witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 174d, last: 14h11m
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 syz, C 2 1666d 1666d 3/4 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1646d 1658d 3/4 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 syz, C 19 1678d 1730d 3/4 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff83944978 pf_lock (pf_lock)
 2nd 0xffffffff8390ad30 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xae sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1244
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1076
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x274 sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x1377 sys/net/pf_ioctl.c:3284
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xae sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3059 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3097
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x182b sys/dev/pv/if_vio.c:935
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x4fd sys/dev/pci/virtio_pci.c:673
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x917 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x358 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x381 sys/arch/amd64/pci/acpipci.c:257
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:265
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff8390ad30,9,0) at witness_checkorder+0x10cd sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff8390ad18,0) at rw_do_enter_write+0xae sys/kern/kern_rwlock.c:234
uvn_io(fffff9806d59dbf0,ffff80002a34bf78,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1244
uvn_get(fffff9806d59dbf0,0,ffff80002a34c048,ffff80002a34c02c,0,1,c354fd03d7c8bd12,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1076
uvm_fault_lower_io(ffff80002a34c260,ffff80002a34c298,ffff80002a34c0d8,ffff80002a34c0c8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80002a34c260,ffff80002a34c298,ffff80002a34c1e0) at uvm_fault_lower+0x274 sys/uvm/uvm_fault.c:1381
uvm_fault(fffff9806e1a2b80,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a34c410,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff80002a34c410) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(14900,c4504441,ffff800001619800,1,ffff80002a2daa98) at pfioctl+0x1377 sys/net/pf_ioctl.c:3284
VOP_IOCTL(fffff980783fd040,c4504441,ffff800001619800,1,fffff980097fd4e0,ffff80002a2daa98) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff9806c7b80e8,c4504441,ffff800001619800,ffff80002a2daa98) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a2daa98,ffff80002a34cfc0,ffff80002a34cf10) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80002a34cfc0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a34cfc0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x448f8ebe70, count: -18
ddb{1}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80002a34bd30
rbx                                0
rdx               0xffff80000002a640
rcx               0xffff80002a2daa98
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80002a34bc10
r9                0x8080808080808080
r10               0x22e07a73396994b7
r11               0x8c1bc7acb88cd3bd
r12               0xfffff980040f42c0
r13               0xfffff980048e4670
r14                              0x3
r15               0xffffffff835541b0    substchar+0xbba1
rip               0xffffffff81432565    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a34bd20
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=176341 pid=13244 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a2da568,0xffff80002a2da2e0
    process=0xffff800045ff3560 user=0xffff80002a348000, vmspace=0xfffff9806e1a2b80
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 70582  325543  42041     0  2           0          0           syz-executor
 70582  192796  42041     0  2           0  0x4000000           syz-executor
  3003   61360  91011     0  3         0x2          0 clonelk   ifconfig
 13244  522227  96461     0  2           0          0           syz-executor
*13244  176341  96461     0  7           0  0x4000000           syz-executor
 91011    4253  41902     0  3    0x100002       0x88 sigsusp   sh
 83893  370833  35707     0  2           0      0xc80           syz-executor
 83893  122945  35707     0  3           0  0x4000080 kqpoll    syz-executor
 83893  402694  35707     0  3           0  0x4000080 kqpoll    syz-executor
 83893  110144  35707     0  3           0  0x4000080 fsleep    syz-executor
 41902   54812  76638     0  3         0x2       0x80 wait      syz-executor
 27056   21040  68157     0  3        0x10       0x80 nanoslp   syz-executor
 27056  185715  68157     0  3        0x10  0x4000080 sbwait    syz-executor
 27056  390384  68157     0  3        0x10  0x4000080 fsleep    syz-executor
 27056   42669  68157     0  3        0x10  0x4000080 fsleep    syz-executor
 35707  519668  76638     0  2         0x2      0xc80           syz-executor
