syzbot


pool: free list modified: pvpl (2)

Status: upstream: reported on 2025/10/22 09:18
Reported-by: syzbot+81751b013a0cca45b174@syzkaller.appspotmail.com
First crash: 4d19h, last: 4d19h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: pvpl -1 17 1912d 2167d 0/3 auto-closed as invalid on 2020/10/30 14:39

Sample crash report:
panic: pool_do_get: pvpl free list modified: page 0xfffffd806734d000; item addr 0xfffffd806734df00; offset 0x0=0xffffffff83888000 != 0x2c0aa41eab05b81d
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*430541  94738      0           0  0x4000000    0  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8338d4a6) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff8394d5a0,2,ffff80002a882548) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff8394d5a0,2) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_enter(fffffd8070e03880,200000b98000,63445000,3,22) at pmap_enter+0x1dc sys/arch/amd64/amd64/pmap.c:-1
uvm_fault_lower(ffff80002a882860,ffff80002a882898,ffff80002a8827e0) at uvm_fault_lower+0x7d6 sys/uvm/uvm_fault.c:1520
uvm_fault(fffffd806ec0de68,200000b98000,0,2) at uvm_fault+0x241 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a882a00,200000b98000) at kpageflttrap+0x2d1 sys/arch/amd64/amd64/trap.c:-1
kerntrap(ffff80002a882a00) at kerntrap+0x186 sys/arch/amd64/amd64/trap.c:491
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x64
mmrw(20c,ffff80002a882eb0,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a882c90) at spec_read+0x142 sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e5c1b38,ffff80002a882eb0,0,fffffd8007bfb8f0) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
end trace frame: 0xffff80002a882d80, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: pool_do_get: pvpl free list modified: page 0xfffffd806734d000; item addr 0xfffffd806734df00; offset 0x0=0xffffffff83888000 != 0x2c0aa41eab05b81d
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8338d4a6) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff8394d5a0,2,ffff80002a882548) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff8394d5a0,2) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_enter(fffffd8070e03880,200000b98000,63445000,3,22) at pmap_enter+0x1dc sys/arch/amd64/amd64/pmap.c:-1
uvm_fault_lower(ffff80002a882860,ffff80002a882898,ffff80002a8827e0) at uvm_fault_lower+0x7d6 sys/uvm/uvm_fault.c:1520
uvm_fault(fffffd806ec0de68,200000b98000,0,2) at uvm_fault+0x241 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a882a00,200000b98000) at kpageflttrap+0x2d1 sys/arch/amd64/amd64/trap.c:-1
kerntrap(ffff80002a882a00) at kerntrap+0x186 sys/arch/amd64/amd64/trap.c:491
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x64
mmrw(20c,ffff80002a882eb0,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a882c90) at spec_read+0x142 sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e5c1b38,ffff80002a882eb0,0,fffffd8007bfb8f0) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c23c780,ffff80002a882eb0,1) at vn_read+0x16d sys/kern/vfs_vnops.c:369
dofilereadv(ffff80002a86d500,3,ffff80002a882eb0,1,ffff80002a882f60) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80002a86d500,ffff80002a883010,ffff80002a882f60) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3336
syscall(ffff80002a883010) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a883010) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x455ba7aa8a0, count: -19
ddb> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a8823b0
rbx               0xfffffd806734df00
rdx               0xffff800001468ac0
rcx                                0
rax               0xffff80002a86d500
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x33ce7bec163c4be5
r11               0xc7f6275ee194f6a0
r12                                0
r13               0x18d10b251841312e
r14                                0
r15                              0x1
rip               0xffffffff819ff715    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a8823a0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb> show proc
PROC (syz-executor) tid=430541 pid=94738 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=80, usrpri=81, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a86c808,0xffff80002a787ca0
    process=0xffff80003c9e16a0 user=0xffff80002a87e000, vmspace=0xfffffd806ec0de68
    estcpu=31, cpticks=4, pctcpu=0.0, user=0, sys=4, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 98159  184415  69813      0  2           0                syz-executor
 98159  353492  69813      0  3   0x4000080  fsleep        syz-executor
 39971   25860  62731      0  2           0                syz-executor
 39971  380408  62731      0  3   0x4000080  fsleep        syz-executor
 86924  358309  21877      0  2           0                syz-executor
