witness: lock_object uninitialized: ADDR (6)

Status: upstream: reported on 2026/07/24 08:54
Reported-by: syzbot+7f96d1ae30eae229ea32@syzkaller.appspotmail.com
First crash: 9d14h, last: 6d16h
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: lock_object uninitialized: ADDR (4) -1 1 310d 310d 0/4 auto-obsoleted due to no activity on 2025/12/25 23:24
openbsd witness: lock_object uninitialized: ADDR (5) -1 1 188d 188d 0/4 auto-obsoleted due to no activity on 2026/04/26 15:18
openbsd witness: lock_object uninitialized: ADDR (2) -1 1 1383d 1383d 0/4 auto-obsoleted due to no activity on 2023/01/17 13:32
openbsd witness: lock_object uninitialized: ADDR (3) -1 syz, C 6417 536d 1219d 0/4 auto-obsoleted due to no activity on 2025/05/07 22:43
openbsd witness: lock_object uninitialized: ADDR -1 71 1539d 1679d 0/4 auto-closed as invalid on 2022/08/14 06:12

Sample crash report:
witness: lock_object uninitialized: 0xffffffff85222690
Starting stack trace...
witness_debugger(1) at witness_debugger+0xb2 sys/kern/subr_witness.c:2572
witness_checkorder(ffffffff85222690,9,0) at witness_checkorder+0x19c sys/kern/subr_witness.c:783
mtx_enter(ffffffff85222680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffffffff85222680,ffff8000337585e0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffffffff8546b440,17b88) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffffffff8546b0e0,f0,ffffffff8123d4c0,0,0,ffff8000337587c0) at fork1+0x1225 sys/kern/kern_fork.c:511
kthread_create(ffffffff8123d4c0,0,0,ffffffff8468ab60) at kthread_create+0xa8 sys/kern/kern_kthread.c:61
nfs_getset_niothreads(1) at nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
nfs_sysctl(ffff8000337589c8,1,0,ffff8000337589a0,200000000180,0,ffff800033758c10) at nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:891
sys_sysctl(ffff80003a706a88,ffff800033758c10,ffff800033758b80) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800033758c10) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800033758c10) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
eStopped at      db_enter+0x17:  popq    %rbp
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
kasan: no report recorded this boot
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
witness_checkorder(ffffffff85222690,9,0) at witness_checkorder+0x19c sys/kern/subr_witness.c:783
mtx_enter(ffffffff85222680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffffffff85222680,ffff8000337585e0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffffffff8546b440,17b88) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffffffff8546b0e0,f0,ffffffff8123d4c0,0,0,ffff8000337587c0) at fork1+0x1225 sys/kern/kern_fork.c:511
kthread_create(ffffffff8123d4c0,0,0,ffffffff8468ab60) at kthread_create+0xa8 sys/kern/kern_kthread.c:61
nfs_getset_niothreads(1) at nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
nfs_sysctl(ffff8000337589c8,1,0,ffff8000337589a0,200000000180,0,ffff800033758c10) at nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:891
sys_sysctl(ffff80003a706a88,ffff800033758c10,ffff800033758b80) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800033758c10) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800033758c10) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8810e4cf30, count: -12
ddb{0}> show registers
rdi                              0x3
rsi                                0
rbp               0xffff800033758170
rbx                                0
rdx               0xffff80000016f280
rcx                          0x7ffff    acpi_pdirpa+0x6be70
rax               0xffff80002a2c9000
r8                0xffff8000337580a0
r9                0xffff800033757ee0
r10               0xffff800033757e78
r11               0xffffffff8184f420    comstart
r12               0xffffffff85222690    cpu_info_full_primary+0x2690
r13                              0x4
r14                                0
r15               0xffffffff852226b0    cpu_info_full_primary+0x26b0
rip               0xffffffff820d6ab7    db_enter+0x17
cs                               0x8
rflags                         0x246
rsp               0xffff800033758170
ss                              0x10
