uvm_fault: rtable_getsource

Status: upstream: reported on 2026/08/31 23:55
Reported-by: syzbot+8ef2fcdee61aa2438d44@syzkaller.appspotmail.com
First crash: 18d, last: 18d

Sample crash report:
uvm_fault(0xfffff4800b1f75b8, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      rtable_getsource+0x171: movq    0(%rax,%rcx,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 187725  71045      0     0x14000      0x200    0  systqmp
rtable_getsource(0,2) at rtable_getsource+0x171 rtable_get sys/net/rtable.c:260 [inline]
rtable_getsource(0,2) at rtable_getsource+0x171 sys/net/rtable.c:410
rtable_clearsource(0,ffff80000162b668) at rtable_clearsource+0x41 sys/net/rtable.c:-1
rt_ifa_del(ffff80000162b600,800100,ffff80000162b668,0) at rt_ifa_del+0x37b sys/net/route.c:1341
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f4000) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f4000) at if_detach+0x2fe sys/net/if.c:1311
tun_clone_destroy(ffff8000015f4000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a3788c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d04,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a378980) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff4806e170108,7,fffff480097fd270,ffff800030f8aa90) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff4806cf2be90,ffff800030f8aa90) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff4806cf2be90,ffff800030f8aa90) at closef+0x192 sys/kern/kern_descrip.c:1265
end trace frame: 0xffff80002a378b60, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffff4800b1f75b8, 0x0, 0, 1) -> e
ddb{1}> show kasan
No such command
ddb{1}> trace
rtable_getsource(0,2) at rtable_getsource+0x171 rtable_get sys/net/rtable.c:260 [inline]
rtable_getsource(0,2) at rtable_getsource+0x171 sys/net/rtable.c:410
rtable_clearsource(0,ffff80000162b668) at rtable_clearsource+0x41 sys/net/rtable.c:-1
rt_ifa_del(ffff80000162b600,800100,ffff80000162b668,0) at rt_ifa_del+0x37b sys/net/route.c:1341
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f4000) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f4000) at if_detach+0x2fe sys/net/if.c:1311
tun_clone_destroy(ffff8000015f4000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a3788c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d04,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a378980) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff4806e170108,7,fffff480097fd270,ffff800030f8aa90) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff4806cf2be90,ffff800030f8aa90) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff4806cf2be90,ffff800030f8aa90) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800030f8aa90) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800030f8aa90,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800030f8aa90,ffff80002a378cf0,ffff80002a378c40) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a378cf0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a378cf0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77d09a2759c0, count: -19
ddb{1}> show registers
rdi                             0x21
rsi                                0
rbp               0xffff80002a378550
rbx                              0x1
rdx                                0
rcx                                0
rax                                0
r8                              0xa0
r9                               0x1
r10               0x5316e2f571289482
r11               0xfad207df4d2d883e
r12                             0x21
r13                       0xfffffffe
r14                                0
r15               0xffff800000c40ec0
rip               0xffffffff8158cf61    rtable_getsource+0x171
cs                               0x8
rflags                       0x10206    __ALIGN_SIZE+0xf206
rsp               0xffff80002a378500
ss                              0x10
rtable_getsource+0x171: movq    0(%rax,%rcx,8),%r14
ddb{1}> show proc
PROC (syz-executor) tid=262293 pid=51376 tcnt=0 stat=onproc
    flags process=a<EXEC,EXITING> proc=2000<WEXIT>
    runpri=32, usrpri=78, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80003c3cfa18,0xffff800030f8b798
    process=0xffff80003a823050 user=0xffff80002a373000, vmspace=0xfffff4800b1f75b8
    estcpu=28, cpticks=5, pctcpu=0.3, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 20097  446921  92294     0  3         0x2          0 clonelk   ifconfig
 92294  408741  80633     0  3    0x100002       0x88 sigsusp   sh
 80633  450971  69536     0  3         0x2       0x80 wait      syz-executor
 25403  512871  35404     0  3         0x2          0 clonelk   ifconfig
 35404  507614  39130     0  3    0x100002       0x88 sigsusp   sh
 39130  415998  69536     0  3         0x2       0x80 wait      syz-executor
  5657  371984  31634     0  3         0x2          0 clonelk   ifconfig
 31634  303897  55226     0  3    0x100002       0x88 sigsusp   sh
 55226  327534  69536     0  3         0x2       0x80 wait      syz-executor
 84958  312306  69536     0  3         0x2          0 clonelk   syz-executor
 21774  352511  69536     0  3         0x2       0x80 piperd    syz-executor
 50294    4874      0     0  3     0x14000      0x280 nfsidl    nfsio
 15489   44392      0     0  3     0x14000      0x280 nfsidl    nfsio
 39264  342508      0     0  3     0x14000      0x280 nfsidl    nfsio
 64372  504951      0     0  3     0x14000      0x280 nfsidl    nfsio
  1635   16365      0     0  3     0x14000      0x280 nfsidl    nfsio
