protection_fault: dtioctl

Status: upstream: reported on 2026/08/27 13:17
Reported-by: syzbot+7145e89c7192f0144904@syzkaller.appspotmail.com
First crash: 1d21h, last: 1d21h

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      dtioctl+0x489:  movl    0x28(%r12),%r13d
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> show kasan
No such command
ddb> trace
dtioctl(11e60,80184404,ffff80003c9aef80,81,ffff80003c90a560) at dtioctl+0x489 dt_ioctl_probe_enable sys/dev/dt/dt_dev.c:613 [inline]
dtioctl(11e60,80184404,ffff80003c9aef80,81,ffff80003c90a560) at dtioctl+0x489 sys/dev/dt/dt_dev.c:328
VOP_IOCTL(fffff300697f8dd0,80184404,ffff80003c9aef80,81,fffff30007ffd270,ffff80003c90a560) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffff30067d889e0,80184404,ffff80003c9aef80,ffff80003c90a560) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c90a560,ffff80003c9af150,ffff80003c9af0a0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c9af150) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9af150) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xce83b1bbd0, count: -6
ddb> show registers
rdi               0xffff80002d4aa000
rsi                            0x1bf
rbp               0xffff80003c9aedb0
rbx                            0x160
rdx               0xffff80002d4aa000
rcx                            0x1be
rax               0xffffffff8318884c    dtioctl+0x49c
r8                0xffff80003c90a560
r9                0xffff80003c90a560
r10               0x332e1d1409394c8b
r11               0xd7b71e461519d5a5
r12                 0xffff800000c500
r13                                0
r14               0xffff80003c9aef80
r15               0xffff800001617180
rip               0xffffffff83188839    dtioctl+0x489
cs                               0x8
rflags                       0x10206    __ALIGN_SIZE+0xf206
rsp               0xffff80003c9aed30
ss                              0x10
dtioctl+0x489:  movl    0x28(%r12),%r13d
ddb> show proc
PROC (syz-executor) tid=152109 pid=10618 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c90a2c8,0xffffffff83ad9fa8
    process=0xffff80003c995220 user=0xffff80003c9aa000, vmspace=0xfffff3006d182180
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 95578   42594  31983     0  2           0      0xc80           syz-executor
 95578  415721  31983     0  3           0  0x4000000 smrbar    syz-executor
 10618  442835   1869     0  2           0          0           syz-executor
 10618  464255   1869     0  3           0  0x4000080 rest      syz-executor
 10618  157593   1869     0  3           0  0x4000080 bell      syz-executor
*10618  152109   1869     0  7           0  0x4000000           syz-executor
 46620  274656      0     0  3     0x14000      0x280 nfsidl    nfsio
 86794  349308      0     0  3     0x14000      0x280 nfsidl    nfsio
 95914  380435      0     0  3     0x14000      0x280 nfsidl    nfsio
 50063  147549      0     0  3     0x14000      0x280 nfsidl    nfsio
 24009  163767      0     0  3     0x14000      0x280 nfsidl    nfsio
 85301  409783      0     0  3     0x14000      0x280 nfsidl    nfsio
 64816  294737      0     0  3     0x14000      0x280 nfsidl    nfsio
 20413  318330      0     0  3     0x14000      0x280 nfsidl    nfsio
 27778  448729      0     0  3     0x14000      0x280 nfsidl    nfsio
 67961  295947      0     0  3     0x14000      0x280 nfsidl    nfsio
 10945  365534      0     0  3     0x14000      0x280 nfsidl    nfsio
 76748  412704      0     0  3     0x14000      0x280 nfsidl    nfsio
 54259   59964      0     0  3     0x14000      0x280 nfsidl    nfsio
  2681  145050      0     0  3     0x14000      0x280 nfsidl    nfsio
 12930  458561      0     0  3     0x14000      0x280 nfsidl    nfsio
 99570   72774      0     0  3     0x14000      0x280 nfsidl    nfsio
 44967   43504      0     0  3     0x14000      0x280 nfsidl    nfsio
  6162  142370      0     0  3     0x14000      0x280 nfsidl    nfsio
 93429  523548      0     0  3     0x14000      0x280 nfsidl    nfsio
 77375  494175      0     0  3     0x14000      0x280 nfsidl    nfsio
 91070  183180  50435     0  2        0x10      0xc80           syz-executor
 91070  297464  50435     0  3        0x10  0x4000080 kqread    syz-executor
 91070  313249  50435     0  3        0x10  0x4000080 fsleep    syz-executor
  8615   27497  22827     0  3           0       0x80 nanoslp   syz-executor
  8615   41974  22827     0  3           0  0x4000080 sbwait    syz-executor
  8615  478180  22827     0  3           0  0x4000080 fsleep    syz-executor
 75057    2105  48746     0  3           0       0x80 nanoslp   syz-executor
 75057  179004  48746     0  3           0  0x4000080 ttyin     syz-executor
 75057  317284  48746     0  3           0  0x4000080 fsleep    syz-executor
