syzbot


witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 72d, last: 8h38m
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 C 2 1565d 1565d 3/4 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1544d 1556d 3/4 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 C 19 1576d 1628d 3/4 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff838de798 pf_lock (pf_lock)
 2nd 0xffffffff839d34c0 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x13ff sys/net/pf_ioctl.c:3238
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3057 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3095
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x1853 sys/dev/pv/if_vio.c:935
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x52c sys/dev/pci/virtio_pci.c:675
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x8e5 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x37a sys/arch/amd64/pci/acpipci.c:231
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:239
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff839d34c0,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff839d34a8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(ffffee006c8de970,ffff80003c404568,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(ffffee006c8de970,0,ffff80003c404638,ffff80003c40461c,0,1,4a5392826e54117d,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff80003c404850,ffff80003c404888,ffff80003c4046d0,ffff80003c4046b8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003c404850,ffff80003c404888,ffff80003c4047d0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(ffffee006ccf33f0,200000000000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003c404a00,200000000200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80003c404a00) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(44900,c4504441,ffff800001617800,1,ffff800032b95a18) at pfioctl+0x13ff sys/net/pf_ioctl.c:3238
VOP_IOCTL(ffffee00650ef038,c4504441,ffff800001617800,1,ffffee00097fd680,ffff800032b95a18) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(ffffee006cac4378,c4504441,ffff800001617800,ffff800032b95a18) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800032b95a18,ffff80003c4055b0,ffff80003c405500) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c4055b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4055b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xff7899f1fd0, count: -18
ddb{0}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80003c404320
rbx                                0
rdx               0xffff80000160dd80
rcx               0xffff800032b95a18
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80003c404200
r9                0x8080808080808080
r10               0xa3093c008261e92d
r11               0x453fa26ec9c99a2d
r12               0xffffee00040b92c0
r13               0xffffee00048a8928
r14                              0x3
r15               0xffffffff83529885    substchar+0xb725
rip               0xffffffff82e646e5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c404310
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=121432 pid=98694 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=81, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800032b927e8,0xffff800032b94038
    process=0xffff80003c488030 user=0xffff80003c400000, vmspace=0xffffee006ccf33f0
    estcpu=31, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
  6343  338952  72388     0  2           0          0           syz-executor
  6343   53680  72388     0  2           0  0x4000000           syz-executor
 25976  130539  35908     0  2           0          0           syz-executor
 25976  243562  35908     0  3           0  0x4000080 fifor     syz-executor
 11524   73008  53578     0  2           0          0           syz-executor
 11524  460060  53578     0  3           0  0x4000080 fsleep    syz-executor
 11524  415386  53578     0  3           0  0x4000080 fsleep    syz-executor
 98694  302954  32058     0  2           0          0           syz-executor
*98694  121432  32058     0  7           0  0x4000000           syz-executor
 41864   24510  30571 60929  2        0x10          0           syz-executor
 41864  360702  30571 60929  3        0x10  0x4000080 kqsel     syz-executor
 41864  309422  30571 60929  3        0x10  0x4000080 fsleep    syz-executor
 93224  415388      0     0  3     0x14000      0x280 nfsidl    nfsio
 92298  134186      0     0  3     0x14000      0x280 nfsidl    nfsio
 58260   94445      0     0  3     0x14000      0x280 nfsidl    nfsio
  3833   68061      0     0  3     0x14000      0x280 nfsidl    nfsio
 20249  142051      0     0  3     0x14000      0x280 nfsidl    nfsio
 24294  278024      0     0  3     0x14000      0x280 nfsidl    nfsio
 68589  216170      0     0  3     0x14000      0x280 nfsidl    nfsio
  9020  166137      0     0  3     0x14000      0x280 nfsidl    nfsio
 23891  512731      0     0  3     0x14000      0x280 nfsidl    nfsio
 17902  199427      0     0  3     0x14000      0x280 nfsidl    nfsio
 17062  364568      0     0  3     0x14000      0x280 nfsidl    nfsio
 29524  356894      0     0  3     0x14000      0x280 nfsidl    nfsio
 89539  278547      0     0  3     0x14000      0x280 nfsidl    nfsio
 93245  121532      0     0  3     0x14000      0x280 nfsidl    nfsio
 10011  324691      0     0  3     0x14000      0x280 nfsidl    nfsio
  2080  252420      0     0  3     0x14000      0x280 nfsidl    nfsio
 71723  232747      0     0  3     0x14000      0x280 nfsidl    nfsio
