syzbot


witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 31d, last: 1d12h
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 C 2 1523d 1523d 3/3 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1502d 1514d 3/3 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 C 19 1534d 1586d 3/3 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff8390ad98 pf_lock (pf_lock)
 2nd 0xffffffff8391f740 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x13ff sys/net/pf_ioctl.c:3238
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3057 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3095
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x17f7 sys/dev/pv/if_vio.c:927
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x52c sys/dev/pci/virtio_pci.c:675
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x8e5 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x37a sys/arch/amd64/pci/acpipci.c:231
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:239
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff8391f740,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff8391f728,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(ffffef806c10cb00,ffff80003c3dfff8,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(ffffef806c10cb00,0,ffff80003c3e00c8,ffff80003c3e00ac,0,1,ce6f8e4eb9156905,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff80003c3e02e0,ffff80003c3e0318,ffff80003c3e0160,ffff80003c3e0148) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003c3e02e0,ffff80003c3e0318,ffff80003c3e0260) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(ffffef800ee89020,200000000000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003c3e0490,200000000200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80003c3e0490) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(24900,c4504441,ffff800000c5f800,1,ffff80003bbc74e8) at pfioctl+0x13ff sys/net/pf_ioctl.c:3238
VOP_IOCTL(ffffef80632cf630,c4504441,ffff800000c5f800,1,ffffef80097fd270,ffff80003bbc74e8) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(ffffef806c1b69a8,c4504441,ffff800000c5f800,ffff80003bbc74e8) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003bbc74e8,ffff80003c3e1040,ffff80003c3e0f90) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3e1040) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3e1040) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc0cfeadbf70, count: -18
ddb{1}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80003c3dfdb0
rbx                                0
rdx               0xffff8000015fd240
rcx               0xffff80003bbc74e8
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80003c3dfc90
r9                0x8080808080808080
r10               0x7e2cbee76ad1dfe6
r11                 0x8586b6edb68be2
r12               0xffffef80040c82c0
r13               0xffffef80048b72c8
r14                              0x3
r15               0xffffffff835257b9    substchar+0x5274
rip               0xffffffff827c2b95    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c3dfda0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=89368 pid=32690 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003bbc67f0,0xffff80003bbc6568
    process=0xffff80003c466b78 user=0xffff80003c3dc000, vmspace=0xffffef800ee89020
    estcpu=29, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 34781  320679  12169      0  2           0                syz-executor
 34781  266846  12169      0  2   0x4000000                syz-executor
 34781  264237  12169      0  3   0x4000000  smrbar        syz-executor
 94491  413983  18820      0  2           0                syz-executor
 94491     310  18820      0  3   0x4000080  kqpoll        syz-executor
 93385  145824  46723      0  2           0                syz-executor
 93385   75344  46723      0  3   0x4000080  fsleep        syz-executor
 93385   66651  46723      0  2   0x4000000                syz-executor
 87907  444575  16050  60929  2        0x10                syz-executor
 87907   43499  16050  60929  3   0x4000090  lockf         syz-executor
 87907  198042  16050  60929  3   0x4000090  fsleep        syz-executor
 32690  432134  34016      0  2           0                syz-executor
*32690   89368  34016      0  7   0x4000000                syz-executor
 73950  195664  31501      0  2           0                syz-executor
 73950  195950  31501      0  3   0x4000080  fsleep        syz-executor
 73950  145294  31501      0  3   0x4000080  fsleep        syz-executor
 55832  360092  81266      0  2           0                syz-executor
 55832  116894  81266      0  3   0x4000080  fsleep        syz-executor
 20473  505905  52203      0  7    0x100003                sh
 52203  212335  68329      0  3        0x82  wait          syz-executor
 53260  307978      0      0  3     0x14200  acct          acct
 84602  371521      0      0  3     0x14280  nfsidl        nfsio
  5520  289053      0      0  3     0x14280  nfsidl        nfsio
 77967  227375      0      0  3     0x14280  nfsidl        nfsio
  1365  128761      0      0  3     0x14280  nfsidl        nfsio
 46300  317220      0      0  3     0x14280  nfsidl        nfsio
  7459  183775      0      0  3     0x14280  nfsidl        nfsio
 60238   38862      0      0  3     0x14280  nfsidl        nfsio
 60394  300592      0      0  3     0x14280  nfsidl        nfsio
 73407   53014      0      0  3     0x14280  nfsidl        nfsio
 42191  507777      0      0  3     0x14280  nfsidl        nfsio
 62049   53847      0      0  3     0x14280  nfsidl        nfsio
 76179  230505      0      0  3     0x14280  nfsidl        nfsio
 97518  392918      0      0  3     0x14280  nfsidl        nfsio