 86924  381641  21877      0  3   0x4000080  fsleep        syz-executor
 86924  483536  21877      0  3   0x4000080  fsleep        syz-executor
 45143  175007  67714      0  2           0                syz-executor
 45143  479067  67714      0  3   0x4000080  fsleep        syz-executor
 45143  250963  67714      0  2   0x4000000                syz-executor
 76922  158815  61064      0  2           0                syz-executor
 76922   33074  61064      0  3   0x4000080  fsleep        syz-executor
 76922  402412  61064      0  3   0x4000080  fsleep        syz-executor
 76922  100014  61064      0  3   0x4000080  fsleep        syz-executor
 94738  456427  76565      0  2           0                syz-executor
*94738  430541  76565      0  7   0x4000000                syz-executor
 54216  258790  35066      0  2           0                syz-executor
 54216  299659  35066      0  3   0x4000080  kqread        syz-executor
 54216   61271  35066      0  3   0x4000080  fsleep        syz-executor
 54216   34166  35066      0  3   0x4000080  fsleep        syz-executor
 90661   10395  50306      0  2           0                syz-executor
 90661  429964  50306      0  3   0x4000080  kqpoll        syz-executor
 90661  133875  50306      0  3   0x4000080  fsleep        syz-executor
  6233   93631      1      0  3    0x100083  ttyopn        getty
 21877  265745  81843      0  3        0x82  nanoslp       syz-executor
 69813  514529  81843      0  3        0x82  nanoslp       syz-executor
 67714  425755  81843      0  3        0x82  nanoslp       syz-executor
 32290  130042      0      0  3     0x14280  nfsidl        nfsio
  1252  433616      0      0  3     0x14280  nfsidl        nfsio
 49379  214667      0      0  3     0x14280  nfsidl        nfsio
 16518  501782      0      0  3     0x14280  nfsidl        nfsio
 67449  184602      0      0  3     0x14280  nfsidl        nfsio
 70178   43437      0      0  3     0x14280  nfsidl        nfsio
 39203  147645      0      0  3     0x14280  nfsidl        nfsio
 87826  450572      0      0  3     0x14280  nfsidl        nfsio
 31108  222509      0      0  3     0x14280  nfsidl        nfsio
 94155  446701      0      0  3     0x14280  nfsidl        nfsio
 15682  101558      0      0  3     0x14280  nfsidl        nfsio
 92556   47275      0      0  3     0x14280  nfsidl        nfsio
 68839  347522      0      0  3     0x14280  nfsidl        nfsio
 28541  405211      0      0  3     0x14280  nfsidl        nfsio
 96844  274509      0      0  3     0x14280  nfsidl        nfsio
 86085  360043      0      0  3     0x14280  nfsidl        nfsio
 28197  393394      0      0  3     0x14280  nfsidl        nfsio
 63373   16023      0      0  3     0x14280  nfsidl        nfsio
 93365  431905      0      0  3     0x14280  nfsidl        nfsio
 76983  513077      0      0  3     0x14280  nfsidl        nfsio
 76565  359366  81843      0  3        0x82  nanoslp       syz-executor
 61064  215034  81843      0  3        0x82  nanoslp       syz-executor
 35066  301941  81843      0  3        0x82  nanoslp       syz-executor
 17039  314217      0      0  3     0x14200  bored         sosplice
 50306   91299  81843      0  3        0x82  nanoslp       syz-executor
 62731  251168  81843      0  3        0x82  nanoslp       syz-executor
 81843  188743   7070      0  3        0x82  kqread        syz-executor
  7070  508172  51394      0  3    0x10008a  sigsusp       ksh
 51394  304562  69984      0  3        0x98  kqread        sshd-session
 69984  189661  38042      0  3        0x92  kqread        sshd-session
 38042  212577      1      0  3        0x88  kqread        sshd
 93408  301770  30838     73  3   0x1100090  kqread        syslogd
 30838  510435      1      0  3    0x100082  sbwait        syslogd
 32761  500832      1      0  3    0x100080  kqread        resolvd
 30139  433321  39067     77  3    0x100092  kqread        dhcpleased
 28331  345886  39067     77  3    0x100092  kqread        dhcpleased
 39067  456156      1      0  3        0x80  kqread        dhcpleased
 75007  300855      0      0  3     0x14200  bored         smr
  2821   10253      0      0  2     0x14200                zerothread
 75877  432092      0      0  3     0x14200  aiodoned      aiodoned
 49427  330266      0      0  3     0x14200  syncer        update
 80181  467071      0      0  3     0x14200  cleaner       cleaner
  2152    5629      0      0  3     0x14200  reaper        reaper
 87543   42053      0      0  3     0x14200  pgdaemon      pagedaemon
 41297  510293      0      0  3     0x14200  bored         viomb
 74312  123424      0      0  3  0x40014200  acpi0         acpi0
 87884   28596      0      0  3     0x14200  bored         softnet0
 41331  393894      0      0  3     0x14200  smrbar        systqmp