 82555  117243      0     0  3     0x14000      0x280 nfsidl    nfsio
 73969  432870      0     0  3     0x14000      0x280 nfsidl    nfsio
 20158  299822      0     0  3     0x14000      0x280 nfsidl    nfsio
 74868  140364      0     0  3     0x14000      0x280 nfsidl    nfsio
 36912   55033      0     0  3     0x14000      0x280 nfsidl    nfsio
 48199  309161      0     0  3     0x14000      0x280 nfsidl    nfsio
 24204  443050      0     0  3     0x14000      0x280 nfsidl    nfsio
 30071  326058      0     0  3     0x14000      0x280 nfsidl    nfsio
 31973  385189      0     0  3     0x14000      0x280 nfsidl    nfsio
 14747  189935      0     0  3     0x14000      0x280 nfsidl    nfsio
 52747  145799      0     0  3     0x14000      0x280 nfsidl    nfsio
 32373  218894      0     0  3     0x14000      0x280 nfsidl    nfsio
 39014  325586      0     0  3     0x14000      0x280 nfsidl    nfsio
 39669  142432      0     0  3     0x14000      0x280 nfsidl    nfsio
 16795  512668      0     0  3     0x14000      0x280 nfsidl    nfsio
 69536   54989   9587     0  3         0x2       0x80 nanoslp   syz-executor
  9587  365602  33983     0  3    0x100002       0x88 sigsusp   ksh
 33983  361105  25873     0  3        0x10       0x88 kqread    sshd-session
 25873  235544  46909     0  3        0x12       0x80 kqread    sshd-session
 87692  486824      1     0  3    0x100003       0x80 ttyin     getty
 46909    1054      1     0  3           0       0x88 kqread    sshd
 57323  124513  97993    74  3   0x1100012       0x80 bpf       pflogd
 97993  267429      1     0  3           0       0x80 sbwait    pflogd
 64034  213245  50990    73  3   0x1100010       0x80 kqread    syslogd
 50990  244644      1     0  3    0x100002       0x80 sbwait    syslogd
 11583  187180      1     0  3    0x100000       0x80 kqread    resolvd
 48498  149012  45700    77  3    0x100012       0x80 kqread    dhcpleased
 18320  112186  45700    77  3    0x100012       0x80 kqread    dhcpleased
 45700  469005      1     0  3           0       0x80 kqread    dhcpleased
 16340  433134      0     0  3     0x14000      0x200 bored     smr
 57371  186511      0     0  3     0x14000      0x200 pgzero    zerothread
 78689  110188      0     0  3     0x14000      0x200 aiodoned  aiodoned
 11083   12525      0     0  3     0x14000      0x200 syncer    update
 17636  451338      0     0  3     0x14000      0x200 cleaner   cleaner
 13215   66104      0     0  3     0x14000      0x200 reaper    reaper
 77593   61830      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 88666  362528      0     0  3     0x14000      0x200 bored     viomb
 10089  250050      0     0  3     0x14000 0x40000200 acpi0     acpi0
  4907  283737      0     0  3     0x14000 0x40000200           idle1
 93619  385348      0     0  3     0x14000      0x200 bored     softnet1
  5763   62093      0     0  3     0x14000      0x200 bored     softnet0
 71045  187725      0     0  7     0x14000      0x200           systqmp
 69893  218198      0     0  3     0x14000      0x200 bored     systq
 62828  513912      0     0  3     0x14000      0x200 tmoslp    softclockmp
 28617  413244      0     0  3     0x14000 0x40000200 tmoslp    softclock
 61423   99408      0     0  3     0x14000 0x40000200           idle0
     1  410413      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 71045 (systqmp) thread 0xffff800045ffe298 (187725)
shared rwlock systqmp r = 0 (0xffffffff839649c8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11036  12071K   12350K 166960K     12748        0
            pcb    17     13K      14K 166960K        87        0
         rtable   127      8K      12K 166960K      3490        0
             pf    28     17K      38K 166960K       305        0
         ifaddr    19      3K       7K 166960K       465        0
        ifgroup    31      1K       2K 166960K       472        0
         sysctl     3      1K       9K 166960K         8        0
       counters    58     35K      37K 166960K       412        0
       ioctlops     0      0K       4K 166960K      1758        0
            iov     0      0K      12K 166960K         7        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1290     81K      81K 166960K      2579        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         6        0
         VM map     2      1K       1K 166960K         2        0
            sem    17      0K       0K 166960K        27        0
        dirhash    15      2K       2K 166960K        15        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    14     49K      89K 166960K      1970        0
          sigio     0      0K       0K 166960K         3        0
           proc    93    164K     180K 166960K      3492        0
        subproc    54      3K       4K 166960K      1035        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        15        0
       in_multi    33      2K       6K 166960K      1232        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     0      0K       0K 166960K        54        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    49    228K     228K 166960K        49        0
           exec     0      0K       1K 166960K      1743        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   177    152K     179K 166960K     13930        0
       UVM aobj     7      2K       2K 166960K        10        0
     pinsyscall    39     78K     102K 166960K      5820        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         6        0
