pool: free list modified: shmpl (6)

pool: free list modified: shmpl (6)

Status: upstream: reported on 2025/02/04 10:40
Reported-by: syzbot+640f5b53834a8559e680@syzkaller.appspotmail.com
First crash: 538d, last: 6h57m

▶ ▼ Similar bugs (5)

Kernel	Title	Rank 🛈	Repro	Count	Last	Reported	Patched	Status
openbsd	pool: free list modified: shmpl (3)	-1		1	2245d	2245d	0/4	auto-closed as invalid on 2020/09/01 15:24
openbsd	pool: free list modified: shmpl	-1	C	22	2609d	2704d	3/4	fixed on 2019/10/29 17:45
openbsd	pool: free list modified: shmpl (5)	-1		43	616d	709d	0/4	auto-obsoleted due to no activity on 2025/01/07 01:02
openbsd	pool: free list modified: shmpl (2)	-1		1	2425d	2425d	0/4	auto-closed as invalid on 2020/03/04 23:09
openbsd	pool: free list modified: shmpl (4)	-1		1	987d	987d	0/4	auto-obsoleted due to no activity on 2024/02/11 22:36

Sample crash report:

panic: pool_do_get: shmpl free list modified: page 0xfffff7805e8a4000; item addr 0xfffff7805e8a48c0; offset 0x40=0x6a67801b
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*170356  89137  32767        0x10  0x4000000    0K syz-executor
 398656  90973  32767        0x10          0    1  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834b4199) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_do_get(ffffffff83a288a0,9,ffff80002fb7a5e8) at pool_do_get+0x5df
pool_get(ffffffff83a288a0,9) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff800032b91cb8,ffff80002fb7a840,1f2,ffff80002fb7a790) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff800032b91cb8,ffff80002fb7a840,ffff80002fb7a790) at sys_shmget+0x195 sys/kern/sysv_shm.c:503
syscall(ffff80002fb7a840) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002fb7a840) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d76212ba70, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: pool_do_get: shmpl free list modified: page 0xfffff7805e8a4000; item addr 0xfffff7805e8a48c0; offset 0x40=0x6a67801b
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834b4199) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_do_get(ffffffff83a288a0,9,ffff80002fb7a5e8) at pool_do_get+0x5df
pool_get(ffffffff83a288a0,9) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff800032b91cb8,ffff80002fb7a840,1f2,ffff80002fb7a790) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff800032b91cb8,ffff80002fb7a840,ffff80002fb7a790) at sys_shmget+0x195 sys/kern/sysv_shm.c:503
syscall(ffff80002fb7a840) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002fb7a840) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d76212ba70, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002fb7a410
rbx               0xffffffff8399ae07    cpu_info_full_primary+0x2e07
rdx                                0
rcx               0xffff800032b91cb8
rax               0xffffffff83999ff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x9adc8bfb08f828a6
r11                0x33416ea481e1884
r12               0xffffffff8399ac08    cpu_info_full_primary+0x2c08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff81c8e415    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002fb7a400
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=170356 pid=89137 tcnt=2 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    runpri=50, usrpri=50, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800032b91258,0xffffffff83ac2da8
    process=0xffff80002fb7eb68 user=0xffff80002fb75000, vmspace=0xfffff78071b27d88
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 89137  514461    871 32767  2        0x10          0           syz-executor
*89137  170356    871 32767  7        0x10  0x4000000           syz-executor
  4320  293152  40722 32767  2        0x10          0           syz-executor
  4320  385538  40722 32767  3        0x10  0x4000080 msgwait   syz-executor
 98920   30193  83634 32767  3        0x10       0x80 nanoslp   syz-executor
 98920   45957  83634 32767  3        0x10  0x4000080 msgwait   syz-executor
 98920  466485  83634 32767  3        0x10  0x4000080 fsleep    syz-executor
 63262  279187  39538 32767  3        0x10       0x80 nanoslp   syz-executor
 63262  284844  39538 32767  3        0x10  0x4000080 msgwait   syz-executor
 85846  504026  36228 32767  3        0x10       0x80 nanoslp   syz-executor
 85846  242513  36228 32767  3        0x10  0x4000080 ttyout    syz-executor
 24657  146452  86722 32767  2        0x10          0           syz-executor
 24657  433681  86722 32767  3        0x10  0x4000080 kqread    syz-executor
 24657  374175  86722 32767  3        0x10  0x4000080 fsleep    syz-executor
 86068  318329  71410 32767  3        0x10       0x80 fsleep    syz-executor
 86068  179916  71410 32767  3        0x10  0x4000080 ttyout    syz-executor
 86068  110570  71410 32767  3        0x10  0x4000080 kqsel     syz-executor