 99960  410345      0     0  3     0x14000      0x280 nfsidl    nfsio
 66817  391741      0     0  3     0x14000      0x280 nfsidl    nfsio
 12067  414601      0     0  3     0x14000      0x280 nfsidl    nfsio
 32058  396518  62740     0  3         0x2       0x80 nanoslp   syz-executor
 30571   36046  62740     0  3         0x2       0x80 nanoslp   syz-executor
 53578   21466  62740     0  3         0x2       0x80 nanoslp   syz-executor
 35908  104285  62740     0  3         0x2       0x80 nanoslp   syz-executor
 45243  372330  62740     0  3         0x2       0x80 wait      syz-executor
 72388   49570  62740     0  3         0x2       0x80 nanoslp   syz-executor
 41399   86756  62740     0  2         0x2          0           syz-executor
 79911  456386  62740     0  3         0x2          0 biowait   syz-executor
 62740   94232  70306     0  3         0x2       0x80 kqread    syz-executor
 70306   73092  88050     0  3    0x100002       0x88 sigsusp   ksh
 88050  486098  54161     0  3        0x10       0x88 kqread    sshd-session
 54161  188784  51094     0  3        0x12       0x80 kqread    sshd-session
   475  248294      1     0  3    0x100003       0x80 ttyin     getty
 51094  474578      1     0  3           0       0x88 kqread    sshd
 18134  522122  51388    74  3   0x1100012       0x80 bpf       pflogd
 51388  444475      1     0  3           0       0x80 sbwait    pflogd
 20462  135937  24096    73  3   0x1100010       0x80 kqread    syslogd
 24096  374511      1     0  3    0x100002       0x80 sbwait    syslogd
 14309  437518      1     0  3    0x100000       0x80 kqread    resolvd
 72910  255716  94593    77  3    0x100012       0x80 kqread    dhcpleased
 76228      45  94593    77  3    0x100012       0x80 kqread    dhcpleased
 94593  344218      1     0  3           0       0x80 kqread    dhcpleased
 73055  131649      0     0  3     0x14000      0x200 bored     smr
 83565  119010      0     0  2     0x14000      0x200           zerothread
 72210  110667      0     0  3     0x14000      0x200 aiodoned  aiodoned
 63120  197569      0     0  3     0x14000      0x200 syncer    update
 10229  401572      0     0  3     0x14000      0x200 cleaner   cleaner
 48092   27838      0     0  3     0x14000      0x200 reaper    reaper
 98261  431594      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 35822  155490      0     0  3     0x14000      0x200 bored     viomb
 84690  231647      0     0  3     0x14000 0x40000200 acpi0     acpi0
 95385  508331      0     0  7     0x14000 0x40000200           idle1
 89425   96012      0     0  3     0x14000      0x200 bored     softnet1
 79179  368442      0     0  3     0x14000      0x200 bored     softnet0
 51034  508445      0     0  3     0x14000      0x200 smrbar    systqmp
 12846  157847      0     0  3     0x14000      0x200 bored     systq
  1587  294802      0     0  3     0x14000      0x200 tmoslp    softclockmp
 80759  267869      0     0  3     0x14000 0x40000200 tmoslp    softclock
  9929  259663      0     0  3     0x14000 0x40000200           idle0
     1  242690      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
Process 98694 (syz-executor) thread 0xffff800032b95a18 (121432)
exclusive rwlock pf_lock r = 0 (0xffffffff838de798)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x13ca sys/net/pf_ioctl.c:3238
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff838de828)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2075
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83aafe80)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#4  Xsyscall+0x128
Process 79911 (syz-executor) thread 0xffff80002a222540 (456386)
exclusive rrwlock inode r = 0 (0xffffee006edb16b8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vget+0x2a2 sys/kern/vfs_subr.c:692
#6  ufs_ihashget+0x185 sys/ufs/ufs/ufs_ihash.c:98
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1203
#8  ufs_lookup+0x1a36 sys/ufs/ufs/ufs_lookup.c:478
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x963 sys/kern/vfs_lookup.c:580
#11 namei+0x7c5 sys/kern/vfs_lookup.c:250
#12 dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1807
#13 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffffee0079c4b300)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
#6  namei+0x7c5 sys/kern/vfs_lookup.c:250
#7  dounlinkat+0xc1 sys/kern/vfs_syscalls.c:1807
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
Process 51034 (systqmp) thread 0xffff800045ffe000 (508445)
shared rwlock systqmp r = 0 (0xffffffff838f1728)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11064  12084K   12397K 166960K     12430        0
            pcb    17     13K      14K 166960K       121        0
         rtable   222      6K       7K 166960K       384        0
             pf    36     18K      25K 166960K        83        0
         ifaddr    45      8K       8K 166960K        58        0
        ifgroup    55      2K       2K 166960K        75        0
         sysctl     4      1K       9K 166960K         9        0
       counters    70     37K      37K 166960K        88        0
       ioctlops     1      2K       4K 166960K      1552        0
            iov     0      0K      18K 166960K        77        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1364     86K      86K 166960K      1610        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         4        0
         VM map     2      1K       1K 166960K         2        0
            sem    11      0K       0K 166960K        79        0
