syzbot


uvm_fault: alltraps_kern_meltdown (2)

Status: upstream: reported on 2026/04/16 07:46
Reported-by: syzbot+742febd2e60866693d2b@syzkaller.appspotmail.com
First crash: 51d, last: 23d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: alltraps_kern_meltdown -1 5 148d 299d 0/3 auto-obsoleted due to no activity on 2026/04/08 12:46

Sample crash report:
login: uvm_fault(0xfffffd806c7135d0, 0x98, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff81e97628 cs 8 rflags 10246 cr2 98 cpl 0 rsp ffff80002ef9f0a0
gsbase 0xffff8000299adff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff81e97628
Starting stack trace...
panic(ffffffff8347f8d1) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff80002ef9eff0) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
dovutimens(ffff8000ffffdc90,fffffd806a55e878,ffff80002ef9f1d0) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2771
sys_futimes(ffff8000ffffdc90,ffff80002ef9f320,ffff80002ef9f270) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2813
syscall(ffff80002ef9f320) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002ef9f320) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf48fea31f30, count: 250
End of stack trace.
WARNING: SPL NOT LOWERED ON TRAP EXIT 4 0
Stopped at      alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*191686  14034  60929        0x10  0x4000000    1K syz-executor
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copyout() at copyout+0x64
mmrw(20c,ffff80002a2fa140,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a2f9f20) at spec_read+0x14b sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e6da120,ffff80002a2fa140,0,fffffd80097fd410) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c4a4c20,ffff80002a2fa140,1) at vn_read+0x17b sys/kern/vfs_vnops.c:375
dofilereadv(ffff80003c42b788,6,ffff80002a2fa140,1,ffff80002a2fa200) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80003c42b788,ffff80002a2fa2b0,ffff80002a2fa200) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3366
syscall(ffff80002a2fa2b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2fa2b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6ff6d7f1660, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffffd806c7135d0, 0x98, 0, 1) -> e
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copyout() at copyout+0x64
mmrw(20c,ffff80002a2fa140,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a2f9f20) at spec_read+0x14b sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e6da120,ffff80002a2fa140,0,fffffd80097fd410) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c4a4c20,ffff80002a2fa140,1) at vn_read+0x17b sys/kern/vfs_vnops.c:375
dofilereadv(ffff80003c42b788,6,ffff80002a2fa140,1,ffff80002a2fa200) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80003c42b788,ffff80002a2fa2b0,ffff80002a2fa200) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3366
syscall(ffff80002a2fa2b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2fa2b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6ff6d7f1660, count: -10
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a2f9d10
rbx                                0
rdx               0xffff8000015cea40
rcx               0xffff80003c42b788
rax                             0x2a
r8                0xffff80002a2f9c40
r9                               0x1
r10               0x1fe2da545ba8ca7b
r11               0xb14935680d87fd6e
r12                   0x20000034f480
r13                           0x1000    __ALIGN_SIZE
r14               0xffff80002a2fa140
r15                                0
rip               0xffffffff833bd20b    alltraps_kern_meltdown+0xb8
cs                               0x8
rflags                         0x246
rsp               0xffff80002a2f9c90
ss                              0x10
alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
ddb{1}> show proc
PROC (syz-executor) tid=191686 pid=14034 tcnt=3 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    runpri=86, usrpri=80, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c42ad28,0xffff80003c42a2d8
    process=0xffff80002a38ce88 user=0xffff80002a2f5000, vmspace=0xfffffd80664db5e0
    estcpu=30, cpticks=2, pctcpu=0.2, user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 84030  361996  33831      0  2           0                syz-executor
 90561  393476  31588      0  2           0                syz-executor
 90561  371503  31588      0  3   0x4000000  sbar          syz-executor
 90561  472218  31588      0  2   0x4000000                syz-executor
  1329  174892  51571      0  2           0                syz-executor
  1329   25456  51571      0  3   0x4000080  kqsel         syz-executor
  1329  195838  51571      0  3   0x4000080  fsleep        syz-executor
  1329  417986  51571      0  3   0x4000080  fsleep        syz-executor
 64698  158472  91462      0  2         0x2                ndp