 44140  309873      0      0  3     0x14200  bored         systq
 53238   55365      0      0  3  0x40014200  tmoslp        softclock
 92047  155963      0      0  3  0x40014200                idle0
     1  279861      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10202  11142K   11693K 166960K     14533        0
            pcb    17     20K      22K 166960K       427        0
         rtable   251     13K      14K 166960K       891        0
             pf    37     14K   67481K 166960K       293        0
         ifaddr    42      8K       8K 166960K       161        0
        ifgroup    58      2K       2K 166960K       276        0
         sysctl     4      1K       9K 166960K        87        0
       counters    34     18K      18K 166960K       142        0
       ioctlops     0      0K       4K 166960K       608        0
            iov     1      2K      17K 166960K       297        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1472     92K      93K 166960K      3259        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        23        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K        52        0
        dirhash    12      2K       2K 166960K        45        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     240K 166960K      2042        0
          sigio     0      0K       0K 166960K        39        0
           proc    60     59K     116K 166960K       895        0
        subproc    72      4K       4K 166960K       136        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       496        0
       in_multi    86      6K       7K 166960K       297        0
    ether_multi     1      0K       0K 166960K        52        0
            mrt     2      0K       0K 166960K         9        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   109    493K     493K 166960K       109        0
           exec     0      0K       1K 166960K       713        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         4        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   250    151K     177K 166960K     19546        0
       UVM aobj    87     11K      11K 166960K        91        0
     pinsyscall    39     78K      96K 166960K      3291        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       178        0
            NDP    13      0K       2K 166960K       113        0
           temp    77   8650K    8776K 166960K     65549        0
         kqueue    16     24K      31K 166960K       406        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      164    0      161     1     0     1     1     0     8    0
rtentry    136      223    0      133     4     0     4     4     0     8    0
unpcb      144     1541    0     1524    10     8     2     6     0     8    1
syncache   336        7    0        7     1     1     0     1     0     8    0
tcpqe       32        1    0        1     1     1     0     1     0     8    0
tcpcb      736      905    0      897    26    22     4    13     0     8    3
arp         96       39    0       20     1     0     1     1     0     8    0
ipq         40        5    0        5     1     0     1     1     0     8    1
ipqe        40        7    0        7     1     0     1     1     0     8    1
inpcb      328     2363    0     2351    22    18     4    12     0     8    2
ip6q        72        7    0        7     3     2     1     1     0     8    1
ip6af       40       13    0       13     3     2     1     1     0     8    1
nd6        112       50    0       27     1     0     1     1     0     8    0
pkpcb       40       13    0       13     3     2     1     1     0     8    1
kcovpl      48       15    0        7     1     0     1     1     0     8    0
ppxss      1072      78    0       78     4     3     1     1     0     8    1
pppxif     1384       8    0        8     2     1     1     1     0     8    1
pfstscr     40        1    0        0     1     0     1     1     0     8    0
pfrktable  1344       2    0        2     2     2     0     1     0     8    0
pfanchor   1288       2    0        2     1     1     0     1     0     8    0
pfstitem    24        5    0        0     1     0     1     1     0     8    0
pfstkey    128       71    0       67     1     0     1     1     0     8    0
pfstate    384       36    0       33     1     0     1     1     0     8    0
pfrule     1344       6    0        6     2     2     0     1     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      980    0      574    36    10    26    31     0     8    0
art_table   40      982    0      574     5     0     5     5     0     8    0
art_node    32      223    0      144     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        1     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       49    0       39     1     0     1     1     0     8    0