db_enter+0x17:  popq    %rbp
ddb{0}> show proc
PROC (syz-executor) tid=109030 pid=72273 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=80, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003a707780,0xffff80003a707a28
    process=0xffff800045ff9358 user=0xffff80003374d000, vmspace=0xffff800001c4d7b8
    estcpu=30, cpticks=32, pctcpu=0.20, user=0, sys=31, intr=1
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 97160  118220      0     0  2     0x14000      0x200           swapper
 72273   23574  14148     0  2           0          0           syz-executor
 72273  438649  14148     0  3           0  0x4000000 getblk    syz-executor
*72273  109030  14148     0  7           0  0x4000000           syz-executor
 90572  311052  85698     0  2        0x10      0xc80           syz-executor
 90572  217632  85698     0  3        0x10  0x4000080 kqsel     syz-executor
 90572  399111  85698     0  3        0x10  0x4000080 fsleep    syz-executor
 98584  165104   9292     0  2           0          0           syz-executor
 98584  175222   9292     0  3           0  0x4000080 fsleep    syz-executor
  6172  175304  29286     0  2    0x100002          0           sh
  3242  250946  87484     0  2           0          0           syz-executor
  3242  418128  87484     0  3           0  0x4000080 fsleep    syz-executor
 81018  372656  15283     0  2           0          0           syz-executor
 81018   24121  15283     0  3           0  0x4000080 fsleep    syz-executor
 81018   89523  15283     0  3           0  0x4000080 fsleep    syz-executor
 86782  182825  58384     0  2           0          0           syz-executor
 86782  401774  58384     0  7           0  0x4000000           syz-executor
 86782  452433  58384     0  3           0  0x4000080 fsleep    syz-executor
 29286   97556  36635     0  3         0x2       0x80 wait      syz-executor
  9292  162178  36635     0  2         0x2      0xc80           syz-executor
 87484   43844  36635     0  2         0x2      0xc80           syz-executor
 85698  192757  36635     0  2         0x2      0xc80           syz-executor
 15283  500773  36635     0  2         0x2      0xc80           syz-executor
 72535   61752  36635     0  2         0x2          0           syz-executor
 58384  361307  36635     0  2         0x2      0xc80           syz-executor
 14148  261889  36635     0  2         0x2      0xc80           syz-executor
 36635  427483  91934     0  3         0x2       0x80 kqread    syz-executor
 91934  115337  20619     0  3    0x100002       0x88 sigsusp   ksh
 20619  395988  95123     0  3        0x10       0x88 kqread    sshd-session
 95123   72859  75095     0  3        0x12       0x80 kqread    sshd-session
 25448  136138      1     0  2    0x100003       0x80           getty
 75095  396558      1     0  3           0       0x88 kqread    sshd
 97614  378325  26719    74  3   0x1100012       0x80 bpf       pflogd
 26719  519794      1     0  3           0       0x80 sbwait    pflogd
 56611  488601  62412    73  2   0x1100010       0x80           syslogd
 62412  365198      1     0  3    0x100002       0x80 sbwait    syslogd
 68723  298438      1     0  3    0x100000       0x80 kqread    resolvd
 19357   78733  17193    77  3    0x100012       0x80 kqread    dhcpleased
 54375  494257  17193    77  3    0x100012       0x80 kqread    dhcpleased
 17193  136596      1     0  3           0       0x80 kqread    dhcpleased
 46175  114326      0     0  2     0x14000 0x40000200           smr
 62464  129707      0     0  2     0x14000      0x200           zerothread
 23025  513279      0     0  3     0x14000      0x200 aiodoned  aiodoned
 28451  450300      0     0  3     0x14000      0x200 syncer    update
 35194   17000      0     0  3     0x14000      0x200 cleaner   cleaner
 95722  467707      0     0  3     0x14000      0x200 reaper    reaper
 21141  203990      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
  7232  159947      0     0  3     0x14000      0x200 bored     viomb
  8562  426543      0     0  3     0x14000 0x40000200 acpi0     acpi0
 32611  469309      0     0  3     0x14000 0x40000200           idle1