        dirhash    12      2K       2K 166960K        18        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     57K      89K 166960K       385        0
          sigio     0      0K       0K 166960K         1        0
           proc    72    115K     164K 166960K       569        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        27        0
       in_multi   102      7K       7K 166960K       113        0
    ether_multi     1      0K       0K 166960K         3        0
            mrt     1      0K       0K 166960K        16        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       474        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   230    167K     181K 166960K      5323        0
       UVM aobj    11      4K       4K 166960K        12        0
     pinsyscall    41     82K     106K 166960K      1581        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        15        0
            NDP    12      0K       2K 166960K        36        0
           temp    38   9118K    9134K 166960K     15708        0
         kqueue    15     24K      26K 166960K        66        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       52    0       49     1     0     1     1     0     8    0
rtentry    176      119    0       18     6     0     6     6     0     8    0
unpcb      144      146    0      125     1     0     1     1     0     8    0
syncache   336       11    0       11     1     0     1     1     0     8    1
tcpcb      736       64    0       59     1     0     1     1     0     8    0
arp        136       20    0        0     1     0     1     1     0     8    0
inpcb      328      345    0      335     7     2     5     5     0     8    3
nd6        152       27    0        3     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       7    0        7     1     0     1     1     0     8    1
pppxif     1576       1    0        1     1     0     1     1     0     8    1
pfstscr     40        3    0        2     1     0     1     1     0     8    0
pffrag     232        4    0        0     1     0     1     1     0   482    0
pffrnode    88        4    0        0     1     0     1     1     0     8    0
pffrent     40        6    0        2     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288       3    0        3     1     0     1     1     0     8    1
pfqueue    320        1    0        1     1     1     0     1     0     8    0
pfstitem    24       52    0        2     1     0     1     1     0     8    0
pfstkey    128       54    0        4     2     0     2     2     0     8    0
pfstate    448       52    0        3     6     0     6     6     0     8    0
pfrule     1360      22    0       15     2     0     2     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      560    0       63    34     0    34    34     0     8    1
art_table   40      561    0       63     6     0     6     6     0     8    0
art_node    32      119    0       28     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semapl      72       77    0       68     1     0     1     1     0     8    0
shmpl      112        9    0        1     1     0     1     1     0     8    0
dirhash    1024      21    0        4     3     0     3     3     0     8    0
dino2pl    256     1996    0      531    93     0    93    93     0     8    0
ffsino     296     1996    0      531   114     0   114   114     0     8    0
nchpl      144     2541    0      837    64     0    64    64     0     8    0
rtmask      32        1    0        1     1     0     1     1     0     8    1
vnodes     216     2263    0        0   126     0   126   126     0     8    0
namei      1024    8536    0     8536     2     1     1     2     0     8    1
percpumem   16       60    0        9     1     0     1     1     0     8    0
kstatmem   264       41    0       14     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216     9917    0     9916    11     8     3     8     1     8    2
plimitpl   152       59    0       42     1     0     1     1     0     8    0
sigapl     424      734    0      668     9     1     8     8     0     8    0
knotepl    120      552    0        0    17     0    17    17     0     8    0
kqueuepl   224      132    0      120     3     0     3     3     0     8    2
pipepl     344      155    0      128     3     0     3     3     0     8    0
fdescpl    528      698    0      668     3     0     3     3     0     8    0
filepl     160     3363    0     3141    14     0    14    14     0     8    3
lockfpl    104      191    0      189     1     0     1     1     0     8    0
lockfspl    48       58    0       56     1     0     1     1     0     8    0
sessionpl  144       33    0       24     1     0     1     1     0     8    0
pgrppl      48       43    0       26     1     0     1     1     0     8    0
ucredpl    104      418    0      403     1     0     1     1     0     8    0
zombiepl   144      669    0      668     1     0     1     1     0     8    0
processpl  1232     734    0      668     7     1     6     6     0     8    0
procpl     664     1169    0     1096     7     0     7     7     0     8    0
sockpl     752      553    0      519    10     2     8     8     0     8    4
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      6    0        0     1     0     1     1     0     8    0
mcl12k     12288      4    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     115    0        0    15     0    15    15     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      30    0        0     4     0     4     4     0     8    0