shmpl      112       88    0        4     3     0     3     3     0     8    0
dirhash    1024      39    0       22     3     0     3     3     0     8    0
dino2pl    256     5028    0     3513    96     0    96    96     0     8    0
ffsino     256     5028    0     3513    96     0    96    96     0     8    0
nchpl      144     7733    0     6017    65     0    65    65     0     8    0
rtmask      32       22    0       22     3     3     0     1     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   26889    0    26889     5     4     1     2     0     8    1
kstatmem   264      164    0      138     3     0     3     3     0     8    1
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72       11    0       11     4     3     1     1     0     8    1
scxspl     216    24496    0    24496    15    14     1     8     1     8    1
plimitpl   152      555    0      538     1     0     1     1     0     8    0
sigapl     424     2321    0     2257     8     0     8     8     0     8    0
knotepl    120    99587    0    99537    42    32    10    17     0     8    6
kqueuepl   184      797    0      783     4     3     1     4     0     8    0
pipepl     304      383    0      355     5     2     3     5     0     8    0
fdescpl    448     2281    0     2251     5     1     4     5     0     8    0
filepl     120    15324    0    15109    18     7    11    14     0     8    2
lockfpl    104      922    0      920     3     1     2     2     0     8    1
lockfspl    48      331    0      329     1     0     1     1     0     8    0
sessionpl  144       33    0       25     1     0     1     1     0     8    0
pgrppl      48       75    0       59     1     0     1     1     0     8    0
ucredpl    104     2526    0     2515     1     0     1     1     0     8    0
zombiepl   144     3086    0     3086     1     0     1     1     0     8    1
processpl  1152    2321    0     2257     5     0     5     5     0     8    0
procpl     664     5363    0     5284     9     1     8     8     0     8    0
sosppl     168        5    0        5     3     2     1     1     0     8    1
sockpl     552     4168    0     4136    26    21     5    13     0     8    2
mcl64k     65536    486    0      486     2     1     1     1     0     8    1
mcl16k     16384     67    0       67     2     1     1     1     0     8    1
mcl12k     12288      2    0        2     2     2     0     1     0     8    0
mcl8k      8192      19    0       19     4     3     1     1     0     8    1
mcl4k      4096    5075    0     5023    16     8     8    14     0     8    1
mcl2k2     2112      24    0       24     3     2     1     2     0     8    1
mcl2k      2048    2941    0     2939     6     5     1     5     0     8    0
mtagpl      96       22    0       17     1     0     1     1     0     8    0
mbufpl     256    27147    0    27019    80    65    15    70     0     8    4
bufpl      280     7820    0     1598   445     0   445   445     0     8    0
anonpl      24   325456    0   318704   125    57    68    68     0   187   27
amapchunkpl 152   68407    0    67782    66    34    32    39     0   158    7
amappl16   200     6164    0     6009    55    40    15    27     0     8    6
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184       17    0       17     1     1     0     1     0     8    0
amappl13   176      487    0      486     1     0     1     1     0     8    0
amappl12   168     2672    0     2633     3     1     2     3     0     8    0
amappl11   160        9    0        9     1     1     0     1     0     8    0
amappl10   152       42    0       32     1     0     1     1     0     8    0
amappl9    144      252    0      252     1     1     0     1     0     8    0
amappl8    136       27    0       25     1     0     1     1     0     8    0
amappl7    128      105    0      104     1     0     1     1     0     8    0
amappl6    120      363    0      350     1     0     1     1     0     8    0
amappl5    112       82    0       74     1     0     1     1     0     8    0
amappl4    104      430    0      407     1     0     1     1     0     8    0
amappl3     96    12092    0    11990     3     0     3     3     0     8    0
amappl2     88     2397    0     2324     2     0     2     2     0     8    0
amappl1     80    17666    0    17123    14     0    14    14     0     8    1
amappl      88    18419    0    18236     6     1     5     5     0    92    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
dma32768   32768      1    0        1     1     1     0     1     0     8    0
dma8192    8192       3    0        3     2     2     0     1     0     8    0