            NDP     6      0K       2K 166960K       339        0
           temp    27   9117K    9138K 166960K     25792        0
         kqueue    13     20K      28K 166960K        62        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120      252    0      249     1     0     1     1     0     8    0
rtentry    176     1245    0     1201     7     2     5     6     0     8    1
unpcb      144      178    0      161     2     1     1     2     0     8    0
syncache   336        5    0        5     2     2     0     1     0     8    0
tcpcb      736       52    0       48     1     0     1     1     0     8    0
arp        136      224    0      218     1     0     1     1     0     8    0
inpcb      328      789    0      779     9     8     1     9     0     8    0
nd6        152      333    0      327     1     0     1     1     0     8    0
pkpcb       40        3    0        3     1     1     0     1     0     8    0
kcovpl      48      115    0      109     1     0     1     1     0     8    0
ppxss      1192      68    0       68     1     1     0     1     0     8    0
pfstscr     40       68    0       68     2     2     0     1     0     8    0
pffrag     232        3    0        1     1     0     1     1     0   482    0
pffrnode    88        3    0        1     1     0     1     1     0     8    0
pffrent     40        5    0        3     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       4    0        1     1     0     1     1     0     8    0
pfanchor   1288       7    0        0     1     0     1     1     0     8    0
pfstitem    24       38    0       13     1     0     1     1     0     8    0
pfstkey    128      106    0       81     1     0     1     1     0     8    0
pfstate    448      105    0       80     4     0     4     4     0     8    0
pfrule     1360      24    0       18     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     5070    0     4876    37    10    27    32     0     8    7
art_table   40     5071    0     4876     6     1     5     6     0     8    0
art_node    32     1245    0     1205     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl      72       22    0        7     1     0     1     1     0     8    0
shmpl      112        7    0        3     1     0     1     1     0     8    0
dirhash    1024      19    0        0     3     0     3     3     0     8    0
dino2pl    256     2190    0      506   106     0   106   106     0     8    0
ffsino     296     2190    0      506   130     0   130   130     0     8    0
nchpl      144     2700    0      647    77     0    77    77     0     8    0
rtmask      32        1    0        1     1     1     0     1     0     8    0
vnodes     216     3386    0        0   189     0   189   189     0     8    0
namei      1024   21764    0    21764     2     1     1     2     0     8    1
percpumem   16      222    0      177     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        0     1     0     1     1     0     8    0
kstatmem   264      237    0      222     2     0     2     2     0     8    0
scxspl     216     9023    0     9023     9     8     1     6     1     8    1
plimitpl   152      158    0      142     1     0     1     1     0     8    0
sigapl     424     2093    0     2028    11     3     8     9     0     8    0
knotepl    120      379    0        0    12     0    12    12     0     8    0
kqueuepl   224       85    0       76     1     0     1     1     0     8    0
pipepl     344      470    0      443     5     1     4     4     0     8    1
fdescpl    528     2057    0     2029     3     0     3     3     0     8    0
filepl     160     6049    0     5868    14     4    10    14     0     8    0
lockfpl    104       64    0       62     1     0     1     1     0     8    0
lockfspl    48       32    0       30     1     0     1     1     0     8    0
sessionpl  144      136    0      127     1     0     1     1     0     8    0
pgrppl      48      254    0      238     1     0     1     1     0     8    0
ucredpl    104      384    0      371     1     0     1     1     0     8    0
zombiepl   144     2030    0     2028     1     0     1     1     0     8    0
processpl  1232    2093    0     2028     7     1     6     6     0     8    0
procpl     664     2661    0     2596     7     0     7     7     0     8    0
sockpl     752     1237    0     1207    14    10     4    14     0     8    0
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     131    0        0    17     0    17    17     0     8    0
mcl2k      2048      27    0        0     3     0     3     3     0     8    0
mextrefs    64       27    0        0     1     0     1     1     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256      165    0        0    11     0    11    11     0     8    0
bufpl      272     2917    0      106   188     0   188   188     0     8    0
anonpl      32     7488    0        0    61     0    61    61     0   247    0
amapchunkpl 152   36440    0    36148    27    11    16    25     0   158    2
amappl16   200     2114    0     2105    16    15     1    14     0     8    0
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184     1676    0     1672     1     0     1     1     0     8    0
amappl13   176      349    0      337     1     0     1     1     0     8    0
amappl12   168     2721    0     2696     2     0     2     2     0     8    0
amappl11   160        4    0        4     1     1     0     1     0     8    0