 75057  220753  48746     0  3           0  0x4000080 fsleep    syz-executor
 98199   11299  83827     0  2           0      0xc80           syz-executor
 98199  257495  83827     0  3           0  0x4000080 kqread    syz-executor
 98199  195127  83827     0  3           0  0x4000080 fsleep    syz-executor
 62845  321392      0     0  3     0x14000      0x200 acct      acct
 74607  521058  23282     0  3      0x1000     0x2000 suspend   syz-executor
 74607  363658  23282     0  2      0x1000  0x4080000           syz-executor
 57503   27969      1     0  3    0x100003       0x80 ttyin     getty
 83827  170792  13662     0  3         0x2       0x80 nanoslp   syz-executor
 22827  513647  13662     0  3         0x2       0x80 nanoslp   syz-executor
 31983  343346  13662     0  2         0x2      0xc80           syz-executor
 14458  397008  13662     0  3         0x2       0x80 nanoslp   syz-executor
 48746  373108  13662     0  3         0x2       0x80 nanoslp   syz-executor
 23282  427601  13662     0  3         0x2       0x80 nanoslp   syz-executor
  1869  275409  13662     0  3         0x2       0x80 nanoslp   syz-executor
 50435  344038  13662     0  2         0x2      0xc80           syz-executor
 13662  342207      1     0  3         0x2       0x80 kqread    syz-executor
 85347  185090      1     0  3         0x2       0x88 kqread    sshd
 28017  209793  55734    73  3   0x1100010       0x80 kqread    syslogd
 55734    3505      1     0  3    0x100002       0x80 sbwait    syslogd
 95595  421350      1     0  3    0x100000       0x80 kqread    resolvd
 38192  406598  19556    77  3    0x100012       0x80 kqread    dhcpleased
 81876  358072  19556    77  3    0x100012       0x80 kqread    dhcpleased
 19556  273038      1     0  3           0       0x80 kqread    dhcpleased
 19091    2599      0     0  3     0x14000      0x200 bored     smr
 26123  117279      0     0  2     0x14000      0x200           zerothread
 40539  121781      0     0  3     0x14000      0x200 aiodoned  aiodoned
 97398  340352      0     0  3     0x14000      0x200 syncer    update
 78595  116686      0     0  3     0x14000      0x200 cleaner   cleaner
 81345  500138      0     0  3     0x14000      0x200 reaper    reaper
 77254  495579      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 11628  186801      0     0  3     0x14000      0x200 bored     viomb
 19552  495400      0     0  3     0x14000 0x40000200 acpi0     acpi0
 51818  342552      0     0  3     0x14000      0x200 bored     softnet0
 51153  314357      0     0  3     0x14000      0x200 smrbar    systqmp
 17892  501544      0     0  3     0x14000      0x200 bored     systq
 88390  283624      0     0  3     0x14000 0x40000200 tmoslp    softclock
 25138   71705      0     0  3     0x14000 0x40000200           idle0
     1   20151      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11045  12125K   12329K 166960K     12483        0
            pcb    18     14K      15K 166960K        61        0
         rtable   231      7K       8K 166960K       385        0
             pf    34     13K      19K 166960K        75        0
         ifaddr    41      7K       7K 166960K        49        0
        ifgroup    52      2K       2K 166960K        64        0
         sysctl     3      1K       9K 166960K        10        0
       counters    36     18K      18K 166960K        42        0
       ioctlops     0      0K       4K 166960K        63        0
            iov     1      0K      12K 166960K        11        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1353     85K      85K 166960K      1569        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K       9K 166960K         8        0
         VM map     2      1K       1K 166960K         2        0
            sem     7      0K       0K 166960K         8        0
        dirhash    12      2K       2K 166960K        15        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    18     65K      97K 166960K       260        0
          sigio     0      0K       0K 166960K         4        0
           proc    60     59K     124K 166960K       522        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K        16        0
       in_multi    89      6K       6K 166960K       114        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     0      0K       0K 166960K        12        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       383        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   225    142K     165K 166960K      4064        0
       UVM aobj     9      2K       3K 166960K        11        0
     pinsyscall    34     68K      96K 166960K      1367        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K         8        0
