syzbot


panic: kernel diagnostic assertion "refs != ~NUM" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch

Status: upstream: reported on 2025/06/28 11:44
Reported-by: syzbot+8177044eb68ca7e854f1@syzkaller.appspotmail.com
First crash: 19d, last: 19d

Sample crash report:
Wpanic: AkeRrnNeIlN dGi: agSPnosL tNiOc aTs sLeOrtWEiRoEn D "reOfNs  S!Y=S C~0AL"L  f7a4i le-1d8:1 fil7e2 14"/97s6y zEkaXlIlTe r/m0a naa
geStopped at        savectx+0xae:   movl    $0,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 16616   3070      0           0          0    0  syz-executor
savectx() at savectx+0xae
end of kernel
end trace frame: 0x763b7a5a6ff0, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu1: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 951
ddb{0}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x763b7a5a6ff0, count: -1
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff800037bee470
rbx                                0
rdx                                0
rcx               0xffff8000ffff1c50
rax                             0x3c
r8                0xffff800037bee3a0
r9                                 0
r10               0xa39d15e0f776f4e8
r11               0xb511e88e526526a2
r12                                0
r13                                0
r14               0xffff8000ffff1c50
r15                                0
rip               0xffffffff824d03ee    savectx+0xae
cs                               0x8
rflags                          0x46
rsp               0xffff800037bee3f0
ss                              0x10
savectx+0xae:   movl    $0,%gs:0x688
ddb{0}> show proc
PROC (syz-executor) tid=16616 pid=3070 tcnt=2 stat=onproc
    flags process=0 proc=0
    runpri=50, usrpri=86, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000fffe5c60,0xffff8000ffff02c0
    process=0xffff80003bc0b0a0 user=0xffff800037be9000, vmspace=0xfffffd805e97b988
    estcpu=36, cpticks=3, pctcpu=0.0, user=0, sys=2, intr=1
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
* 3070   16616  25664      0  7           0                syz-executor
  3070  186612  25664      0  3   0x4000080  fsleep        syz-executor
 13028  388350  18291      0  3        0x80  nanoslp       syz-executor
 13028  255209  18291      0  2   0x4000000                syz-executor
 95864  417688  85257      0  3        0x80  nanoslp       syz-executor
 95864  497131  85257      0  3   0x4000080  netcon        syz-executor
 95864  436151  85257      0  3   0x4000080  fsleep        syz-executor
 43327  228374  37444      0  2         0x2                syz-executor
 85627  449397  39725      0  3      0x3000  suspend       syz-executor
 85627  108738  39725      0  3   0x4081000  biowait       syz-executor
 85627  121617  39725      0  3   0x4081000  inode         syz-executor
 57081  106135      1      0  3    0x100083  ttyin         getty
 39147  172056      0      0  3     0x14200  bored         sosplice
  7799   19101  37444      0  3        0x82  nanoslp       syz-executor
 94724  302259  37444      0  3        0x82  wait          syz-executor
 85257  269364  37444      0  3        0x82  nanoslp       syz-executor
 31634   11825  37444      0  2         0x2                syz-executor
 39725  407548  37444      0  3        0x82  nanoslp       syz-executor
 18291  225407  37444      0  3        0x82  nanoslp       syz-executor
 25664  263795  37444      0  3        0x82  nanoslp       syz-executor
 37444  222889  37230      0  2         0x2                syz-executor
 37230  173424  38790      0  3    0x10008a  sigsusp       ksh
 38790  373502  84922      0  3        0x98  kqread        sshd-session
 84922  449355  74263      0  3        0x92  kqread        sshd-session
 74263  395758      1      0  3        0x88  kqread        sshd
   632  195647  52811     74  3   0x1100092  bpf           pflogd
 52811  430366      1      0  3        0x80  sbwait        pflogd
 16524  487096  83468     73  3   0x1100090  kqread        syslogd
 83468  118601      1      0  3    0x100082  sbwait        syslogd
 32978  494914      1      0  2    0x100000                resolvd
 29091  367624  83936     77  2    0x100012                dhcpleased
 18036  201441  83936     77  3    0x100092  kqread        dhcpleased
 83936   27577      1      0  3        0x80  kqread        dhcpleased
 54563   42126      0      0  3     0x14200  bored         smr