 68157  421712  76638     0  7         0x2        0x1           syz-executor
 42041  106802  76638     0  3         0x2       0x80 nanoslp   syz-executor
 41718  247204      0     0  3     0x14000      0x280 nfsidl    nfsio
 61983   61180      0     0  3     0x14000      0x280 nfsidl    nfsio
 21574  466324      0     0  3     0x14000      0x280 nfsidl    nfsio
 92251  406495      0     0  3     0x14000      0x280 nfsidl    nfsio
 85240  156247      0     0  3     0x14000      0x280 nfsidl    nfsio
  4134   77230      0     0  3     0x14000      0x280 nfsidl    nfsio
 45696  219519      0     0  3     0x14000      0x280 nfsidl    nfsio
 15422  356872      0     0  3     0x14000      0x280 nfsidl    nfsio
 95262  357931      0     0  3     0x14000      0x280 nfsidl    nfsio
   840   56143      0     0  3     0x14000      0x280 nfsidl    nfsio
 72730  314165      0     0  3     0x14000      0x280 nfsidl    nfsio
 82364   71593      0     0  3     0x14000      0x280 nfsidl    nfsio
 70741  522704      0     0  3     0x14000      0x280 nfsidl    nfsio
 54505  216476      0     0  3     0x14000      0x280 nfsidl    nfsio
 42595  126748      0     0  3     0x14000      0x280 nfsidl    nfsio
 37446  112984      0     0  3     0x14000      0x280 nfsidl    nfsio
 71092  326719      0     0  3     0x14000      0x280 nfsidl    nfsio
 15165  431602      0     0  3     0x14000      0x280 nfsidl    nfsio
 45496  397271      0     0  3     0x14000      0x280 nfsidl    nfsio
 25686  343022      0     0  3     0x14000      0x280 nfsidl    nfsio
 28040  333529  76638     0  3         0x2       0x80 piperd    syz-executor
 96461  341105  76638     0  2         0x2      0xc80           syz-executor
 76638    3865   2696     0  3         0x2       0x80 wait      syz-executor
  2696   19702  67419     0  3    0x100002       0x88 sigsusp   ksh
 67419  434417  37450     0  3        0x10       0x88 kqread    sshd-session
 37450  420672  87075     0  3        0x12       0x80 kqread    sshd-session
 22949   26773      1     0  3    0x100003       0x80 ttyin     getty
 87075  130734      1     0  3           0       0x88 kqread    sshd
  9403  131121  48561    74  3   0x1100012       0x80 bpf       pflogd
 48561  324191      1     0  3           0       0x80 sbwait    pflogd
 85651  108365   8982    73  3   0x1100010       0x80 kqread    syslogd
  8982  464200      1     0  3    0x100002       0x80 sbwait    syslogd-parent
   872  443494      1     0  3    0x100000       0x80 kqread    resolvd
 93969  462342  73084    77  3    0x100012       0x80 kqread    dhcpleased
 68967   78085  73084    77  3    0x100012       0x80 kqread    dhcpleased
 73084   51914      1     0  3           0       0x80 kqread    dhcpleased
 70942   13043      0     0  3     0x14000      0x200 bored     smr
 51300  358909      0     0  2     0x14000      0x200           zerothread
 16621  178055      0     0  3     0x14000      0x200 aiodoned  aiodoned
 76569  249938      0     0  3     0x14000      0x200 syncer    update
 82949  141908      0     0  3     0x14000      0x200 cleaner   cleaner
 37399     493      0     0  3     0x14000      0x200 reaper    reaper
 39603   45705      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 85897  503583      0     0  3     0x14000      0x200 bored     viomb
 87638  492256      0     0  3     0x14000 0x40000200 acpi0     acpi0
 75847   77591      0     0  3     0x14000 0x40000200           idle1
 10165  199981      0     0  3     0x14000      0x200 bored     softnet1
 85575    5359      0     0  2     0x14000      0x200           softnet0
 56761  216699      0     0  3     0x14000      0x200 bored     systqmp
 48978  510040      0     0  3     0x14000      0x200 bored     systq
 49215  245638      0     0  3     0x14000      0x200 tmoslp    softclockmp
 60247  218144      0     0  3     0x14000 0x40000200 tmoslp    softclock
 18241  302709      0     0  3     0x14000 0x40000200           idle0
     1  508962      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 13244 (syz-executor) thread 0xffff80002a2daa98 (176341)
exclusive rwlock pf_lock r = 0 (0xffffffff83944978)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1342 sys/net/pf_ioctl.c:3284
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff83944a08)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2064
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b2eb00)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11051  12082K   12095K 166960K     12297        0
            pcb    18     12K      12K 166960K        33        0
         rtable   228      8K       9K 166960K       899        0
             pf    32     17K      24K 166960K       123        0
         ifaddr    39      7K       7K 166960K       126        0
        ifgroup    51      2K       2K 166960K       141        0
         sysctl     2      1K       9K 166960K         6        0
       counters    68     36K      37K 166960K       124        0