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma2048    2048       2    0        2     1     1     0     1     0     8    0
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma512     512        1    0        1     1     0     1     1     0     8    1
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      256    0      256     3     2     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       21    0       20     1     0     1     1     0     8    0
aobjpl      72       90    0        4     2     0     2     2     0     8    0
uaddrrnd    24     2281    0     2251     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2281    0     2251     1     0     1     1     0     8    0
vmmpekpl   168    17472    0    17412     3     0     3     3     0     8    0
vmmpepl    168   147307    0   145312   118    10   108   108     0   357   15
vmsppl     368     2280    0     2251     4     1     3     4     0     8    0
rwobjpl     40    44334    0    37321    71     0    71    71     0     8    0
pdppl      4096    4568    0     4502   136    70    66    80     0     8    0
pvpl        32   944177    0   931665   250   108   142   142     0   265   41
pvpl: pool(0xffffffff8394d5a0:pvpl): free list modified: page 0xfffffd806734d000; item ordinal 0; addr 0xfffffd806734df00 (p 0xfffffd806734d000); offset 0x0=0xffffffff83888000
pmappl     216     2280    0     2251     3     1     2     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      529    0      199    12     0    12    12     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8338d4a6) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff8394d5a0,2,ffff80002a882548) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff8394d5a0,2) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_enter(fffffd8070e03880,200000b98000,63445000,3,22) at pmap_enter+0x1dc sys/arch/amd64/amd64/pmap.c:-1
uvm_fault_lower(ffff80002a882860,ffff80002a882898,ffff80002a8827e0) at uvm_fault_lower+0x7d6 sys/uvm/uvm_fault.c:1520
uvm_fault(fffffd806ec0de68,200000b98000,0,2) at uvm_fault+0x241 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a882a00,200000b98000) at kpageflttrap+0x2d1 sys/arch/amd64/amd64/trap.c:-1
kerntrap(ffff80002a882a00) at kerntrap+0x186 sys/arch/amd64/amd64/trap.c:491
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x64
mmrw(20c,ffff80002a882eb0,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a882c90) at spec_read+0x142 sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e5c1b38,ffff80002a882eb0,0,fffffd8007bfb8f0) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c23c780,ffff80002a882eb0,1) at vn_read+0x16d sys/kern/vfs_vnops.c:369
dofilereadv(ffff80002a86d500,3,ffff80002a882eb0,1,ffff80002a882f60) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80002a86d500,ffff80002a883010,ffff80002a882f60) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3336
syscall(ffff80002a883010) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a883010) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x455ba7aa8a0, count: -19
ddb> machine ddbcpu 1
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff8338d4a6) at panic+0x1cf sys/kern/subr_prf.c:198
pool_do_get(ffffffff8394d5a0,2,ffff80002a882548) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff8394d5a0,2) at pool_get+0x11a sys/kern/subr_pool.c:-1
pmap_enter(fffffd8070e03880,200000b98000,63445000,3,22) at pmap_enter+0x1dc sys/arch/amd64/amd64/pmap.c:-1
uvm_fault_lower(ffff80002a882860,ffff80002a882898,ffff80002a8827e0) at uvm_fault_lower+0x7d6 sys/uvm/uvm_fault.c:1520
uvm_fault(fffffd806ec0de68,200000b98000,0,2) at uvm_fault+0x241 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a882a00,200000b98000) at kpageflttrap+0x2d1 sys/arch/amd64/amd64/trap.c:-1
kerntrap(ffff80002a882a00) at kerntrap+0x186 sys/arch/amd64/amd64/trap.c:491
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x64
mmrw(20c,ffff80002a882eb0,0) at mmrw+0x3d6 sys/arch/amd64/amd64/mem.c:-1
spec_read(ffff80002a882c90) at spec_read+0x142 sys/kern/spec_vnops.c:215
VOP_READ(fffffd806e5c1b38,ffff80002a882eb0,0,fffffd8007bfb8f0) at VOP_READ+0x101 sys/kern/vfs_vops.c:227
vn_read(fffffd806c23c780,ffff80002a882eb0,1) at vn_read+0x16d sys/kern/vfs_vnops.c:369
dofilereadv(ffff80002a86d500,3,ffff80002a882eb0,1,ffff80002a882f60) at dofilereadv+0x25a sys/kern/sys_generic.c:252
sys_preadv(ffff80002a86d500,ffff80002a883010,ffff80002a882f60) at sys_preadv+0xe3 sys/kern/vfs_syscalls.c:3336
syscall(ffff80002a883010) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a883010) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x455ba7aa8a0, count: -19

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/22 09:18 openbsd ebf1dab469cf 252fbbad .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main pool: free list modified: pvpl
* Struck through repros no longer work on HEAD.