 15579   46335      0      0  3     0x14280  nfsidl        nfsio
 32253   90400      0      0  3     0x14280  nfsidl        nfsio
 56611  415882      0      0  3     0x14280  nfsidl        nfsio
 60091  518906      0      0  3     0x14280  nfsidl        nfsio
 85705  473490      0      0  3     0x14280  nfsidl        nfsio
 77073  217027      0      0  3     0x14280  nfsidl        nfsio
 73678  130349      0      0  3     0x14280  nfsidl        nfsio
 16050  214705  68329      0  3        0x82  nanoslp       syz-executor
 34016   26156  68329      0  3        0x82  nanoslp       syz-executor
 12169  286730  68329      0  3        0x82  nanoslp       syz-executor
 46723   28045  68329      0  3        0x82  nanoslp       syz-executor
 81266  518463  68329      0  3        0x82  nanoslp       syz-executor
 31501  269021  68329      0  3        0x82  nanoslp       syz-executor
 18820  516665  68329      0  3        0x82  nanoslp       syz-executor
 68329   34271   8989      0  3        0x82  kqread        syz-executor
  8989  292006    152      0  3    0x10008a  sigsusp       ksh
   152  129170  17317      0  3        0x98  kqread        sshd-session
 17317  479959  52204      0  3        0x92  kqread        sshd-session
 57303  413131      1      0  3    0x100083  ttyopn        getty
 52204   79928      1      0  3        0x88  kqread        sshd
 24658  497355  71186     74  3   0x1100092  bpf           pflogd
 71186  515727      1      0  3        0x80  sbwait        pflogd
 33961  372558  98791     73  3   0x1100090  kqread        syslogd
 98791   39737      1      0  3    0x100082  sbwait        syslogd
 92632  258616      1      0  3    0x100080  kqread        resolvd
  8134   42093  61426     77  3    0x100092  kqread        dhcpleased
 59639   96276  61426     77  3    0x100092  kqread        dhcpleased
 61426  180919      1      0  3        0x80  kqread        dhcpleased
 77731  242670      0      0  3     0x14200  bored         smr
 41698  369146      0      0  2     0x14200                zerothread
 19632  218643      0      0  3     0x14200  aiodoned      aiodoned
 24090  164907      0      0  3     0x14200  syncer        update
 40785   50392      0      0  3     0x14200  cleaner       cleaner
 24524   14508      0      0  3     0x14200  reaper        reaper
 70175  365218      0      0  3     0x14200  pgdaemon      pagedaemon
 99401   69764      0      0  3     0x14200  bored         viomb
 45553  236649      0      0  3  0x40014200  acpi0         acpi0
 15578  506299      0      0  3  0x40014200                idle1
  6560  481444      0      0  3     0x14200  bored         softnet1
 69435  225575      0      0  2     0x14200                softnet0
 62304  437468      0      0  3     0x14200  smrbar        systqmp
 78636  364387      0      0  3     0x14200  bored         systq
 67651  407732      0      0  3     0x14200  tmoslp        softclockmp
  6721  261579      0      0  3  0x40014200  tmoslp        softclock
 56895  138104      0      0  3  0x40014200                idle0
     1  216609      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 34781 (syz-executor) thread 0xffff8000fffee548 (264237)
exclusive rwlock clonelk r = 0 (0xffffffff8391f648)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  if_clone_destroy+0x93 sys/net/if.c:-1
#3  ifioctl+0x59d sys/net/if.c:2160
#4  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
Process 32690 (syz-executor) thread 0xffff80003bbc74e8 (89368)
exclusive rwlock pf_lock r = 0 (0xffffffff8390ad98)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x13ca sys/net/pf_ioctl.c:3238
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff8390ae28)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2075
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a3b000)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#4  Xsyscall+0x128
Process 62304 (systqmp) thread 0xffff8000ffffe298 (437468)
shared rwlock systqmp r = 0 (0xffffffff839ca8e8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11073  12102K   12479K 166960K     12588        0
            pcb    18     12K      12K 166960K        84        0
         rtable   196     11K      12K 166960K       672        0
             pf    39     18K      24K 166960K       207        0
         ifaddr    35      5K       7K 166960K       103        0
        ifgroup    59      2K       2K 166960K       134        0
         sysctl     3      1K       9K 166960K         8        0
       counters    72     37K      38K 166960K       134        0
       ioctlops     1      2K       4K 166960K      1578        0
            iov     0      0K      16K 166960K        18        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1353     85K      85K 166960K      1776        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         8        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        27        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     244K 166960K       568        0
          sigio     0      0K       0K 166960K         5        0
           proc    72    115K     180K 166960K       801        0
        subproc    72      4K       4K 166960K       153        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        48        0
       in_multi    66      4K       7K 166960K       204        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     1      0K       0K 166960K        19        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       618        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   238    168K     185K 166960K      6385        0
       UVM aobj    49      2K       2K 166960K        50        0