       ioctlops     1      2K       4K 166960K      1515        0
            iov     0      0K      12K 166960K         5        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1294     81K      81K 166960K      1575        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     6      0K       0K 166960K        10        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     57K      93K 166960K       483        0
          sigio     0      0K       0K 166960K         1        0
           proc    80    131K     164K 166960K      1061        0
        subproc    72      4K       4K 166960K       234        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        76        0
       in_multi    88      5K       6K 166960K       288        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K        12        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    49    228K     228K 166960K        49        0
           exec     0      0K       1K 166960K       618        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   216    159K     173K 166960K      5212        0
       UVM aobj     4      2K       2K 166960K         4        0
     pinsyscall    41     82K     103K 166960K      2075        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         1        0
            NDP    19      1K       2K 166960K        88        0
           temp    38   9122K    9142K 166960K     10136        0
         kqueue    13     20K      24K 166960K        35        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       84    0       79     1     0     1     1     0     8    0
rtentry    176      302    0      201     6     0     6     6     0     8    0
unpcb      144      126    0      107     4     0     4     4     0     8    3
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736       26    0       21     1     0     1     1     0     8    0
arp        136       53    0       36     1     0     1     1     0     8    0
inpcb      328      197    0      185     2     0     2     2     0     8    0
nd6        152       76    0       55     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     0     1     1     0     8    1
kcovpl      48       26    0       18     1     0     1     1     0     8    0
ppxss      1192      10    0       10     1     0     1     1     0     8    1
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        2    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288      11    0        0     1     0     1     1     0     8    0
pfstitem    24       30    0        0     1     0     1     1     0     8    0
pfstkey    128       30    0        0     1     0     1     1     0     8    0
pfstate    448       30    0        0     4     0     4     4     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1259    0      806    32     0    32    32     0     8    0
art_table   40     1260    0      806     6     0     6     6     0     8    0
art_node    32      302    0      210     1     0     1     1     0     8    0
semapl      72        8    0        4     1     0     1     1     0     8    0
shmpl      120        1    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1752    0      242    95     0    95    95     0     8    0
ffsino     296     1752    0      242   117     0   117   117     0     8    0
nchpl      144     2077    0      284    67     0    67    67     0     8    0
vnodes     216     2028    0        0   113     0   113   113     0     8    0
namei      1024    9465    0     9465     3     1     2     2     0     8    2
percpumem   16       78    0       28     1     0     1     1     0     8    0
kstatmem   264       79    0       54     3     0     3     3     0     8    1
scxspl     216     7060    0     7060     3     2     1     2     1     8    1
plimitpl   152       59    0       42     1     0     1     1     0     8    0
sigapl     424      774    0      708     9     1     8     8     0     8    0
knotepl    120      309    0        0    10     0    10    10     0     8    0
kqueuepl   224       45    0       34     1     0     1     1     0     8    0
pipepl     344      196    0      169     3     0     3     3     0     8    0
fdescpl    528      738    0      708     3     0     3     3     0     8    0
filepl     160     2635    0     2416    13     0    13    13     0     8    3
lockfpl    104       44    0       41     1     0     1     1     0     8    0
lockfspl    48       23    0       20     1     0     1     1     0     8    0
sessionpl  144       43    0       34     1     0     1     1     0     8    0
pgrppl      48       69    0       52     1     0     1     1     0     8    0
ucredpl    104      193    0      179     1     0     1     1     0     8    0
zombiepl   144      710    0      708     1     0     1     1     0     8    0
processpl  1240     774    0      708     6     0     6     6     0     8    0
procpl     664      958    0      884     8     1     7     7     0     8    0
