454  482008      0     0  3     0x14000 0x40000200 acpi0     acpi0
 57362  254356      0     0  3     0x14000 0x40000200           idle1
 50937   29437      0     0  3     0x14000      0x200 bored     softnet1
 97064  372831      0     0  3     0x14000      0x200 bored     softnet0
 84563  312426      0     0  3     0x14000      0x200 bored     systqmp
 67641  504880      0     0  3     0x14000      0x200 bored     systq
 16503  147728      0     0  3     0x14000      0x200 tmoslp    softclockmp
 63815  412774      0     0  3     0x14000 0x40000200 tmoslp    softclock
 25525  299690      0     0  3     0x14000 0x40000200           idle0
     1  373445      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex shmpl r = 0 (0xffffffff83a84f18)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pool_get+0x124 sys/kern/subr_pool.c:585
#3  shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
#4  sys_shmget+0x195 sys/kern/sysv_shm.c:503
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
Process 64528 (syz-executor) thread 0xffff80002a238038 (247214)
exclusive rrwlock inode r = 0 (0xfffffd80701d1310)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
#6  namei+0x7c5 sys/kern/vfs_lookup.c:250
#7  vn_open+0x22e sys/kern/vfs_vnops.c:109
#8  doopenat+0x35b sys/kern/vfs_syscalls.c:1163
#9  sys_open+0x59 sys/kern/vfs_syscalls.c:1065
#10 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
Process 7319 (syz-executor) thread 0xffff80003b7b9a20 (239523)
exclusive rrwlock inode r = 0 (0xfffffd8060eac1f0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vn_write+0x18f sys/kern/vfs_vnops.c:411
#6  dofilewritev+0x2bd sys/kern/sys_generic.c:384
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
Process 88632 (syz-executor) thread 0xffff80003b7b9cb8 (285591)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83adda40)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
exclusive mutex shmpl r = 0 (0xffffffff83a84f18)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pool_get+0x124 sys/kern/subr_pool.c:585
#3  shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
#4  sys_shmget+0x195 sys/kern/sysv_shm.c:503
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
Process 32915 (reaper) thread 0xffff800045ffdc90 (468131)
exclusive rwlock kmmaplk r = 0 (0xffffffff83a92dc0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5170
#3  uvm_unmap+0x7d sys/uvm/uvm_map.c:1798
#4  km_free+0x85 sys/uvm/uvm_km.c:714
#5  uvm_uarea_free+0x4f sys/uvm/uvm_glue.c:304
#6  reaper+0x1ca sys/kern/kern_exit.c:495
#7  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11052  12081K   12403K 166960K     12382        0
            pcb    17     14K      15K 166960K        71        0
         rtable   211      6K       7K 166960K       399        0
             pf    34     17K      24K 166960K        82        0
         ifaddr    40      7K       7K 166960K        56        0
        ifgroup    51      2K       2K 166960K        73        0
         sysctl     3      1K       9K 166960K         8        0
       counters    68     36K      37K 166960K        86        0
       ioctlops     0      0K       4K 166960K      1548        0
            iov     0      0K       4K 166960K         7        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         5        0
         vnodes  1384     87K      87K 166960K      1676        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         5        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        16        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     61K      89K 166960K       317        0
          sigio     0      0K       0K 166960K         6        0
           proc    21     33K     180K 166960K       570        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        15        0
       in_multi    91      6K       6K 166960K       112        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         8        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    61    281K     281K 166960K        61        0
           exec     0      0K       1K 166960K       411        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   132     82K     178K 166960K      4905        0
       UVM aobj    75      3K       3K 166960K        76        0
     pinsyscall    19     38K     103K 166960K      1507        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         8        0
            NDP    11      0K       2K 166960K        34        0
           temp    41   9119K    9154K 166960K     10126        0
         kqueue     2      4K      24K 166960K        62        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       79    0       77     3     2     1     2     0     8    0
rtentry    176      120    0       27     6     0     6     6     0     8    0
unpcb      144      117    0      117     1     0     1     1     0     8    1
syncache   336        5    0        5     2     1     1     1     0     8    1
tcpcb      736       80    0       78     4     0     4     4     0     8    3
arp        136       19    0        3     1     0     1     1     0     8    0
inpcb      328      336    0      332    13     6     7     7     0     8    6
nd6        152       28    0        4     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       6    0        6     1     0     1     1     0     8    1
pfstscr     40       33    0       33     1     0     1     1     0     8    1