     pinsyscall    43     86K     100K 166960K      1945        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        10        0
            NDP    13      0K       2K 166960K        72        0
           temp    44   9115K    9174K 166960K     23535        0
         kqueue    13     20K      26K 166960K        74        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      194    0      190     3     2     1     3     0     8    0
rtentry    176      216    0      137     6     0     6     6     0     8    0
unpcb      144      177    0      160     1     0     1     1     0     8    0
syncache   336        7    0        7     2     1     1     1     0     8    1
tcpcb      736       73    0       69     1     0     1     1     0     8    0
arp        136       37    0       24     1     0     1     1     0     8    0
inpcb      328      345    0      336     2     0     2     2     0     8    1
nd6        152       54    0       38     2     0     2     2     0     8    1
pkpcb       40        3    0        3     1     0     1     1     0     8    1
kcovpl      48       17    0        9     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1192      20    0       20     1     0     1     1     0     8    1
pppxif     1576       2    0        2     1     1     0     1     0     8    0
pfstscr     40        8    0        4     1     0     1     1     0     8    0
pffrag     232       19    0       17     1     0     1     1     0   482    0
pffrnode    88       19    0       17     1     0     1     1     0     8    0
pffrent     40       36    0       34     1     0     1     1     0     8    0
pfosfp      40     1428    0     1428     5     4     1     5     0     8    1
pfosfpen   112     1428    0     1428    21     4    17    21     0     8   17
pfrktable  1344       3    0        3     1     1     0     1     0     8    0
pfstlim    224        1    0        1     1     0     1     1     0     8    1
pfanchor   1288      14    0        2     1     0     1     1     0     8    0
pftag       88        5    0        2     1     0     1     1     0     8    0
pfstitem    24       73    0        4     1     0     1     1     0     8    0
pfstkey    128       81    0       12     3     0     3     3     0     8    0
pfstate    448       74    0        8     8     0     8     8     0     8    0
pfrule     1360      35    0       29     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      922    0      555    32     2    30    32     0     8    3
art_table   40      924    0      555     6     0     6     6     0     8    0
art_node    32      216    0      144     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl      72       25    0       15     1     0     1     1     0     8    0
shmpl      112       47    0        1     2     0     2     2     0     8    0
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     2125    0      636    94     0    94    94     0     8    0
ffsino     296     2125    0      636   115     0   115   115     0     8    0
nchpl      144     2743    0      998    65     0    65    65     0     8    0
rtmask      32        2    0        2     1     1     0     1     0     8    0
vnodes     216     2528    0        0   141     0   141   141     0     8    0
namei      1024   10127    0    10127     2     1     1     2     0     8    1
percpumem   16       82    0       31     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        1     1     1     0     1     0     8    0
kstatmem   264       83    0       52     3     0     3     3     0     8    0
scsiplug    72        4    0        4     1     0     1     1     0     8    1
scxspl     216     9745    0     9744    10     3     7     7     1     8    6
plimitpl   152       71    0       54     1     0     1     1     0     8    0
sigapl     424      879    0      810     9     0     9     9     0     8    1
knotepl    120      526    0        0    16     0    16    16     0     8    0
kqueuepl   224      115    0      102     1     0     1     1     0     8    0
pipepl     344      165    0      138     3     0     3     3     0     8    0
fdescpl    528      842    0      810     3     0     3     3     0     8    0
filepl     160     4320    0     4092    13     2    11    13     0     8    1
lockfpl    104      465    0      460     2     1     1     2     0     8    0
lockfspl    48       93    0       89     1     0     1     1     0     8    0
sessionpl  144       48    0       39     1     0     1     1     0     8    0
pgrppl      48       66    0       49     1     0     1     1     0     8    0
ucredpl    104      543    0      528     1     0     1     1     0     8    0
zombiepl   144      810    0      810     1     0     1     1     0     8    1
processpl  1232     879    0      810     6     0     6     6     0     8    0
procpl     664     1392    0     1312     9     1     8     8     0     8    1
sosppl     176        1    0        1     1     1     0     1     0     8    0
sockpl     752      734    0      704    11     5     6    11     0     8    3
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     114    0        0    15     1    14    15     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      38    0        0     5     0     5     5     0     8    0
mtagpl      96        5    0        0     1     0     1     1     0     8    0
mbufpl     256      554    0        0    35     0    35    35     0     8    0
bufpl      280     3359    0      107   233     0   233   233     0     8    0
anonpl      32     7565    0        0    61     0    61    61     0   246    0