sockpl     752      410    0      374    11     0    11    11     0     8    7
mcl64k     65536      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096     124    0        0    16     0    16    16     0     8    0
mcl2k      2048      28    0        0     4     0     4     4     0     8    0
mextrefs    64       26    0        0     1     0     1     1     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256      255    0        0    16     0    16    16     0     8    0
bufpl      272     2610    0       91   168     0   168   168     0     8    0
anonpl      32     5309    0        0    43     0    43    43     0   247    0
amapchunkpl 152   14576    0    14154    24     1    23    23     0   158    6
amappl16   200     1562    0     1545     5     3     2     5     0     8    0
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184      621    0      619     1     0     1     1     0     8    0
amappl13   176      152    0      140     1     0     1     1     0     8    0
amappl12   168     1050    0     1021     2     0     2     2     0     8    0
amappl11   160       25    0       25     1     1     0     1     0     8    0
amappl10   152       66    0       53     1     0     1     1     0     8    0
amappl9    144      283    0      283     1     1     0     1     0     8    0
amappl8    136      161    0      158     1     0     1     1     0     8    0
amappl7    128      174    0      162     1     0     1     1     0     8    0
amappl6    120      219    0      217     1     0     1     1     0     8    0
amappl5    112      223    0      212     1     0     1     1     0     8    0
amappl4    104      365    0      347     1     0     1     1     0     8    0
amappl3     96     2847    0     2740     4     0     4     4     0     8    1
amappl2     88      521    0      463     2     0     2     2     0     8    0
amappl1     80    12860    0    12254    15     0    15    15     0     8    2
amappl      88     4206    0     4063     4     0     4     4     0    92    0
uvmvnodes   80      105    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        3    0        0     1     0     1     1     0     8    0
uaddrrnd    24      738    0      708     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      738    0      708     1     0     1     1     0     8    0
vmmpekpl   168     7481    0     7424     3     0     3     3     0     8    0
vmmpepl    168    56084    0    54305    86     0    86    86     0   357    4
vmsppl     488      737    0      708     5     0     5     5     0     8    1
rwobjpl     80    18695    0    17672    24     0    24    24     0     8    2
pdppl      4096    1484    0     1416   106    34    72    86     0     8    4
pvpl        32    11680    0        0    95     0    95    95     0   265    0
pmappl     256      737    0      708     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      460    0       39    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff8397fff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2c kd_curproc sys/dev/kcov.c:584 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x2c sys/dev/kcov.c:153
__mp_lock(ffffffff83b2e300) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b2e300) at __mp_lock+0x1a3 sys/kern/kern_lock.c:173
intr_handler(ffff80002a334c20,ffff80000006e200) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__mp_lock(ffffffff83b2e300) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b2e300) at __mp_lock+0x192 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x14e sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 sys/dev/kcov.c:153
__mp_lock(ffffffff83b2e300) at __mp_lock+0x1a3 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83b2e300) at __mp_lock+0x1a3 sys/kern/kern_lock.c:173
ktrsyscall(ffff8000393aba18,b,20,ffff80002a335070) at ktrsyscall+0x2ce ktrwrite sys/kern/kern_ktrace.c:-1 [inline]
ktrsyscall(ffff8000393aba18,b,20,ffff80002a335070) at ktrsyscall+0x2ce sys/kern/kern_ktrace.c:183
syscall(ffff80002a335070) at syscall+0x305 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80002a335070) at syscall+0x305 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7a396272b020, count: -16
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff8390ad30,9,0) at witness_checkorder+0x10cd sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff8390ad18,0) at rw_do_enter_write+0xae sys/kern/kern_rwlock.c:234
uvn_io(fffff9806d59dbf0,ffff80002a34bf78,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1244
uvn_get(fffff9806d59dbf0,0,ffff80002a34c048,ffff80002a34c02c,0,1,c354fd03d7c8bd12,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1076
uvm_fault_lower_io(ffff80002a34c260,ffff80002a34c298,ffff80002a34c0d8,ffff80002a34c0c8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80002a34c260,ffff80002a34c298,ffff80002a34c1e0) at uvm_fault_lower+0x274 sys/uvm/uvm_fault.c:1381