 10663  251605      0      0  3     0x14200  pgzero        zerothread
  9160  463948      0      0  3     0x14200  aiodoned      aiodoned
 75699  420983      0      0  3     0x14200  syncer        update
 25033   79159      0      0  3     0x14200  cleaner       cleaner
 87265  435534      0      0  3     0x14200  reaper        reaper
 61750   41627      0      0  3     0x14200  pgdaemon      pagedaemon
 59613  344424      0      0  3     0x14200  bored         viomb
 64801  149919      0      0  3  0x40014200  acpi0         acpi0
 57448  302046      0      0  3  0x40014200                idle1
  2214  438515      0      0  3     0x14200  bored         softnet3
 56761   20680      0      0  3     0x14200  bored         softnet2
 20684  155253      0      0  3     0x14200  bored         softnet1
 81255  412557      0      0  2     0x14200                softnet0
 79902   94622      0      0  3     0x14200  bored         systqmp
 72544  167945      0      0  3     0x14200  bored         systq
 50992   97676      0      0  3     0x14200  tmoslp        softclockmp
 55930   99397      0      0  3  0x40014200  tmoslp        softclock
 31255  258494      0      0  3  0x40014200                idle0
     1  329360      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex &pmap->pm_mtx r = 0 (0xfffffd806bf40810)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1ad sys/kern/kern_lock.c:311
#2  mtx_enter+0x62 sys/kern/kern_lock.c:261
#3  pmap_write_protect+0x87 rcr3 machine/cpufunc.h:139 [inline]
#3  pmap_write_protect+0x87 pmap_map_ptes sys/arch/amd64/amd64/pmap.c:437 [inline]
#3  pmap_write_protect+0x87 sys/arch/amd64/amd64/pmap.c:2163
#4  uvm_map_protect+0xbcd pmap_protect machine/pmap.h:476 [inline]
#4  uvm_map_protect+0xbcd sys/uvm/uvm_map.c:3191
#5  sys_mprotect+0x34c sys/uvm/uvm_mmap.c:590
#6  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:637
#7  Xsyscall+0x128
Process 3070 (syz-executor) thread 0xffff8000ffff1c50 (16616)
exclusive rwlock uobjlk r = 0 (0xfffffd806cfad9b8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  uvm_map_protect+0xb6e sys/uvm/uvm_map.c:3191
#3  sys_mprotect+0x34c sys/uvm/uvm_mmap.c:590
#4  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:637
#5  Xsyscall+0x128
exclusive rwlock vmmaplk r = 0 (0xfffffd805e97ba88)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5168
#3  uvm_map_protect+0xe1 sys/uvm/uvm_map.c:3064
#4  sys_mprotect+0x34c sys/uvm/uvm_mmap.c:590
#5  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:637
#6  Xsyscall+0x128
exclusive mutex &pmap->pm_mtx r = 0 (0xfffffd806bf40810)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1ad sys/kern/kern_lock.c:311
#2  mtx_enter+0x62 sys/kern/kern_lock.c:261
#3  pmap_write_protect+0x87 rcr3 machine/cpufunc.h:139 [inline]
#3  pmap_write_protect+0x87 pmap_map_ptes sys/arch/amd64/amd64/pmap.c:437 [inline]
#3  pmap_write_protect+0x87 sys/arch/amd64/amd64/pmap.c:2163
#4  uvm_map_protect+0xbcd pmap_protect machine/pmap.h:476 [inline]
#4  uvm_map_protect+0xbcd sys/uvm/uvm_map.c:3191
#5  sys_mprotect+0x34c sys/uvm/uvm_mmap.c:590
#6  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:637
#7  Xsyscall+0x128
Process 85627 (syz-executor) thread 0xffff8000ffff0a60 (108738)
exclusive rrwlock inode r = 0 (0xfffffd806bdd52e0)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x190 sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x23c sys/kern/sys_generic.c:380
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:637
#9  Xsyscall+0x128
Process 85627 (syz-executor) thread 0xffff8000fffe54b0 (121617)
exclusive rrwlock inode r = 0 (0xfffffd806d84e8a8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  uipc_bind+0x2f4 sys/kern/uipc_usrreq.c:371
#8  sys_bind+0x28a sys/kern/uipc_syscalls.c:189
#9  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:637
#10 Xsyscall+0x128
Process 81255 (softnet0) thread 0xffff8000ffffe000 (412557)
shared rwlock softnet0 r = 0 (0xffff80000002c078)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10210  11025K   11365K 166960K     12228        0
            pcb    17     12K      12K 166960K       168        0
         rtable   212      7K       8K 166960K       509        0
             pf    35     17K      81K 166960K       108        0
         ifaddr    40      7K       7K 166960K        84        0