amappl10   152       62    0       48     1     0     1     1     0     8    0
amappl9    144      297    0      296     2     1     1     1     0     8    0
amappl8    136      514    0      509     1     0     1     1     0     8    0
amappl7    128      363    0      348     1     0     1     1     0     8    0
amappl6    120     1195    0     1188     1     0     1     1     0     8    0
amappl5    112      109    0       99     1     0     1     1     0     8    0
amappl4    104      606    0      583     1     0     1     1     0     8    0
amappl3     96     7056    0     6992     3     0     3     3     0     8    0
amappl2     88     1769    0     1697     2     0     2     2     0     8    0
amappl1     80    25099    0    24509    16     2    14    15     0     8    1
amappl      88    11421    0    11316     4     0     4     4     0    92    0
uvmvnodes   80      103    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma2048    2048       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        9    0        3     1     0     1     1     0     8    0
uaddrrnd    24     2057    0     2029     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2057    0     2029     1     0     1     1     0     8    0
vmmpekpl   168    16771    0    16719     4     0     4     4     0     8    0
vmmpepl    168   139755    0   138188    96    15    81    94     0   357    7
vmsppl     488     2056    0     2029     5     0     5     5     0     8    0
rwobjpl     80    40018    0    39036    27     4    23    27     0     8    1
pdppl      4096    4121    0     4058   215   150    65    83     0     8    2
pvpl        32    13635    0        0   110     0   110   110     0   265    0
pmappl     256     2056    0     2029     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      601    0      167    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8395cff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:159
taskq_next_work(ffffffff83964950,ffff80002a1caa18) at taskq_next_work+0x8e sys/kern/kern_task.c:399
taskq_thread(ffffffff83964950) at taskq_thread+0x1d5 sys/kern/kern_task.c:439
end trace frame: 0x0, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff8395cff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:159
taskq_next_work(ffffffff83964950,ffff80002a1caa18) at taskq_next_work+0x8e sys/kern/kern_task.c:399
taskq_thread(ffffffff83964950) at taskq_thread+0x1d5 sys/kern/kern_task.c:439
end trace frame: 0x0, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      rtable_getsource+0x171: movq    0(%rax,%rcx,8),%r14
rtable_getsource(0,2) at rtable_getsource+0x171 rtable_get sys/net/rtable.c:260 [inline]
rtable_getsource(0,2) at rtable_getsource+0x171 sys/net/rtable.c:410
rtable_clearsource(0,ffff80000162b668) at rtable_clearsource+0x41 sys/net/rtable.c:-1
rt_ifa_del(ffff80000162b600,800100,ffff80000162b668,0) at rt_ifa_del+0x37b sys/net/route.c:1341
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f4000) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f4000) at if_detach+0x2fe sys/net/if.c:1311
tun_clone_destroy(ffff8000015f4000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a3788c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d04,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a378980) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff4806e170108,7,fffff480097fd270,ffff800030f8aa90) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff4806cf2be90,ffff800030f8aa90) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff4806cf2be90,ffff800030f8aa90) at closef+0x192 sys/kern/kern_descrip.c:1265
end trace frame: 0xffff80002a378b60, count: 0
ddb{1}> trace
rtable_getsource(0,2) at rtable_getsource+0x171 rtable_get sys/net/rtable.c:260 [inline]
rtable_getsource(0,2) at rtable_getsource+0x171 sys/net/rtable.c:410
rtable_clearsource(0,ffff80000162b668) at rtable_clearsource+0x41 sys/net/rtable.c:-1
rt_ifa_del(ffff80000162b600,800100,ffff80000162b668,0) at rt_ifa_del+0x37b sys/net/route.c:1341
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000162b600) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f4000) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f4000) at if_detach+0x2fe sys/net/if.c:1311
tun_clone_destroy(ffff8000015f4000) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a3788c0) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d04,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a378980) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff4806e170108,7,fffff480097fd270,ffff800030f8aa90) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff4806cf2be90,ffff800030f8aa90) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffff4806cf2be90,ffff800030f8aa90) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff4806cf2be90,ffff800030f8aa90) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff800030f8aa90) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff800030f8aa90,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff800030f8aa90,ffff80002a378cf0,ffff80002a378c40) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a378cf0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a378cf0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77d09a2759c0, count: -19

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/31 23:54 openbsd 4077242b4a15 00e9c810 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: rtable_getsource
* Struck through repros no longer work on HEAD.