 91462  144508  40060      0  3    0x10008a  sigsusp       sh
 14034  389093  56677  60929  3        0x10  vmmaplk       syz-executor
*14034  191686  56677  60929  7   0x4000010                syz-executor
 14034  344842  56677  60929  2   0x4000010                syz-executor
 51571  430292  24933      0  2       0xc82                syz-executor
 40060  435087  24933      0  3        0x82  wait          syz-executor
 69903  243823      1      0  2    0x100083                getty
 50829  395607      0      0  3     0x14280  nfsidl        nfsio
 61103  146449      0      0  3     0x14280  nfsidl        nfsio
  6613    8692      0      0  3     0x14280  nfsidl        nfsio
 93587   41964      0      0  3     0x14280  nfsidl        nfsio
 39738  159002      0      0  3     0x14280  nfsidl        nfsio
 11629  487926      0      0  3     0x14280  nfsidl        nfsio
  4555  126062      0      0  3     0x14280  nfsidl        nfsio
 18528  350900      0      0  3     0x14280  nfsidl        nfsio
  6541  128759      0      0  3     0x14280  nfsidl        nfsio
 76793   43826      0      0  3     0x14280  nfsidl        nfsio
 44647  154071      0      0  3     0x14280  nfsidl        nfsio
 77876  253965      0      0  3     0x14280  nfsidl        nfsio
  9585  174391      0      0  3     0x14280  nfsidl        nfsio
 41060  328057      0      0  3     0x14280  nfsidl        nfsio
 48269  509258      0      0  3     0x14280  nfsidl        nfsio
 19316  245499      0      0  3     0x14280  nfsidl        nfsio
 58913  192520      0      0  3     0x14280  nfsidl        nfsio
 87814   61002      0      0  3     0x14280  nfsidl        nfsio
 74440  162756      0      0  3     0x14280  nfsidl        nfsio
 38814  473751      0      0  3     0x14280  nfsidl        nfsio
 61726  438160      0      0  3     0x14200  acct          acct
 31588   61038  24933      0  2       0xc82                syz-executor
 33831  221350  24933      0  2       0xc82                syz-executor
 67021  413547  24933      0  2       0xc82                syz-executor
 93671  299595  24933      0  2         0x3                syz-executor
 68837  471318  24933      0  2         0x3                syz-executor
 56677  244096  24933      0  2       0xc82                syz-executor
 24933  235407  93602      0  2        0x82                syz-executor
 93602  443143  88816      0  3    0x10008a  sigsusp       ksh
 88816  199620   5353      0  3        0x98  kqread        sshd-session
  5353  251148  88428      0  3        0x92  kqread        sshd-session
 88428  226054      1      0  3        0x88  kqread        sshd
 52506  464141  54933     74  3   0x1100092  bpf           pflogd
 54933  184361      1      0  3        0x80  sbwait        pflogd
 77211    4730   2475     73  3   0x1100090  kqread        syslogd
  2475  285089      1      0  3    0x100082  sbwait        syslogd
   664  474416      1      0  3    0x100080  kqread        resolvd
 67978  198808  95248     77  3    0x100092  kqread        dhcpleased
 24312   50465  95248     77  3    0x100092  kqread        dhcpleased
 95248  423808      1      0  3        0x80  kqread        dhcpleased
 28421  523234      0      0  3     0x14200  bored         smr
 20057  360320      0      0  2     0x14200                zerothread
 20607  148499      0      0  3     0x14200  aiodoned      aiodoned
 74999  315329      0      0  2     0x14e00                update
  8612  484811      0      0  3     0x14200  cleaner       cleaner
  3007  279115      0      0  3     0x14200  kmmaplk       reaper
 37293  355153      0      0  3     0x14200  pgdaemon      pagedaemon
 57025  268168      0      0  3     0x14200  bored         viomb
 76862  378071      0      0  3  0x40014200  acpi0         acpi0
 58369  213851      0      0  3  0x40014200                idle1
 50649  222366      0      0  3     0x14200  bored         softnet1
 86158  404686      0      0  2     0x14200                softnet0
 41067  377943      0      0  2     0x14200                systqmp
 26153  148153      0      0  3     0x14200  bored         systq
 92008   85250      0      0  2     0x14200                softclockmp
 64523  176653      0      0  3  0x40014200  tmoslp        softclock
 64132  324024      0      0  3  0x40014200                idle0
     1  260926      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 90561 (syz-executor) thread 0xffff8000ffffdc90 (371503)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff839d31c0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
Process 64698 (ndp) thread 0xffff80003c42a560 (158472)
exclusive rwlock kmmaplk r = 0 (0xffffffff83a390e0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5171
#3  uvm_map_extract+0x5c7 sys/uvm/uvm_map.c:4278
#4  sys_kbind+0x6e4 sys/uvm/uvm_mmap.c:1279
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