            NDP    12      0K       2K 166960K        31        0
           temp    42   9111K    9118K 166960K     10355        0
         kqueue    15     24K      24K 166960K        45        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       43    0       40     1     0     1     1     0     8    0
rtentry    136      118    0       14     4     0     4     4     0     8    0
unpcb      144      104    0       91     1     0     1     1     0     8    0
syncache   336        7    0        7     1     0     1     1     0     8    1
tcpqe       32        4    0        4     1     0     1     1     0     8    1
tcpcb      736       56    0       44     2     0     2     2     0     8    0
arp         96       21    0        2     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        1    0        0     1     0     1     1     0     8    0
inpcb      328      309    0      224     8     0     8     8     0     8    0
nd6        112       25    0        4     1     0     1     1     0     8    0
pkpcb       40        3    0        2     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1072       7    0        4     1     0     1     1     0     8    0
pppxif     1416       1    0        1     1     0     1     1     0     8    1
pfstscr     40        1    0        0     1     0     1     1     0     8    0
pfrktable  1344       4    0        4     1     0     1     1     0     8    1
pfanchor   1288       5    0        2     1     0     1     1     0     8    0
pftag       88        1    0        1     1     0     1     1     0     8    1
pfstitem    24        5    0        0     1     0     1     1     0     8    0
pfstkey    128        5    0        1     1     0     1     1     0     8    0
pfstate    384        3    0        0     1     0     1     1     0     8    0
pfrule     1360       3    0        3     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      467    0       48    30     0    30    30     0     8    2
art_table   40      468    0       48     5     0     5     5     0     8    0
art_node    32      118    0       23     1     0     1     1     0     8    0
semapl      72        6    0        1     1     0     1     1     0     8    0
shmpl      112        8    0        2     1     0     1     1     0     8    0
dirhash    1024      19    0        2     3     0     3     3     0     8    0
dino2pl    256     1847    0      389    92     0    92    92     0     8    0
ffsino     256     1847    0      389    92     0    92    92     0     8    0
nchpl      144     2217    0      515    64     0    64    64     0     8    0
rtmask      32        3    0        1     1     0     1     1     0     8    0
vnodes     216     2053    0        0   115     0   115   115     0     8    0
namei      1024    7026    0     7026     2     0     2     2     0     8    2
pfiaddrpl  120        1    0        1     1     0     1     1     0     8    1
kstatmem   264       31    0        6     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216    11246    0    11246     4     0     4     4     1     8    4
plimitpl   152       80    0       64     1     0     1     1     0     8    0
sigapl     424      577    0      516     7     0     7     7     0     8    0
knotepl    120     7569    0     7512     9     0     9     9     0     8    7
kqueuepl   184       60    0       49     1     0     1     1     0     8    0
pipepl     304      196    0      168     8     0     8     8     0     8    5
fdescpl    448      543    0      516     5     0     5     5     0     8    1
filepl     120     2915    0     2592    13     0    13    13     0     8    3
lockfpl    104       62    0       60     1     0     1     1     0     8    0
lockfspl    48       26    0       24     1     0     1     1     0     8    0
sessionpl  144       29    0       22     1     0     1     1     0     8    0
pgrppl      48       40    0       25     1     0     1     1     0     8    0
ucredpl    104      409    0      398     1     0     1     1     0     8    0
zombiepl   144      518    0      516     1     0     1     1     0     8    0
processpl  1152     577    0      516     5     0     5     5     0     8    0
procpl     664      774    0      699     7     0     7     7     0     8    0
sockpl     552      461    0      358     8     0     8     8     0     8    0
mcl64k     65536     12    0       12     1     0     1     1     0     8    1
mcl16k     16384      3    0        3     1     0     1     1     0     8    1
mcl9k128   9344       1    0        1     1     0     1     1     0     8    1
mcl8k      8192       8    0        8     1     0     1     1     0     8    1
mcl4k      4096    2686    0     2633    14     0    14    14     0     8    6