 86068  354095  71410 32767  3        0x10  0x4000080 ttyout    syz-executor
 39538  287196  18837 32767  3        0x10       0x80 nanoslp   syz-executor
 40722   51771  37416 32767  3        0x10       0x80 nanoslp   syz-executor
   871  444780  32087 32767  3        0x10       0x80 nanoslp   syz-executor
 71410    2957  82593 32767  3        0x10       0x80 nanoslp   syz-executor
 90973  398656  31984 32767  7        0x10          0           syz-executor
 36228   26443  82842 32767  3        0x10       0x80 nanoslp   syz-executor
 86722  233228  90181 32767  3        0x10       0x80 nanoslp   syz-executor
 83634  163167  48802 32767  3        0x10       0x80 nanoslp   syz-executor
 32087  464215  15499     0  3         0x2       0x80 wait      syz-executor
 37416  193931  15499     0  3         0x2       0x80 wait      syz-executor
 82593    3485  15499     0  3         0x2       0x80 wait      syz-executor
 18837  173160  15499     0  3         0x2       0x80 wait      syz-executor
 31984  211896  15499     0  3         0x2       0x80 wait      syz-executor
 48802  508692  15499     0  3         0x2       0x80 wait      syz-executor
 82842  360946  15499     0  3         0x2       0x80 wait      syz-executor
 90181  411871  15499     0  3         0x2       0x80 wait      syz-executor
 15499  120556  98577     0  3         0x2       0x80 kqread    syz-executor
 98577  395621  90909     0  3    0x100002       0x88 sigsusp   ksh
 90909  330181  61201     0  3        0x10       0x88 kqread    sshd-session
 61201   35367  17826     0  3        0x12       0x80 kqread    sshd-session
 38929  448446      1     0  3    0x100003       0x80 ttyin     getty
 17826  162013      1     0  3           0       0x88 kqread    sshd
 77774  371095  48239    73  3   0x1100010       0x80 kqread    syslogd
 48239  351729      1     0  3    0x100002       0x80 sbwait    syslogd
 59735  341970      1     0  3    0x100000       0x80 kqread    resolvd
 43616  286883  20748    77  3    0x100012       0x80 kqread    dhcpleased
 76539  271574  20748    77  3    0x100012       0x80 kqread    dhcpleased
 20748  226236      1     0  3           0       0x80 kqread    dhcpleased
 90036  394146      0     0  3     0x14000      0x200 bored     smr
 67086  230163      0     0  2     0x14000      0x200           zerothread
 80939  241149      0     0  3     0x14000      0x200 aiodoned  aiodoned
 27503  196393      0     0  3     0x14000      0x200 syncer    update
  6538  226893      0     0  3     0x14000      0x200 cleaner   cleaner
 14128   88409      0     0  3     0x14000      0x200 reaper    reaper
 85840  219109      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 49232  288621      0     0  3     0x14000      0x200 bored     viomb
 40662   22086      0     0  3     0x14000 0x40000200 acpi0     acpi0
 12869  522941      0     0  3     0x14000 0x40000200           idle1
 25143  512056      0     0  3     0x14000      0x200 bored     softnet1
 88375  331157      0     0  3     0x14000      0x200 bored     softnet0
 97828   34589      0     0  3     0x14000      0x200 bored     systqmp
 17922  347640      0     0  3     0x14000      0x200 bored     systq
 55527  377357      0     0  3     0x14000      0x200 tmoslp    softclockmp
 88229  417774      0     0  3     0x14000 0x40000200 tmoslp    softclock
 36645  417026      0     0  3     0x14000 0x40000200           idle0
     1  433586      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex shmpl r = 0 (0xffffffff83a288b8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pool_get+0x124 sys/kern/subr_pool.c:585
#3  shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
#4  sys_shmget+0x195 sys/kern/sysv_shm.c:503
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
Process 89137 (syz-executor) thread 0xffff800032b91cb8 (170356)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a29e40)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
exclusive mutex shmpl r = 0 (0xffffffff83a288b8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  pool_get+0x124 sys/kern/subr_pool.c:585
#3  shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
#4  sys_shmget+0x195 sys/kern/sysv_shm.c:503
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11057  12019K   12034K 166960K     12148        0
            pcb    17     12K      12K 166960K        17        0
         rtable   247      7K       7K 166960K       360        0
             pf    31     16K      16K 166960K        31        0
         ifaddr    42      7K       7K 166960K        44        0
        ifgroup    50      2K       2K 166960K        50        0
         sysctl     2      1K       9K 166960K         6        0
       counters    70     37K      37K 166960K        70        0