        ifgroup    56      2K       2K 166960K       132        0
         sysctl     3      1K       9K 166960K        12        0
       counters    70     37K      37K 166960K       130        0
       ioctlops     0      0K       4K 166960K      1586        0
            iov     0      0K      16K 166960K        40        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1329     84K      84K 166960K      2079        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2     16K      20K 166960K        14        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        19        0
        dirhash    12      2K       2K 166960K        24        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K      97K 166960K      2369        0
          sigio     0      0K       0K 166960K        19        0
           proc    72     91K     152K 166960K       639        0
        subproc    72      4K       4K 166960K        81        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       118        0
       in_multi    87      6K       7K 166960K       172        0
    ether_multi     1      0K       0K 166960K        19        0
            mrt     2      0K       0K 166960K        15        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    97    440K     440K 166960K        97        0
           exec     0      0K       1K 166960K       459        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   234    168K     183K 166960K     20032        0
       UVM aobj     8      2K       2K 166960K        10        0
     pinsyscall    41     82K     108K 166960K      3485        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        57        0
            NDP    14      0K       2K 166960K        54        0
           temp    55   8690K    8945K 166960K     43366        0
         kqueue    14     22K      26K 166960K       205        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      106    0      103     1     0     1     1     0     8    0
rtentry    176      147    0       52     6     0     6     6     0     8    0
unpcb      144      413    0      394     1     0     1     1     0     8    0
syncache   336        4    0        4     3     2     1     1     0     8    1
tcpcb      736      213    0      208     1     0     1     1     0     8    0
arp        128       25    0        5     1     0     1     1     0     8    0
inpcb      328      741    0      731     3     1     2     2     0     8    1
nd6        144       28    0        6     1     0     1     1     0     8    0
pkpcb       40        7    0        7     2     2     0     1     0     8    0
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1192      19    0       18     1     0     1     1     0     8    0
pppxif     1504       8    0        7     1     0     1     1     0     8    0
pffrag     232        4    0        2     1     0     1     1     0   482    0
pffrnode    88        4    0        2     1     0     1     1     0     8    0
pffrent     40        8    0        6     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       74    0       23     1     0     1     1     0     8    0
pfstkey    128       74    0       23     2     0     2     2     0     8    0
pfstate    384       74    0       23     6     0     6     6     0     8    0
pfrule     1344      23    0       17     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      609    0      206    29     2    27    29     0     8    0
art_table   32      611    0      206     4     0     4     4     0     8    0
art_node    16      143    0       59     1     0     1     1     0     8    0
sysvmsgpl   40       12    0        6     1     0     1     1     0     8    0
semupl     112        3    0        3     1     1     0     1     0     8    0
semapl     112       16    0        6     1     0     1     1     0     8    0
shmpl      112        7    0        2     1     0     1     1     0     8    0
dirhash    1024      25    0        8     3     0     3     3     0     8    0
dino2pl    256     4704    0     3203    95     0    95    95     0     8    0
ffsino     288     4704    0     3203   109     0   109   109     0     8    0
nchpl      144     7368    0     6841    63    31    32    63     0     8    8
uvmvnodes   80     5120    0        0   105     0   105   105     0     8    0