mcl2k2     2112       1    0        1     1     0     1     1     0     8    1
mcl2k      2048     357    0      356     1     0     1     1     0     8    0
mextrefs    64       97    0       97     1     0     1     1     0     8    1
mtagpl      96        4    0        4     1     0     1     1     0     8    1
mbufpl     256     5702    0     5552    11     0    11    11     0     8    0
bufpl      272     4447    0      105   290     0   290   290     0     8    0
anonpl      24   103083    0    97387    80     0    80    80     0   187   31
amapchunkpl 152   11795    0    11232    29     0    29    29     0   158    6
amappl16   200     2117    0     1971    34     9    25    34     0     8   14
amappl15   192        3    0        3     1     0     1     1     0     8    1
amappl14   184      408    0      408     1     0     1     1     0     8    1
amappl13   176      115    0      107     1     0     1     1     0     8    0
amappl12   168      780    0      754     2     0     2     2     0     8    0
amappl11   160        4    0        4     1     0     1     1     0     8    1
amappl10   152       61    0       51     1     0     1     1     0     8    0
amappl9    144      270    0      270     1     0     1     1     0     8    1
amappl8    136       94    0       93     1     0     1     1     0     8    0
amappl7    128      146    0      134     1     0     1     1     0     8    0
amappl6    120      149    0      148     1     0     1     1     0     8    0
amappl5    112       89    0       84     1     0     1     1     0     8    0
amappl4    104      275    0      259     1     0     1     1     0     8    0
amappl3     96     2110    0     2014     3     0     3     3     0     8    0
amappl2     88      665    0      603     2     0     2     2     0     8    0
amappl1     80    11032    0    10641    14     0    14    14     0     8    6
amappl      88     3351    0     3183     4     0     4     4     0    92    0
uvmvnodes   80      101    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      254    0      254     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       10    0        2     1     0     1     1     0     8    0
uaddrrnd    24      543    0      516     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      543    0      516     1     0     1     1     0     8    0
vmmpekpl   168     6697    0     6667     3     0     3     3     0     8    0
vmmpepl    168    44673    0    43014    95     0    95    95     0   357   18
vmsppl     368      542    0      516     4     0     4     4     0     8    1
rwobjpl     40    16142    0    15177    15     0    15    15     0     8    1
pdppl      4096    1092    0     1032    96    34    62    82     0     8    2
pvpl        32   269712    0   259262   172     0   172   172     0   265   60
pmappl     216      542    0      516     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      651    0       34    18     0    18    18     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
dtioctl(11e60,80184404,ffff80003c9aef80,81,ffff80003c90a560) at dtioctl+0x489 dt_ioctl_probe_enable sys/dev/dt/dt_dev.c:613 [inline]
dtioctl(11e60,80184404,ffff80003c9aef80,81,ffff80003c90a560) at dtioctl+0x489 sys/dev/dt/dt_dev.c:328
VOP_IOCTL(fffff300697f8dd0,80184404,ffff80003c9aef80,81,fffff30007ffd270,ffff80003c90a560) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffff30067d889e0,80184404,ffff80003c9aef80,ffff80003c90a560) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c90a560,ffff80003c9af150,ffff80003c9af0a0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c9af150) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9af150) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xce83b1bbd0, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
dtioctl(11e60,80184404,ffff80003c9aef80,81,ffff80003c90a560) at dtioctl+0x489 dt_ioctl_probe_enable sys/dev/dt/dt_dev.c:613 [inline]
dtioctl(11e60,80184404,ffff80003c9aef80,81,ffff80003c90a560) at dtioctl+0x489 sys/dev/dt/dt_dev.c:328
VOP_IOCTL(fffff300697f8dd0,80184404,ffff80003c9aef80,81,fffff30007ffd270,ffff80003c90a560) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffff30067d889e0,80184404,ffff80003c9aef80,ffff80003c90a560) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c90a560,ffff80003c9af150,ffff80003c9af0a0) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c9af150) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9af150) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xce83b1bbd0, count: -6
ddb> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/27 13:16 openbsd eaf6a50527ed c53a1b9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: dtioctl
* Struck through repros no longer work on HEAD.