exclusive rwlock vmmaplk r = 0 (0xfffffd80664db128)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5171
#3  uvm_map_extract+0x17c sys/uvm/uvm_map.c:4242
#4  sys_kbind+0x6e4 sys/uvm/uvm_mmap.c:1279
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
Process 14034 (syz-executor) thread 0xffff80003c42b788 (191686)
exclusive rwlock vmmaplk r = 0 (0xfffffd80664db6e0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
#3  uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x106 sys/uvm/uvm_fault.c:627
#5  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
#6  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
#7  alltraps_kern_meltdown+0x7b
#8  copyout+0x64
#9  mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
#10 spec_read+0x14b sys/kern/spec_vnops.c:215
#11 VOP_READ+0x101 sys/kern/vfs_vops.c:227
#12 vn_read+0x17b sys/kern/vfs_vnops.c:375
#13 dofilereadv+0x25a sys/kern/sys_generic.c:252
#14 sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3366
#15 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#15 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#16 Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11069  12159K   12464K 166960K     12718        0
            pcb    17     12K      12K 166960K        91        0
         rtable   183      5K       7K 166960K       641        0
             pf    33     17K      24K 166960K       134        0
         ifaddr    37      6K       7K 166960K        98        0
        ifgroup    51      2K       2K 166960K       128        0
         sysctl     4      1K       9K 166960K        11        0
       counters    68     36K      37K 166960K       114        0
       ioctlops     0      0K       4K 166960K      1570        0
            iov     1      2K      12K 166960K        13        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1292     81K      82K 166960K      1756        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         4        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        55        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K      93K 166960K       614        0
          sigio     0      0K       0K 166960K         6        0
           proc    73    115K     164K 166960K       860        0
        subproc    72      4K       4K 166960K       153        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        48        0
       in_multi    78      5K       6K 166960K       204        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     0      0K       0K 166960K        19        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       540        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   213    167K     185K 166960K      6852        0
       UVM aobj    12      4K       4K 166960K        14        0
     pinsyscall    42     84K     104K 166960K      2029        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        19        0
            NDP    15      0K       1K 166960K        66        0
           temp    49   9080K    9147K 166960K     31493        0
         kqueue    13     20K      29K 166960K        82        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       99    0       96     2     1     1     2     0     8    0
rtentry    176      216    0      134     5     0     5     5     0     8    0
unpcb      144      266    0      249     5     4     1     4     0     8    0
syncache   336        9    0        9     4     3     1     1     0     8    1
tcpqe       32        2    0        2     1     0     1     1     0     8    1
tcpcb      736      115    0      110     4     2     2     4     0     8    1
arp        136       36    0       20     1     0     1     1     0     8    0
inpcb      328      520    0      510    12     8     4     7     0     8    3
nd6        152       52    0       35     1     0     1     1     0     8    0
pkpcb       40        4    0        4     2     2     0     1     0     8    0
kcovpl      48       17    0        9     1     0     1     1     0     8    0
ppxss      1192       7    0        7     2     1     1     1     0     8    1
pppxif     1576       1    0        1     1     1     0     1     0     8    0
pfstscr     40        1    0        1     1     1     0     1     0     8    0
pffrag     232        5    0        0     1     0     1     1     0   482    0
pffrnode    88        5    0        0     1     0     1     1     0     8    0
pffrent     40        8    0        3     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfsrclim   320        4    0        4     2     1     1     1     0     8    1
pfanchor   1288       5    0        1     1     0     1     1     0     8    0
pfqueue    320        2    0        2     2     1     1     1     0     8    1
pfstitem    24       50    0       15     1     0     1     1     0     8    0