uvm_fault(fffff9806e1a2b80,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a34c410,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff80002a34c410) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(14900,c4504441,ffff800001619800,1,ffff80002a2daa98) at pfioctl+0x1377 sys/net/pf_ioctl.c:3284
VOP_IOCTL(fffff980783fd040,c4504441,ffff800001619800,1,fffff980097fd4e0,ffff80002a2daa98) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff9806c7b80e8,c4504441,ffff800001619800,ffff80002a2daa98) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a2daa98,ffff80002a34cfc0,ffff80002a34cf10) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80002a34cfc0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a34cfc0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x448f8ebe70, count: -18

Crashes (406):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/21 19:41 openbsd 20a3cb7191ff 42e06812 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/21 12:33 openbsd 20a3cb7191ff 42e06812 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/21 11:15 openbsd 20a3cb7191ff 42e06812 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/20 12:53 openbsd d3f7195f4849 21286ae2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/19 22:43 openbsd 5e2b008c70ca 440f8011 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/19 16:47 openbsd 10825b7eb358 440f8011 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/18 22:57 openbsd 903d56f9b046 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/18 19:16 openbsd 903d56f9b046 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/18 07:48 openbsd c30c84965dc4 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/15 23:15 openbsd 2976452f6b3c 3f2522c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/14 12:59 openbsd 662782962efe 1a71827b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/14 07:30 openbsd 0a0964b49541 7321cd29 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/13 12:40 openbsd 2779855b37e2 5a1eeac4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 23:05 openbsd 932037cc97d6 745a967f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 15:41 openbsd 932037cc97d6 745a967f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 12:45 openbsd 932037cc97d6 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 04:23 openbsd f3dc682c6638 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/10 13:05 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/09 02:41 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 22:24 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 19:48 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 18:04 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 01:25 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 15:00 openbsd 5e47a7ebbb41 6520ecdb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 14:45 openbsd 5e47a7ebbb41 6520ecdb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 12:41 openbsd 5e47a7ebbb41 6520ecdb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 08:22 openbsd ce063bbc9d61 f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 05:49 openbsd ce063bbc9d61 f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/06 22:03 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/06 18:58 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/06 13:56 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 20:25 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 15:39 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 14:28 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 10:07 openbsd e058c89070c2 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 05:58 openbsd e058c89070c2 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 04:01 openbsd e058c89070c2 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/31 05:38 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d 2041d3f8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/30 16:36 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d 0ec395f8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/30 04:47 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d b498adee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/29 06:50 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d b1d00f76 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/28 23:20 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d b1d00f76 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/28 23:19 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d b1d00f76 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/28 19:51 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d 858db2ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/27 20:58 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b1b521f3695d 96923c60 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/17 14:09 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan bacaf78497a8 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/05 00:04 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 834bc6d187a0 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.