       ioctlops     0      0K       4K 166960K        34        0
            iov     0      0K       8K 166960K         9        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1288     81K      81K 166960K      1391        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         8        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        20        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    25     93K     129K 166960K       297        0
          sigio     0      0K       0K 166960K         1        0
           proc    59    115K     180K 166960K       517        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        24        0
       in_multi    99      7K       7K 166960K       102        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     0      0K       0K 166960K         6        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   103    466K     466K 166960K       103        0
           exec     0      0K       1K 166960K       383        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   253    168K     203K 166960K      4286        0
       UVM aobj    11      4K       4K 166960K        13        0
     pinsyscall    46     92K     114K 166960K      1387        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         7        0
            NDP    11      0K       2K 166960K        27        0
           temp    44   9116K    9131K 166960K      4002        0
         kqueue    16     26K      28K 166960K        44        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       43    0       40     1     0     1     1     0     8    0
rtentry    176      116    0        1     6     0     6     6     0     8    0
unpcb      144      126    0      109     1     0     1     1     0     8    0
syncache   336        6    0        6     1     0     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      736       64    0       58     2     0     2     2     0     8    1
arp        136       19    0        0     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        2    0        0     1     0     1     1     0     8    0
inpcb      328      478    0      465     9     0     9     9     0     8    7
ip6q        72        1    0        0     1     0     1     1     0     8    0
ip6af       40        1    0        0     1     0     1     1     0     8    0
nd6        152       28    0        0     2     0     2     2     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      476    0        0    30     0    30    30     0     8    0
art_table   40      477    0        0     5     0     5     5     0     8    0
art_node    32      116    0       11     1     0     1     1     0     8    0
sysvmsgpl   40        4    0        2     1     0     1     1     0     8    0
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl      72       17    0        7     1     0     1     1     0     8    0
shmpl      112       10    0        2     1     0     1     1     0     8    0
pool(0xffffffff83a288a0:shmpl): page inconsistency: page 0xfffff7805e8a4000; 26 on list, 8 missing, 35 items per page
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     1795    0      329    92     0    92    92     0     8    0
ffsino     296     1795    0      329   114     0   114   114     0     8    0
nchpl      144     2216    0      525    63     0    63    63     0     8    0
vnodes     216     1876    0        0   105     0   105   105     0     8    0
namei      1024    6794    0     6794     2     0     2     2     0     8    2
percpumem   16       51    0        0     1     0     1     1     0     8    0
kstatmem   264       25    0        0     2     0     2     2     0     8    0
scxspl     216     7414    0     7414     4     3     1     3     1     8    1
plimitpl   152       54    0       26     2     0     2     2     0     8    0
sigapl     424      590    0      537     7     0     7     7     0     8    0
knotepl    120      308    0        0    10     0    10    10     0     8    0
kqueuepl   224       90    0       77     3     0     3     3     0     8    2
pipepl     344      167    0      140     6     0     6     6     0     8    3
fdescpl    528      574    0      537     4     0     4     4     0     8    0
filepl     160     2786    0     2558    16     0    16    16     0     8    5
lockfpl    104       42    0       37     1     0     1     1     0     8    0
lockfspl    48       20    0       15     1     0     1     1     0     8    0
sessionpl  144       30    0       14     1     0     1     1     0     8    0
pgrppl      48       38    0       14     1     0     1     1     0     8    0
ucredpl    104      398    0      379     1     0     1     1     0     8    0
zombiepl   144      537    0      537     1     0     1     1     0     8    1