pfstkey    128       52    0       17     2     0     2     2     0     8    0
pfstate    448       51    0       16     6     0     6     6     0     8    0
pfrule     1360      23    0       18     2     1     1     2     0     8    0
rttmr      136        2    0        2     1     1     0     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      942    0      579    30     6    24    29     0     8    1
art_table   40      943    0      579     5     0     5     5     0     8    0
art_node    32      216    0      143     1     0     1     1     0     8    0
sysvmsgpl   40        8    0        3     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       53    0       43     1     0     1     1     0     8    0
shmpl      112       11    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     2265    0      787    93     0    93    93     0     8    0
ffsino     296     2265    0      787   114     0   114   114     0     8    0
nchpl      144     2962    0     1224    65     0    65    65     0     8    0
vnodes     216     2603    0        0   145     0   145   145     0     8    0
namei      1024   10721    0    10721     5     4     1     2     0     8    1
percpumem   16       72    0       23     1     0     1     1     0     8    0
kstatmem   264       67    0       42     3     1     2     3     0     8    0
scsiplug    72        3    0        3     3     3     0     1     0     8    0
scxspl     216    10627    0    10627     9     8     1     8     1     8    1
plimitpl   152       61    0       44     1     0     1     1     0     8    0
sigapl     424      939    0      871    10     1     9     9     0     8    1
knotepl    120      322    0        0    10     0    10    10     0     8    0
kqueuepl   224      157    0      147     3     1     2     3     0     8    1
pipepl     344      266    0      239     6     0     6     6     0     8    3
fdescpl    528      901    0      871     3     0     3     3     0     8    0
filepl     160     4302    0     4087    18     5    13    15     0     8    3
lockfpl    104      124    0      122     1     0     1     1     0     8    0
lockfspl    48       59    0       57     1     0     1     1     0     8    0
sessionpl  144       52    0       43     1     0     1     1     0     8    0
pgrppl      48      135    0      118     1     0     1     1     0     8    0
ucredpl    104      368    0      354     1     0     1     1     0     8    0
zombiepl   144      956    0      955     1     0     1     1     0     8    0
processpl  1232     939    0      871     7     1     6     6     0     8    0
procpl     664     1544    0     1468     8     0     8     8     0     8    1
sosppl     176        1    0        1     1     1     0     1     0     8    0
sockpl     752      900    0      870    27    19     8    17     0     8    5
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     126    0        0    16     0    16    16     0     8    0
mcl2k      2048      24    0        0     3     0     3     3     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      164    0        0    11     0    11    11     0     8    0
bufpl      280     3616    0      104   251     0   251   251     0     8    0
anonpl      32     7486    0        0    61     0    61    61     0   246    0
amapchunkpl 152   20595    0    20204    37    11    26    28     0   158    6
amappl16   200     1646    0     1566    18    13     5    15     0     8    0
amappl15   192        4    0        4     1     1     0     1     0     8    0
amappl14   184      536    0      534     1     0     1     1     0     8    0
amappl13   176      147    0      134     1     0     1     1     0     8    0
amappl12   168     1187    0     1159     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       62    0       48     1     0     1     1     0     8    0
amappl9    144      273    0      273     1     1     0     1     0     8    0
amappl8    136      135    0      132     1     0     1     1     0     8    0
amappl7    128      206    0      192     1     0     1     1     0     8    0
amappl6    120      266    0      262     1     0     1     1     0     8    0
amappl5    112      101    0       90     1     0     1     1     0     8    0
amappl4    104      335    0      314     1     0     1     1     0     8    0
amappl3     96     4151    0     4058     4     1     3     4     0     8    0
amappl2     88      645    0      582     2     0     2     2     0     8    0
amappl1     80    13688    0    13058    23     6    17    17     0     8    0
amappl      88     5882    0     5744     6     2     4     5     0    92    0
uvmvnodes   80      115    0        1     3     0     3     3     0     8    0
dma16384   16384      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        7    0        7     2     2     0     1     0     8    0