 91693  329867      0     0  3     0x14000      0x200 bored     softnet1
 82470  441683      0     0  2     0x14000      0x200           softnet0
 32652  296289      0     0  3     0x14000      0x200 bored     systqmp
 88177  485424      0     0  3     0x14000      0x200 bored     systq
 63792  181519      0     0  2     0x14000      0x200           softclockmp
 70918  365472      0     0  3     0x14000 0x40000200 tmoslp    softclock
 83746  149897      0     0  3     0x14000 0x40000200           idle0
     1  183110      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
CPU 1:
exclusive mutex amappl16 r = 0 (0xffffffff854aa1c8)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x683 sys/kern/kern_lock.c:487
#2  pool_get+0x1de sys/kern/subr_pool.c:693
#3  amap_alloc1+0x1b6 sys/uvm/uvm_amap.c:-1
#4  amap_alloc+0x9f sys/uvm/uvm_amap.c:414
#5  amap_copy+0x9fa sys/uvm/uvm_amap.c:567
#6  uvm_fault_check+0x776 sys/uvm/uvm_fault.c:747
#7  uvm_fault+0x1e7 sys/uvm/uvm_fault.c:627
#8  kpageflttrap+0x41e sys/arch/amd64/amd64/trap.c:283
#9  kerntrap+0x1b6 sys/arch/amd64/amd64/trap.c:528
#10 alltraps_kern_meltdown+0x7b
#11 _copyin+0x50
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#13 Xsyscall+0x128
Process 72273 (syz-executor) thread 0xffff80003a707780 (438649)
exclusive rrwlock inode r = 0 (0xffff800001d23a38)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0xda sys/ufs/ufs/ufs_ihash.c:146
#5  ffs_vget+0x2e9 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x576 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_makeinode+0x1a1 sys/ufs/ufs/ufs_vnops.c:1759
#8  ufs_create+0xcf sys/ufs/ufs/ufs_vnops.c:147
#9  VOP_CREATE+0x1a2 sys/kern/vfs_vops.c:103
#10 vn_open+0x6d9 sys/kern/vfs_vnops.c:118
#11 doopenat+0x460 sys/kern/vfs_syscalls.c:1163
#12 sys_open+0x86 sys/kern/vfs_syscalls.c:1065
#13 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff800001d230f8)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4  vn_lock+0xca sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x1f7 sys/kern/vfs_lookup.c:431
#6  namei+0xe19 sys/kern/vfs_lookup.c:250
#7  vn_open+0x319 sys/kern/vfs_vnops.c:109
#8  doopenat+0x460 sys/kern/vfs_syscalls.c:1163
#9  sys_open+0x86 sys/kern/vfs_syscalls.c:1065
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
Process 72273 (syz-executor) thread 0xffff80003a706a88 (109030)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff85d77a80)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  sysctl_vslock+0x72 sys/kern/kern_sysctl.c:197
#2  sys_sysctl+0x460 sys/kern/kern_sysctl.c:304
#3  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#4  Xsyscall+0x128
exclusive rwlock sysctllk r = 0 (0xffffffff8530cc58)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  sysctl_vslock+0x37 sys/kern/kern_sysctl.c:192
#3  sys_sysctl+0x460 sys/kern/kern_sysctl.c:304
#4  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#5  Xsyscall+0x128
Process 86782 (syz-executor) thread 0xffff800045ffd770 (401774)
exclusive rwlock vmmaplk r = 0 (0xffff800001c8b4f0)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413
#2  uvmfault_lookup+0x1a2 sys/uvm/uvm_fault.c:-1
#3  uvm_fault_check+0x43 sys/uvm/uvm_fault.c:693
#4  uvm_fault+0x1e7 sys/uvm/uvm_fault.c:627
#5  kpageflttrap+0x41e sys/arch/amd64/amd64/trap.c:283
#6  kerntrap+0x1b6 sys/arch/amd64/amd64/trap.c:528
#7  alltraps_kern_meltdown+0x7b
#8  _copyin+0x50
#9  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#10 Xsyscall+0x128
Process 72535 (syz-executor) thread 0xffff800029912010 (61752)
exclusive rrwlock inode r = 0 (0xffff800001d23470)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0xda sys/ufs/ufs/ufs_ihash.c:146
#5  ffs_vget+0x2e9 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x576 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0x25d sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x1a8 sys/kern/vfs_vops.c:394
#9  domkdirat+0x1f9 sys/kern/vfs_syscalls.c:3063
#10 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffff800001b9ab48)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xf0 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0x17e sys/kern/vfs_vops.c:527
#4  vn_lock+0xca sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x1f7 sys/kern/vfs_lookup.c:431