mextrefs    64       31    0        0     1     0     1     1     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      241    0        0    16     0    16    16     0     8    0
bufpl      272     3959    0      106   257     0   257   257     0     8    0
anonpl      32     7593    0        0    62     0    62    62     0   247    0
amapchunkpl 152   16342    0    15873    30     2    28    28     0   158    7
amappl16   200     2390    0     2361    15     8     7    14     0     8    4
amappl15   192        2    0        2     1     1     0     1     0     8    0
amappl14   184      442    0      441     1     0     1     1     0     8    0
amappl13   176      144    0      132     1     0     1     1     0     8    0
amappl12   168      958    0      929     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       65    0       51     1     0     1     1     0     8    0
amappl9    144      281    0      280     2     1     1     1     0     8    0
amappl8    136      102    0      100     1     0     1     1     0     8    0
amappl7    128      156    0      142     1     0     1     1     0     8    0
amappl6    120      152    0      151     1     0     1     1     0     8    0
amappl5    112      102    0       91     1     0     1     1     0     8    0
amappl4    104      303    0      284     1     0     1     1     0     8    0
amappl3     96     3165    0     3054     4     0     4     4     0     8    0
amappl2     88      568    0      506     2     0     2     2     0     8    0
amappl1     80    11497    0    10895    15     2    13    15     0     8    0
amappl      88     4527    0     4369     5     0     5     5     0    92    0
uvmvnodes   80      107    0        0     3     0     3     3     0     8    0
dma8192    8192       1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     1     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       11    0        1     1     0     1     1     0     8    0
uaddrrnd    24      698    0      668     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      698    0      668     1     0     1     1     0     8    0
vmmpekpl   168     7635    0     7594     3     0     3     3     0     8    1
vmmpepl    168    52791    0    50926    97     4    93    97     0   357    6
vmsppl     488      697    0      668     5     1     4     5     0     8    0
rwobjpl     80    17843    0    16794    27     2    25    27     0     8    0
pdppl      4096    1403    0     1336    95    24    71    83     0     8    4
pvpl        32    15148    0        0   124     1   123   123     0   265    0
pmappl     256      697    0      668     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      540    0       27    15     0    15    15     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff839d34c0,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff839d34a8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(ffffee006c8de970,ffff80003c404568,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(ffffee006c8de970,0,ffff80003c404638,ffff80003c40461c,0,1,4a5392826e54117d,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff80003c404850,ffff80003c404888,ffff80003c4046d0,ffff80003c4046b8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003c404850,ffff80003c404888,ffff80003c4047d0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(ffffee006ccf33f0,200000000000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003c404a00,200000000200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80003c404a00) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(44900,c4504441,ffff800001617800,1,ffff800032b95a18) at pfioctl+0x13ff sys/net/pf_ioctl.c:3238
VOP_IOCTL(ffffee00650ef038,c4504441,ffff800001617800,1,ffffee00097fd680,ffff800032b95a18) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(ffffee006cac4378,c4504441,ffff800001617800,ffff800032b95a18) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff800032b95a18,ffff80003c4055b0,ffff80003c405500) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c4055b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4055b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xff7899f1fd0, count: -18
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff80002999dff0) at sched_idle+0x371 sys/kern/kern_sched.c:192
end trace frame: 0x0, count: -5

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/21 19:57 openbsd 20200149c668 7c5de9c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/30 05:54 openbsd 13c7226bf352 fff8d0a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/25 08:23 openbsd 7c9581f1cd1a cfa969bf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/18 10:12 openbsd 135881df8fe2 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/14 11:38 openbsd 46410a2bd49b 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/08 18:49 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/03 07:23 openbsd cf839b82e3ec cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/03 07:22 openbsd cf839b82e3ec cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/30 05:58 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/30 05:58 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/30 05:58 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/27 11:12 openbsd 59afafd236bf cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/12 03:15 openbsd 369ac04692fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.