vnodes     216     5120    0        0   285     0   285   285     0     8    0
namei      1024   18555    0    18554     3     2     1     2     0     8    0
percpumem   16       80    0       30     1     0     1     1     0     8    0
kstatmem   264       72    0       46     3     0     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        6    0        6     1     0     1     1     0     8    1
scxspl     216    26706    0    26705    12    10     2     8     1     8    1
plimitpl   152      126    0      108     1     0     1     1     0     8    0
sigapl     424     2692    0     2643     9     2     7     9     0     8    0
knotepl    120      567    0        0    17     0    17    17     0     8    0
kqueuepl   224      216    0      205     1     0     1     1     0     8    0
pipepl     336      136    0      109     4     1     3     3     0     8    0
fdescpl    520     2650    0     2620     3     0     3     3     0     8    0
filepl     160     6733    0     6515    11     1    10    10     0     8    0
lockfpl    104      346    0      344     1     0     1     1     0     8    0
lockfspl    48      144    0      142     1     0     1     1     0     8    0
sessionpl  144       25    0       16     1     0     1     1     0     8    0
pgrppl      48       44    0       27     1     0     1     1     0     8    0
ucredpl    104      960    0      946     1     0     1     1     0     8    0
zombiepl   144     2646    0     2643     3     2     1     1     0     8    0
processpl  1240    2692    0     2643     7     2     5     6     0     8    0
procpl     656     5154    0     5099     7     1     6     7     0     8    0
srpgc       96        4    0        4     1     0     1     1     0     8    1
sockpl     728     1286    0     1254     6     2     4     4     0     8    0
mcl64k     65536     17    0        0     3     0     3     3     0     8    0
mcl16k     16384     17    0        0     3     0     3     3     0     8    0
mcl12k     12288     17    0        0     2     0     2     2     0     8    0
mcl9k      9216      17    0        0     2     0     2     2     0     8    0
mcl8k      8192      17    0        0     3     0     3     3     0     8    0
mcl4k      4096     122    0        0    16     0    16    16     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      19    0        0     3     0     3     3     0     8    0
mtagpl      96       21    0        0     1     0     1     1     0     8    0
mbufpl     256     1211    0        0    76     0    76    76     0     8    0
bufpl      280     8852    0     2710   440     0   440   440     0     8    1
anonpl      32     8518    0        0    69     0    69    69     0   246    0
amapchunkpl 152   69564    0    69105    39    12    27    29     0   158    7
amappl16   200     5593    0     5329    41    27    14    18     0     8    0
amappl15   192        4    0        4     1     1     0     1     0     8    0
amappl14   184      116    0      104     1     0     1     1     0     8    0
amappl13   176        3    0        3     2     2     0     1     0     8    0
amappl12   168     3314    0     3284     3     1     2     2     0     8    0
amappl11   160       81    0       67     1     0     1     1     0     8    0
amappl10   152       29    0       29     2     2     0     1     0     8    0
amappl9    144      242    0      242     2     2     0     1     0     8    0
amappl8    136       33    0       31     1     0     1     1     0     8    0
amappl7    128      123    0      110     1     0     1     1     0     8    0
amappl6    120      180    0      177     2     1     1     1     0     8    0
amappl5    112      124    0      115     1     0     1     1     0     8    0
amappl4    104      321    0      301     1     0     1     1     0     8    0
amappl3     96    15237    0    15129     5     1     4     4     0     8    0
amappl2     88      652    0      592     2     0     2     2     0     8    0
amappl1     80    17382    0    16771    18     4    14    15     0     8    0
amappl      88    19223    0    19063     5     0     5     5     0    92    0
dma65536   65536      1    0        1     1     0     1     1     0     8    1
dma16384   16384      1    0        1     1     0     1     1     0     8    1
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        7    0        7     2     2     0     1     0     8    0