#6  namei+0xe19 sys/kern/vfs_lookup.c:250
#7  domkdirat+0xe1 sys/kern/vfs_syscalls.c:3048
#8  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11062  12456K   12461K 166960K     12214        0
            pcb    17     26K      28K 166960K        72        0
         rtable   181      9K      13K 166960K       365        0
             pf    30     21K      23K 166960K        50        0
         ifaddr    33      9K      12K 166960K        48        0
        ifgroup    47      2K       2K 166960K        61        0
         sysctl     4      1K      13K 166960K         8        0
       counters    66     41K      43K 166960K        74        0
       ioctlops     0      0K       4K 166960K      1497        0
            iov     0      0K      12K 166960K         6        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1296     83K      84K 166960K      1424        0
      UFS quota     1     36K      36K 166960K         1        0
      UFS mount     5     44K      44K 166960K         5        0
            shm     2      2K       6K 166960K         3        0
         VM map     2      1K       1K 166960K         2        0
            sem     9      0K       0K 166960K        10        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     292K 166960K     11964        0
      file desc    17     61K      97K 166960K       221        0
           proc    72    128K     193K 166960K       583        0
        subproc    72      9K       9K 166960K        81        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     20K      20K 166960K         1        0
       in_multi    67      5K       7K 166960K       100        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         3        0
    ISOFS mount     1     36K      36K 166960K         1        0
  MSDOSFS mount     1     20K      20K 166960K         1        0
           ttys    43    303K     303K 166960K        43        0
           exec     0      0K       2K 166960K       394        0
   fusefs mount     1     36K      36K 166960K         1        0
            tdb     3      1K       1K 166960K         3        0
        VM swap    14    124K     124K 166960K        15        0
       UVM amap   230    247K     270K 166960K      3836        0
       UVM aobj     8      4K       4K 166960K         8        0
     pinsyscall  1066   1750K    1751K 166960K      1396        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    10      0K       2K 166960K        30        0
           temp    38   9170K    9179K 166960K      4178        0
         kqueue    15     45K      52K 166960K        40        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       34    0       31     1     0     1     1     0     8    0
rtentry    176      116    0       34     6     0     6     6     0     8    1
unpcb      144      113    0       94     2     0     2     2     0     8    1
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      736       16    0       11     1     0     1     1     0     8    0
arp        136       20    0        6     1     0     1     1     0     8    0
inpcb      328      142    0      133     4     0     4     4     0     8    2
nd6        152       25    0        9     1     0     1     1     0     8    0
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1192       1    0        1     1     0     1     1     0     8    1
pffrent     40        1    0        1     1     0     1     1     0     8    1
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       19    0        0     1     0     1     1     0     8    0
pfstkey    128       19    0        0     1     0     1     1     0     8    0
pfstate    448       19    0        0     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      458    0      132    29     0    29    29     0     8    4
art_table   40      459    0      132     5     0     5     5     0     8    0
art_node    32      116    0       41     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        1     1     0     1     1     0     8    1
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl      72        7    0        0     1     0     1     1     0     8    0