processpl  1232     590    0      537     5     0     5     5     0     8    0
procpl     664      836    0      772     7     0     7     7     0     8    0
sosppl     176        1    0        1     1     0     1     1     0     8    1
sockpl     752      647    0      614    13     1    12    13     0     8    7
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k128   9344       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     133    0        0    17     0    17    17     0     8    0
mcl2k      2048      14    0        0     2     0     2     2     0     8    0
mextrefs    64       14    0        0     1     0     1     1     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      202    0        0    13     0    13    13     0     8    0
bufpl      272     2535    0      101   163     0   163   163     0     8    0
anonpl      32     6234    0        0    51     0    51    51     0   247    0
amapchunkpl 152   12896    0    12336    33     0    33    33     0   158    7
amappl16   200     2049    0     2028     5     2     3     5     0     8    0
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184      401    0      400     1     0     1     1     0     8    0
amappl13   176      120    0      110     1     0     1     1     0     8    0
amappl12   168      808    0      772     2     0     2     2     0     8    0
amappl11   160        6    0        6     2     2     0     1     0     8    0
amappl10   152       58    0       48     1     0     1     1     0     8    0
amappl9    144      282    0      282     1     1     0     1     0     8    0
amappl8    136       92    0       91     1     0     1     1     0     8    0
amappl7    128      144    0      132     1     0     1     1     0     8    0
amappl6    120      153    0      150     1     0     1     1     0     8    0
amappl5    112       97    0       90     1     0     1     1     0     8    0
amappl4    104      265    0      248     1     0     1     1     0     8    0
amappl3     96     2399    0     2267     5     1     4     4     0     8    0
amappl2     88      542    0      487     2     0     2     2     0     8    0
amappl1     80    11640    0    11062    20     0    20    20     0     8    3
amappl      88     3584    0     3396     5     0     5     5     0    92    0
uvmvnodes   80      104    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       12    0        2     1     0     1     1     0     8    0
uaddrrnd    24      574    0      537     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      574    0      537     1     0     1     1     0     8    0
vmmpekpl   168     6891    0     6859     2     0     2     2     0     8    0
vmmpepl    168    46598    0    44540   116     0   116   116     0   357   16
vmsppl     488      573    0      537     7     1     6     6     0     8    0
rwobjpl     80    16697    0    15729    30     1    29    29     0     8    6
pdppl      4096    1155    0     1074   115    24    91    99     0     8   10
pvpl        32    15833    0        0   128     0   128   128     0   265    0
pmappl     256      573    0      537     4     1     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      451    0       27    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834b4199) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_do_get(ffffffff83a288a0,9,ffff80002fb7a5e8) at pool_do_get+0x5df
pool_get(ffffffff83a288a0,9) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff800032b91cb8,ffff80002fb7a840,1f2,ffff80002fb7a790) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff800032b91cb8,ffff80002fb7a840,ffff80002fb7a790) at sys_shmget+0x195 sys/kern/sysv_shm.c:503
syscall(ffff80002fb7a840) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002fb7a840) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7d76212ba70, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a29640) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a29640) at __mp_lock+0x192 sys/kern/kern_lock.c:173
syscall(ffff800033397e20) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff800033397e20) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7569122c99e0, count: 9
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a29640) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a29640) at __mp_lock+0x192 sys/kern/kern_lock.c:173
syscall(ffff800033397e20) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff800033397e20) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7569122c99e0, count: -6

Crashes (919):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Assets (help?)	Manager	Title