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfsrclim   320        2    0        2     1     0     1     1     0     8    1
pfanchor   1288       9    0        0     1     0     1     1     0     8    0
pfstitem    24       44    0        0     1     0     1     1     0     8    0
pfstkey    128      110    0       66     2     0     2     2     0     8    0
pfstate    448       76    0       33     5     0     5     5     0     8    0
pfrule     1360      23    0       18     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      536    0       87    29     0    29    29     0     8    0
art_table   40      537    0       87     5     0     5     5     0     8    0
art_node    32      120    0       36     1     0     1     1     0     8    0
sysvmsgpl   40        4    0        4     2     1     1     1     0     8    1
semapl      72       14    0        4     1     0     1     1     0     8    0
shmpl      112       73    0        1     3     0     3     3     0     8    0
pool(0xffffffff83a84f00:shmpl): page inconsistency: page 0xfffffd806f49f000; 32 on list, 2 missing, 35 items per page
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     1912    0      436    93     0    93    93     0     8    0
ffsino     296     1912    0      436   114     0   114   114     0     8    0
nchpl      144     2352    0      648    64     0    64    64     0     8    0
vnodes     216     2245    0        0   125     0   125   125     0     8    0
namei      1024    7428    0     7427     3     2     1     3     0     8    0
percpumem   16       59    0        9     1     0     1     1     0     8    0
kstatmem   264       39    0       14     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216    10199    0    10198    12     4     8     8     1     8    7
plimitpl   152       43    0       30     1     0     1     1     0     8    0
sigapl     424      664    0      608     8     1     7     7     0     8    0
knotepl    120      507    0        0    16     0    16    16     0     8    0
kqueuepl   224       72    0       70     1     0     1     1     0     8    0
pipepl     344      140    0      113     3     0     3     3     0     8    0
fdescpl    528      628    0      609     3     0     3     3     0     8    0
filepl     160     2941    0     2778    15     3    12    12     0     8    3
lockfpl    104      134    0      133     1     0     1     1     0     8    0
lockfspl    48       64    0       63     1     0     1     1     0     8    0
sessionpl  144       38    0       35     1     0     1     1     0     8    0
pgrppl      48       48    0       37     1     0     1     1     0     8    0
ucredpl    104      350    0      344     1     0     1     1     0     8    0
zombiepl   144      718    0      717     1     0     1     1     0     8    0
processpl  1232     664    0      608     5     0     5     5     0     8    0
procpl     664     1009    0      940     8     1     7     7     0     8    0
sosppl     176        2    0        0     1     0     1     1     0     8    0
sockpl     752      535    0      529    17     8     9    10     0     8    7
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl9k128   9344       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     119    0        0    15     0    15    15     0     8    0
mcl2k      2048      25    0        0     4     0     4     4     0     8    0
mextrefs    64       22    0        0     1     0     1     1     0     8    0
mtagpl      96        6    0        0     1     0     1     1     0     8    0
mbufpl     256     1681    0        0   106     0   106   106     0     8    0
bufpl      272     4799    0      105   313     0   313   313     0     8    0
anonpl      32     5937    0        0    48     0    48    48     0   247    0
amapchunkpl 152   14395    0    14039    27     9    18    26     0   158    2
amappl16   200     1690    0     1655     5     3     2     5     0     8    0
amappl15   192       14    0       14     1     1     0     1     0     8    0
amappl14   184      441    0      441     2     1     1     1     0     8    1
amappl13   176      130    0      129     1     0     1     1     0     8    0
amappl12   168      887    0      869     2     0     2     2     0     8    0
amappl11   160       10    0       10     1     1     0     1     0     8    0
amappl10   152       63    0       63     1     1     0     1     0     8    0
amappl9    144      278    0      277     1     0     1     1     0     8    0
amappl8    136      112    0      112     1     1     0     1     0     8    0
amappl7    128      155    0      153     1     0     1     1     0     8    0
amappl6    120      171    0      171     1     1     0     1     0     8    0
amappl5    112       98    0       97     1     0     1     1     0     8    0
amappl4    104      298    0      295     1     0     1     1     0     8    0
amappl3     96     2712    0     2632     3     0     3     3     0     8    0
amappl2     88      556    0      547     2     0     2     2     0     8    0
amappl1     80    11345    0    11221    14     6     8    14     0     8    0
amappl      88     4064    0     3946     4     0     4     4     0    92    0
uvmvnodes   80      102    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        8    0        8     2     1     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       75    0        1     2     0     2     2     0     8    0