shmpl      112        5    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1689    0      221    93     0    93    93     0     8    0
ffsino     296     1690    0      221   114     0   114   114     0     8    0
nchpl      144     2002    0      298    64     0    64    64     0     8    0
vnodes     216     1824    0        0   102     0   102   102     0     8    0
namei      1024    6212    0     6210     2     0     2     2     0     8    1
percpumem   16       53    0        4     1     0     1     1     0     8    0
kstatmem   264       31    0        8     2     0     2     2     0     8    0
scxspl     216     7163    0     7163     4     3     1     3     1     8    1
plimitpl   152       35    0       18     1     0     1     1     0     8    0
sigapl     424      537    0      489     7     0     7     7     0     8    1
knotepl    120      144    0        0     5     0     5     5     0     8    0
kqueuepl   224       49    0       37     1     0     1     1     0     8    0
pipepl     344      206    0      178     9     0     9     9     0     8    6
fdescpl    528      520    0      489     3     0     3     3     0     8    0
filepl     160     2162    0     1944    15     0    15    15     0     8    4
lockfpl    104       36    0       34     1     0     1     1     0     8    0
lockfspl    48       19    0       17     1     0     1     1     0     8    0
sessionpl  144       29    0       20     1     0     1     1     0     8    0
pgrppl      48       40    0       23     1     0     1     1     0     8    0
ucredpl    104      165    0      150     1     0     1     1     0     8    0
zombiepl   144      489    0      489     1     0     1     1     0     8    1
processpl  1232     537    0      489     5     0     5     5     0     8    1
procpl     664      673    0      615     6     0     6     6     0     8    1
sockpl     752      291    0      260     7     0     7     7     0     8    3
mcl64k     65536      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       1    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k      2048      31    0        0     4     0     4     4     0     8    0
mextrefs    64       26    0        0     1     0     1     1     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      186    0        0    12     0    12    12     0     8    0
bufpl      272     2404    0      106   154     0   154   154     0     8    0
anonpl      32     5462    0        0    44     0    44    44     0   222    0
amapchunkpl 152   10775    0    10249    22     0    22    22     0   158    1
amappl16   200     1993    0     1901     8     3     5     5     0     8    0
amappl15   192       12    0       11     2     1     1     1     0     8    0
amappl14   184      438    0      435     1     0     1     1     0     8    0
amappl13   176      140    0      128     1     0     1     1     0     8    0
amappl12   168      771    0      741     2     0     2     2     0     8    0
amappl11   160       24    0       24     2     1     1     1     0     8    1
amappl10   152       71    0       57     1     0     1     1     0     8    0
amappl9    144      286    0      286     1     1     0     1     0     8    0
amappl8    136      102    0      100     1     0     1     1     0     8    0
amappl7    128      151    0      138     1     0     1     1     0     8    0
amappl6    120      165    0      163     1     0     1     1     0     8    0
amappl5    112      107    0       97     1     0     1     1     0     8    0
amappl4    104      308    0      287     1     0     1     1     0     8    0
amappl3     96     1987    0     1878     4     0     4     4     0     8    1
amappl2     88      548    0      487     2     0     2     2     0     8    0
amappl1     80    10807    0    10205    16     1    15    15     0     8    2
amappl      88     3095    0     2936     4     0     4     4     0    92    0
uvmvnodes   80       99    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        7    0        0     1     0     1     1     0     8    0