2026/07/27 15:58	openbsd	03525b20a4f0	1f273138	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/07/24 17:12	openbsd	969775618695	dd737a83	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/07/24 12:42	openbsd	969775618695	dd737a83	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/07/23 15:41	openbsd	6c9531571979	71a13572	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/21 14:34	openbsd	20200149c668	7c5de9c3	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/19 19:07	openbsd	2fc221d2874b	72524a66	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/19 01:39	openbsd	fc1b4e4caf7d	72524a66	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/18 21:02	openbsd	bc321d44d2f5	72524a66	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/17 11:52	openbsd	94b919120046	7f27c57a	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/16 21:54	openbsd	5f0b8e1b9eb7	6ca2b51a	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/15 13:40	openbsd	af68cf7bb0f1	a4ed0f4f	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/11 21:35	openbsd	bdda9179e659	d78ea535	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/07/09 11:30	openbsd	926f22cdc5e5	b9f1ceaa	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/06/16 19:00	openbsd	3cf96d7d154c	a3998659	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/06/16 04:28	openbsd	3894b14b3da6	50bb0618	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/06/15 16:41	openbsd	e83fdb494821	c700a26e	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/06/14 13:01	openbsd	46410a2bd49b	4f06757f	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/06/14 07:18	openbsd	46410a2bd49b	4f06757f	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/06/12 09:34	openbsd	10fabdd075df	e93da63e	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-main	pool: free list modified: shmpl
2026/06/05 19:10	openbsd	ce89dc54e9c4	48b6c3fa	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/25 08:12	openbsd	3ca1fbf96c86	c69befb3	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/23 00:29	openbsd	dbd5cf8c5e8a	c69befb3	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/22 20:44	openbsd	54bbd1fe416a	95d90255	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/12 20:43	openbsd	7bfd65388e23	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/12 18:47	openbsd	7bfd65388e23	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/11 10:35	openbsd	bf258236f7c1	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/11 08:17	openbsd	bf258236f7c1	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/11 01:46	openbsd	bf258236f7c1	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/10 01:17	openbsd	e291ae399501	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/09 18:44	openbsd	387d82fb614c	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/09 10:20	openbsd	387d82fb614c	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/08 23:44	openbsd	34e7bded0e8b	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/08 20:08	openbsd	34e7bded0e8b	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/08 14:25	openbsd	d1081477e0e5	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/08 08:06	openbsd	d1081477e0e5	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/07 11:45	openbsd	eea3785ced43	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/07 09:19	openbsd	eea3785ced43	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/06 21:44	openbsd	3f03630caf4d	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/06 10:05	openbsd	eec9cf095b26	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/06 08:32	openbsd	eec9cf095b26	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/06 05:03	openbsd	eec9cf095b26	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/05/06 03:27	openbsd	eec9cf095b26	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/05/03 02:04	openbsd	3c6f8ccfe730	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/03 00:47	openbsd	3c6f8ccfe730	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/02 22:54	openbsd	3c6f8ccfe730	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/02 17:01	openbsd	cdbf859d9674	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/02 08:34	openbsd	cdbf859d9674	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/02 04:31	openbsd	bedf3632bee6	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/05/01 09:02	openbsd	d15801fa3705	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl
2026/04/30 23:19	openbsd	2117c4c4e299	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/04/30 20:55	openbsd	2117c4c4e299	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2026/04/30 04:38	openbsd	04e2410ca848	340bcdf0	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-setuid	pool: free list modified: shmpl
2025/02/04 10:39	openbsd	1eab3ea7ad62	8f267cef	.config	console log	report	[disk image] [bsd.gdb] [kernel image]	ci-openbsd-multicore	pool: free list modified: shmpl

* ~~Struck through~~ repros no longer work on HEAD.