dma128     128      255    0      255     2     2     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       13    0        2     1     0     1     1     0     8    0
uaddrrnd    24      901    0      871     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      901    0      871     1     0     1     1     0     8    0
vmmpekpl   168     9787    0     9742     3     0     3     3     0     8    0
vmmpepl    168    66128    0    64244   116    17    99    99     0   357    3
vmsppl     488      900    0      870     6     1     5     5     0     8    0
rwobjpl     80    20599    0    19479    33     5    28    28     0     8    1
pdppl      4096    1809    0     1740   123    46    77    85     0     8    8
pvpl        32    14341    0        0   116     0   116   116     0   265    0
pmappl     256      900    0      870     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      311    0       65     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83898ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839d29c0) at __mp_lock+0x190 __mp_lock_spin sys/kern/kern_lock.c:143 [inline]
__mp_lock(ffffffff839d29c0) at __mp_lock+0x190 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf kd_curproc sys/dev/kcov.c:580 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf sys/dev/kcov.c:153
pool_put(ffffffff8399a8e0,fffffd806c49b908) at pool_put+0xba sys/kern/subr_pool.c:805
uvm_unmap_detach(ffff80003c3d9540,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1359
uvm_map_teardown(fffffd806c7137b8) at uvm_map_teardown+0x360 sys/uvm/uvm_map.c:2536
exit1(ffff8000367ad4e8,0,0,1) at exit1+0x6fc sys/kern/kern_exit.c:260
sys_exit(ffff8000367ad4e8,ffff80003c3d9710,ffff80003c3d9660) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c3d9710) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3d9710) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
end trace frame: 0xffff80003c3d9790, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff83898ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839d29c0) at __mp_lock+0x190 __mp_lock_spin sys/kern/kern_lock.c:143 [inline]
__mp_lock(ffffffff839d29c0) at __mp_lock+0x190 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf kd_curproc sys/dev/kcov.c:580 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf sys/dev/kcov.c:153
pool_put(ffffffff8399a8e0,fffffd806c49b908) at pool_put+0xba sys/kern/subr_pool.c:805
uvm_unmap_detach(ffff80003c3d9540,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1359
uvm_map_teardown(fffffd806c7137b8) at uvm_map_teardown+0x360 sys/uvm/uvm_map.c:2536
exit1(ffff8000367ad4e8,0,0,1) at exit1+0x6fc sys/kern/kern_exit.c:260
sys_exit(ffff8000367ad4e8,ffff80003c3d9710,ffff80003c3d9660) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c3d9710) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3d9710) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7677d62be850, count: -15
ddb{0}> machine ddbcpu 1
Stopped at      alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copyout() at copyout+0x64
mmrw(20c,ffff80002a2fa140,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a2f9f20) at spec_read+0x14b sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e6da120,ffff80002a2fa140,0,fffffd80097fd410) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c4a4c20,ffff80002a2fa140,1) at vn_read+0x17b sys/kern/vfs_vnops.c:375
dofilereadv(ffff80003c42b788,6,ffff80002a2fa140,1,ffff80002a2fa200) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80003c42b788,ffff80002a2fa2b0,ffff80002a2fa200) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3366
syscall(ffff80002a2fa2b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2fa2b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6ff6d7f1660, count: 5
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copyout() at copyout+0x64
mmrw(20c,ffff80002a2fa140,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a2f9f20) at spec_read+0x14b sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e6da120,ffff80002a2fa140,0,fffffd80097fd410) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c4a4c20,ffff80002a2fa140,1) at vn_read+0x17b sys/kern/vfs_vnops.c:375
dofilereadv(ffff80003c42b788,6,ffff80002a2fa140,1,ffff80002a2fa200) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80003c42b788,ffff80002a2fa2b0,ffff80002a2fa200) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3366
syscall(ffff80002a2fa2b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2fa2b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6ff6d7f1660, count: -10

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/13 23:09 openbsd ed5454cb43ec 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
2026/04/16 07:45 openbsd 2a36b3c3c2a3 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
* Struck through repros no longer work on HEAD.