uaddrrnd    24      520    0      489     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      520    0      489     1     0     1     1     0     8    0
vmmpekpl   168     6610    0     6576     3     0     3     3     0     8    0
vmmpepl    168    42550    0    40608    86     0    86    86     0   357    1
vmsppl     488      519    0      489     5     0     5     5     0     8    0
rwobjpl     80    15685    0    14580    25     0    25    25     0     8    1
pdppl      4096    1049    0      978   101    26    75    89     0     8    4
pvpl        32    12178    0        0   100     1    99    99     0   265    0
pmappl     256      519    0      489     3     0     3     3     0     8    0
extentpl    40       47    0       29     1     0     1     1     0     8    0
phpool     120      429    0       29    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
witness_checkorder(ffffffff85222690,9,0) at witness_checkorder+0x19c sys/kern/subr_witness.c:783
mtx_enter(ffffffff85222680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffffffff85222680,ffff8000337585e0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffffffff8546b440,17b88) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffffffff8546b0e0,f0,ffffffff8123d4c0,0,0,ffff8000337587c0) at fork1+0x1225 sys/kern/kern_fork.c:511
kthread_create(ffffffff8123d4c0,0,0,ffffffff8468ab60) at kthread_create+0xa8 sys/kern/kern_kthread.c:61
nfs_getset_niothreads(1) at nfs_getset_niothreads+0xe7 sys/nfs/nfs_syscalls.c:702
nfs_sysctl(ffff8000337589c8,1,0,ffff8000337589a0,200000000180,0,ffff800033758c10) at nfs_sysctl+0x102 sys/nfs/nfs_vfsops.c:891
sys_sysctl(ffff80003a706a88,ffff800033758c10,ffff800033758b80) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff800033758c10) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800033758c10) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8810e4cf30, count: -12
ddb{0}> machine ddbcpu 1
nd of kernel
endS trace frame: 0xf8810e4cf30, cotunt: 245
End ofo stack trace.
pped at      x86_ipi_db+0x19:        leave
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
kasan_shadow_4byte_isvalid(ffffffff85450a5c) at kasan_shadow_4byte_isvalid+0x1 sys/kern/kasan_shadow.h:119
witness_lock_stack_free(fffffd8007d14360) at witness_lock_stack_free+0xb8 sys/kern/subr_witness.c:1856
witness_unlock(ffffffff854aa1c8,8) at witness_unlock+0x510 sys/kern/subr_witness.c:1326
mtx_leave(ffffffff854aa1b8) at mtx_leave+0xb3 sys/kern/kern_lock.c:503
pool_get(ffffffff854aa1b0,a) at pool_get+0x313 sys/kern/subr_pool.c:702
amap_alloc1(10,2,0) at amap_alloc1+0x1b6 sys/uvm/uvm_amap.c:-1
amap_alloc(10000,2,0) at amap_alloc+0x9f sys/uvm/uvm_amap.c:414
amap_copy(ffff800001c8b3f0,ffff800001ccf800,2,1,200000440000,200000440001) at amap_copy+0x9fa sys/uvm/uvm_amap.c:567
uvm_fault_check(ffff800033983e20,ffff800033983dc8,ffff800033983db8,0) at uvm_fault_check+0x776 sys/uvm/uvm_fault.c:747
uvm_fault(ffff800001c8b3f0,200000440000,0,1) at uvm_fault+0x1e7 sys/uvm/uvm_fault.c:627
kpageflttrap(ffff800033984100,200000440000) at kpageflttrap+0x41e sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff800033984100) at kerntrap+0x1b6 sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x50
syscall(ffff800033984700) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800033984700) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x9775327b300, count: -19

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/27 07:46 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 5ba6d07861fc 492bab15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: lock_object uninitialized: ADDR
2026/07/26 20:53 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 5ba6d07861fc 492bab15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: lock_object uninitialized: ADDR
2026/07/26 06:32 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 5ba6d07861fc 492bab15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: lock_object uninitialized: ADDR
2026/07/24 08:53 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 7c61c2d2eaf2 544adce9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: lock_object uninitialized: ADDR
* Struck through repros no longer work on HEAD.