amapchunkpl 152   19646    0    19138    27     1    26    27     0   158    6
amappl16   200     2475    0     2208    20     5    15    15     0     8    0
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184      548    0      546     1     0     1     1     0     8    0
amappl13   176      152    0      140     1     0     1     1     0     8    0
amappl12   168     1131    0     1100     2     0     2     2     0     8    0
amappl11   160        7    0        6     1     0     1     1     0     8    0
amappl10   152       74    0       60     1     0     1     1     0     8    0
amappl9    144      284    0      284     1     1     0     1     0     8    0
amappl8    136      132    0      130     1     0     1     1     0     8    0
amappl7    128      170    0      156     1     0     1     1     0     8    0
amappl6    120      245    0      242     1     0     1     1     0     8    0
amappl5    112      115    0      104     1     0     1     1     0     8    0
amappl4    104      340    0      319     1     0     1     1     0     8    0
amappl3     96     3852    0     3734     4     0     4     4     0     8    1
amappl2     88      646    0      583     2     0     2     2     0     8    0
amappl1     80    13686    0    13081    19     2    17    17     0     8    3
amappl      88     5443    0     5278     4     0     4     4     0    92    0
uvmvnodes   80      106    0        0     3     0     3     3     0     8    0
dma65536   65536      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      255    0      255     3     2     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       49    0        1     1     0     1     1     0     8    0
uaddrrnd    24      842    0      810     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      842    0      810     1     0     1     1     0     8    0
vmmpekpl   168     8918    0     8872     3     0     3     3     0     8    0
vmmpepl    168    63613    0    61425    99     0    99    99     0   357    3
vmsppl     488      841    0      810     5     0     5     5     0     8    1
rwobjpl     80    21017    0    19680    29     1    28    28     0     8    0
pdppl      4096    1691    0     1620   105    34    71    83     0     8    0
pvpl        32    14096    0        0   115     1   114   114     0   265    0
pmappl     256      841    0      810     3     0     3     3     0     8    1
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      316    0       43     9     0     9     9     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff838f6ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a3a800) at __mp_lock+0x199 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a3a800) at __mp_lock+0x199 sys/kern/kern_lock.c:173
intr_handler(ffff80003c47d9f0,ffff800000079600) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__mp_lock(ffffffff83a3a800) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a3a800) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80003c47db50,ffff8000002a3480) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff83a3a800) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a3a800) at __mp_lock+0x192 sys/kern/kern_lock.c:173
ktrsyscall(ffff80003bbc7250,2e,18,ffff80003c47de00) at ktrsyscall+0x2c7 ktrwrite sys/kern/kern_ktrace.c:-1 [inline]
ktrsyscall(ffff80003bbc7250,2e,18,ffff80003c47de00) at ktrsyscall+0x2c7 sys/kern/kern_ktrace.c:183
syscall(ffff80003c47de00) at syscall+0x305 mi_syscall sys/sys/syscall_mi.h:154 [inline]
syscall(ffff80003c47de00) at syscall+0x305 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x76be448dd060, count: -13
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff8391f740,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff8391f728,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(ffffef806c10cb00,ffff80003c3dfff8,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(ffffef806c10cb00,0,ffff80003c3e00c8,ffff80003c3e00ac,0,1,ce6f8e4eb9156905,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff80003c3e02e0,ffff80003c3e0318,ffff80003c3e0160,ffff80003c3e0148) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003c3e02e0,ffff80003c3e0318,ffff80003c3e0260) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(ffffef800ee89020,200000000000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003c3e0490,200000000200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80003c3e0490) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(24900,c4504441,ffff800000c5f800,1,ffff80003bbc74e8) at pfioctl+0x13ff sys/net/pf_ioctl.c:3238
VOP_IOCTL(ffffef80632cf630,c4504441,ffff800000c5f800,1,ffffef80097fd270,ffff80003bbc74e8) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(ffffef806c1b69a8,c4504441,ffff800000c5f800,ffff80003bbc74e8) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003bbc74e8,ffff80003c3e1040,ffff80003c3e0f90) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003c3e1040) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3e1040) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc0cfeadbf70, count: -18

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/08 18:49 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/03 07:23 openbsd cf839b82e3ec cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/06/03 07:22 openbsd cf839b82e3ec cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/30 05:58 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/30 05:58 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/30 05:58 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/27 11:12 openbsd 59afafd236bf cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/12 03:15 openbsd 369ac04692fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.