uaddrrnd    24      628    0      609     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      628    0      609     1     0     1     1     0     8    0
vmmpekpl   168     7115    0     7078     2     0     2     2     0     8    0
vmmpepl    168    48758    0    47888    87    45    42    87     0   357    1
vmsppl     488      627    0      608     5     1     4     5     0     8    0
rwobjpl     80    16642    0    16132    24     3    21    24     0     8    0
pdppl      4096    1263    0     1216   103    56    47    83     0     8    0
pvpl        32     9958    0        0    81     0    81    81     0   265    0
pmappl     256      627    0      608     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      692    0       62    19     0    19    19     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}>

Crashes (925):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/01 18:58 openbsd 59ec3ab4d107 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/31 18:59 openbsd 6bf809100faf db462e94 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/31 04:45 openbsd aa7f4357c308 0a1bc234 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/30 21:06 openbsd a3419d81e108 0a1bc234 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/30 15:14 openbsd a3419d81e108 0a1bc234 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/28 21:42 openbsd e63b2cdac76f 5fe7c56f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/27 15:58 openbsd 03525b20a4f0 1f273138 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/24 17:12 openbsd 969775618695 dd737a83 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/07/24 12:42 openbsd 969775618695 dd737a83 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/07/23 15:41 openbsd 6c9531571979 71a13572 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/21 14:34 openbsd 20200149c668 7c5de9c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/19 19:07 openbsd 2fc221d2874b 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/19 01:39 openbsd fc1b4e4caf7d 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/18 21:02 openbsd bc321d44d2f5 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/17 11:52 openbsd 94b919120046 7f27c57a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/16 21:54 openbsd 5f0b8e1b9eb7 6ca2b51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/15 13:40 openbsd af68cf7bb0f1 a4ed0f4f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/11 21:35 openbsd bdda9179e659 d78ea535 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/07/09 11:30 openbsd 926f22cdc5e5 b9f1ceaa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/06/16 19:00 openbsd 3cf96d7d154c a3998659 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/06/16 04:28 openbsd 3894b14b3da6 50bb0618 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/06/15 16:41 openbsd e83fdb494821 c700a26e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/06/14 13:01 openbsd 46410a2bd49b 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/06/14 07:18 openbsd 46410a2bd49b 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/06/12 09:34 openbsd 10fabdd075df e93da63e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: shmpl
2026/06/05 19:10 openbsd ce89dc54e9c4 48b6c3fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/25 08:12 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/23 00:29 openbsd dbd5cf8c5e8a c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/22 20:44 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/12 20:43 openbsd 7bfd65388e23 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/12 18:47 openbsd 7bfd65388e23 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/11 10:35 openbsd bf258236f7c1 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/11 08:17 openbsd bf258236f7c1 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/11 01:46 openbsd bf258236f7c1 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/10 01:17 openbsd e291ae399501 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/09 18:44 openbsd 387d82fb614c 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/09 10:20 openbsd 387d82fb614c 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/08 23:44 openbsd 34e7bded0e8b 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/08 20:08 openbsd 34e7bded0e8b 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/08 14:25 openbsd d1081477e0e5 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/08 08:06 openbsd d1081477e0e5 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/07 11:45 openbsd eea3785ced43 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/07 09:19 openbsd eea3785ced43 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/06 21:44 openbsd 3f03630caf4d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/06 10:05 openbsd eec9cf095b26 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/06 08:32 openbsd eec9cf095b26 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid pool: free list modified: shmpl
2026/05/06 05:03 openbsd eec9cf095b26 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2026/05/06 03:27 openbsd eec9cf095b26 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
2025/02/04 10:39 openbsd 1eab3ea7ad62 8f267cef .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore pool: free list modified: shmpl
* Struck through repros no longer work on HEAD.