dma128     128      254    0      254     2     2     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        8    0        8     2     1     1     1     0     8    1
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72        9    0        2     1     0     1     1     0     8    0
uaddrrnd    24     2650    0     2620     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2650    0     2620     1     0     1     1     0     8    0
vmmpekpl   168    18089    0    18047     2     0     2     2     0     8    0
vmmpepl    168   158176    0   155999   109     6   103   103     0   357    3
vmsppl     480     2649    0     2620     6     1     5     5     0     8    0
rwobjpl     72    40929    0    34638   115     0   115   115     0     8    0
pdppl      4096    5307    0     5240   108    35    73    87     0     8    6
pvpl        32    17543    0        0   142     1   141   141     0   265    0
pmappl     256     2649    0     2620     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      471    0       46    13     0    13    13     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x763b7a5a6ff0, count: -1
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(1) at acpitimer_delay+0x175 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline]
acpitimer_delay(1) at acpitimer_delay+0x175 sys/dev/acpi/acpitimer.c:125
comcnputc(800,65) at comcnputc+0x29b sys/dev/ic/com.c:1269
cnputc(65) at cnputc+0x61 sys/dev/cons.c:218
db_putchar(65) at db_putchar+0x65c sys/ddb/db_output.c:155
kprintf() at kprintf+0x2aba sys/kern/subr_prf.c:1065
db_printf(ffffffff833fc7d0) at db_printf+0x9b sys/kern/subr_prf.c:-1
panic(ffffffff83469383) at panic+0x103 sys/kern/subr_prf.c:216
__assert(ffffffff83414efe,ffffffff8341d686,3b7,ffffffff8341d709) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_finalize(ffff80003c445788,ffffffff8335de51) at refcnt_finalize+0x1db sys/kern/kern_synch.c:952
pppx_if_destroy(0,ffff80003c445780) at pppx_if_destroy+0x3d sys/net/if_pppx.c:806
end trace frame: 0xffff80002a3489c0, count: 0
ddb{1}> trace
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 sys/arch/amd64/amd64/bus_space.c:666
acpitimer_delay(1) at acpitimer_delay+0x175 acpitimer_read sys/dev/acpi/acpitimer.c:141 [inline]
acpitimer_delay(1) at acpitimer_delay+0x175 sys/dev/acpi/acpitimer.c:125
comcnputc(800,65) at comcnputc+0x29b sys/dev/ic/com.c:1269
cnputc(65) at cnputc+0x61 sys/dev/cons.c:218
db_putchar(65) at db_putchar+0x65c sys/ddb/db_output.c:155
kprintf() at kprintf+0x2aba sys/kern/subr_prf.c:1065
db_printf(ffffffff833fc7d0) at db_printf+0x9b sys/kern/subr_prf.c:-1
panic(ffffffff83469383) at panic+0x103 sys/kern/subr_prf.c:216
__assert(ffffffff83414efe,ffffffff8341d686,3b7,ffffffff8341d709) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_finalize(ffff80003c445788,ffffffff8335de51) at refcnt_finalize+0x1db sys/kern/kern_synch.c:952
pppx_if_destroy(0,ffff80003c445780) at pppx_if_destroy+0x3d sys/net/if_pppx.c:806
pppxclose(205b9a,1,2000,ffff8000ffff0020) at pppxclose+0xa0 sys/net/if_pppx.c:553
spec_close(ffff80002a348a40) at spec_close+0x412 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd806ff5c2d8,1,fffffd80097fb750,ffff8000ffff0020) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806d2ffc98,ffff8000ffff0020) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806d2ffc98,ffff8000ffff0020) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd806d2ffc98,ffff8000ffff0020) at fdrop+0x126 sys/kern/kern_descrip.c:1267
closef(fffffd806d2ffc98,ffff8000ffff0020) at closef+0x192 sys/kern/kern_descrip.c:1251
fdfree(ffff8000ffff0020) at fdfree+0x116 sys/kern/kern_descrip.c:1182
exit1(ffff8000ffff0020,0,0,1) at exit1+0x59c sys/kern/kern_exit.c:215
sys_exit(ffff8000ffff0020,ffff80002a348db0,ffff80002a348d00) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a348db0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a348db0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:637
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ecd44367540, count: -25

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/28 11:43 openbsd fd1ffb313c1e fc9d8ee5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: kernel diagnostic assertion "refs != ~NUM" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch
* Struck through repros no longer work on HEAD.