assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (4)

Status: upstream: reported on 2026/07/22 08:14
Reported-by: syzbot+7b7e690f0ba72ecb65c5@syzkaller.appspotmail.com
First crash: 58d, last: 28d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c -1 1 2391d 2391d 3/4 fixed on 2020/04/22 21:18
openbsd assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (3) -1 4 755d 883d 0/4 auto-obsoleted due to no activity on 2024/11/22 13:01
openbsd assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (2) -1 1 2336d 2336d 0/4 auto-closed as invalid on 2020/07/25 17:46

Sample crash report:
panic: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/main/kernel/sys/netinet6/nd6.c", line 704
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83489e59) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff834c5b67,ffffffff834d1153,2c0,ffffffff834c7451) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff5000cb01e68,ffff8000015f7000,0) at nd6_free+0x2ad
nd6_purge(ffff8000015f7000) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015f7000) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015f7000) at if_detach+0x333 sys/net/if.c:1314
tun_clone_destroy(ffff8000015f7000) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80003c8e2d90) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003c8e2e50) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff5006bae0cf8,7,fffff50007ffd340,ffff80002ccaa560) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff5006eff7530,ffff80002ccaa560) at fdrop+0x121 sys/kern/kern_descrip.c:1281
end trace frame: 0xffff80003c8e2fd0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/main/kernel/sys/netinet6/nd6.c", line 704
ddb> show kasan
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83489e59) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff834c5b67,ffffffff834d1153,2c0,ffffffff834c7451) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff5000cb01e68,ffff8000015f7000,0) at nd6_free+0x2ad
nd6_purge(ffff8000015f7000) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015f7000) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015f7000) at if_detach+0x333 sys/net/if.c:1314
tun_clone_destroy(ffff8000015f7000) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80003c8e2d90) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003c8e2e50) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff5006bae0cf8,7,fffff50007ffd340,ffff80002ccaa560) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff5006eff7530,ffff80002ccaa560) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5006eff7530,ffff80002ccaa560) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002ccaa560) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002ccaa560,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002ccaa560,ffff80003c8e31b0,ffff80003c8e3100) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c8e31b0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c8e31b0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7844f650a160, count: -20
ddb> 

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/21 13:35 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
2026/08/18 19:38 openbsd c2844c6b7636 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
2026/07/22 08:14 openbsd e524649e2c66 b561ce9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c
* Struck through repros no longer work on HEAD.