uvm_fault: rtable_clearsource

Status: upstream: reported on 2026/08/22 23:56
Reported-by: syzbot+9d95a0129e2eebbb37a0@syzkaller.appspotmail.com
First crash: 6d03h, last: 1d02h

Sample crash report:
uvm_fault(0xfffff9806d180740, 0x6a90e4d5, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      rtable_clearsource+0x15a:       movq    0(%rax,%r14,8),%rax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_get sys/net/rtable.c:260 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_getsource sys/net/rtable.c:410 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a sys/net/rtable.c:422
rt_ifa_del(ffff80000159b100,800100,ffff80000159b168,0) at rt_ifa_del+0x37b sys/net/route.c:1342
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f2800) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f2800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff8000015f2800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a805490) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a805550) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff980703c0898,7,fffff98007ffd820,ffff80002a766010) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff9806dfc0f10,ffff80002a766010) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff9806dfc0f10,ffff80002a766010) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a766010) at fdfree+0x115 sys/kern/kern_descrip.c:1196
end trace frame: 0xffff80002a8057b0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffff9806d180740, 0x6a90e4d5, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_get sys/net/rtable.c:260 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_getsource sys/net/rtable.c:410 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a sys/net/rtable.c:422
rt_ifa_del(ffff80000159b100,800100,ffff80000159b168,0) at rt_ifa_del+0x37b sys/net/route.c:1342
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f2800) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f2800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff8000015f2800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a805490) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a805550) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff980703c0898,7,fffff98007ffd820,ffff80002a766010) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff9806dfc0f10,ffff80002a766010) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff9806dfc0f10,ffff80002a766010) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a766010) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a766010,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a766010,ffff80002a8058b0,ffff80002a805800) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a8058b0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8058b0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73e4fb58c220, count: -18
ddb> show registers
rdi                              0x6
rsi                                0
rbp               0xffff80002a805170
rbx                       0xfffffffe
rdx                                0
rcx                              0x1
rax                       0x6a90e4d5
r8                              0xa0
r9                                 0
r10               0xa2bd6c392dfc4a62
r11               0x2a1d459a9ade4338
r12                              0x6
r13               0xffff800000c577a0
r14                                0
r15               0xffff80000159b168
rip               0xffffffff833d61da    rtable_clearsource+0x15a
cs                               0x8
rflags                       0x10206    __ALIGN_SIZE+0xf206
rsp               0xffff80002a805120
ss                              0x10
rtable_clearsource+0x15a:       movq    0(%rax,%r14,8),%rax
ddb> show proc
PROC (syz-executor) tid=381554 pid=10351 tcnt=0 stat=onproc
    flags process=a<EXEC,EXITING> proc=2000<WEXIT>
    runpri=32, usrpri=79, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80003c8fad18,0xffff80003c8fb258
    process=0xffff800045ff8498 user=0xffff80002a800000, vmspace=0xfffff9806d180740
    estcpu=29, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 48484  167035  48792     0  3         0x2          0 clonelk   ifconfig
 21942  401365  93771     0  3         0x2          0 clonelk   ifconfig
 91100  198115  86591     0  2           0          0           syz-executor
 91100   61766  86591     0  3           0  0x4000080 fsleep    syz-executor
 48792  468276  89577     0  3    0x100002       0x88 sigsusp   sh
 93771   16750  89702     0  3    0x100002       0x88 sigsusp   sh
 82287  260536   1386     0  2           0          0           syz-executor
 82287  150107   1386     0  3           0  0x4000080 kqread    syz-executor
 82287  407842   1386     0  2           0  0x4000000           syz-executor
 82287  487259   1386     0  2           0  0x4000000           syz-executor
 82287   69752   1386     0  2           0  0x4000000           syz-executor
 89577  231664  26030     0  3         0x2       0x80 wait      syz-executor
 89702  365320  26030     0  3         0x2       0x80 wait      syz-executor
  1386   86775  26030     0  3         0x2       0x80 nanoslp   syz-executor
  4695  309695  26030     0  3         0x2          0 biowait   syz-executor
 30417  300536  26030     0  3         0x2       0x80 piperd    syz-executor
 86591   88701  26030     0  3         0x2       0x80 nanoslp   syz-executor
 26030  240185  59187     0  3         0x2       0x80 wait      syz-executor
 59187  421592  56141     0  3    0x100002       0x88 sigsusp   ksh
 56141  151072  80600     0  3        0x10       0x88 kqread    sshd-session
 80600  178089  84858     0  3        0x12       0x80 kqread    sshd-session
 58977  278601      1     0  3    0x100003       0x80 ttyin     getty
 84858  467005      1     0  3           0       0x88 kqread    sshd
 51744   34833  10843    73  3   0x1100010       0x80 kqread    syslogd
 10843  244740      1     0  3    0x100002       0x80 sbwait    syslogd
 81367   86209      1     0  3    0x100000       0x80 kqread    resolvd
 97483  246944  30914    77  3    0x100012       0x80 kqread    dhcpleased
 87172  232445  30914    77  3    0x100012       0x80 kqread    dhcpleased
 30914  426567      1     0  3           0       0x80 kqread    dhcpleased
  8064   79405      0     0  3     0x14000      0x200 bored     smr
 45249  362101      0     0  2     0x14000      0x200           zerothread
  8699   64757      0     0  3     0x14000      0x200 aiodoned  aiodoned
 30402  196464      0     0  3     0x14000      0x200 syncer    update
 76074  330771      0     0  3     0x14000      0x200 cleaner   cleaner
 21908   99433      0     0  3     0x14000      0x200 reaper    reaper
 88329  335686      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 54002  314216      0     0  3     0x14000      0x200 bored     viomb
 14288  304068      0     0  3     0x14000 0x40000200 acpi0     acpi0
 57812  319260      0     0  3     0x14000      0x200 bored     softnet0
 75113   71141      0     0  3     0x14000      0x200 bored     systqmp
  7037  239758      0     0  3     0x14000      0x200 bored     systq
 99314  189050      0     0  3     0x14000 0x40000200 tmoslp    softclock
 44823  484643      0     0  3     0x14000 0x40000200           idle0
     1  260216      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3  0x10010000      0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11026  12174K   12364K 166960K     13279        0
            pcb    17     16K      18K 166960K       187        0
         rtable   187      7K       9K 166960K      2559        0
             pf    34     14K      73K 166960K       224        0
         ifaddr    35      7K       9K 166960K       351        0
        ifgroup    42      1K       2K 166960K       372        0
         sysctl     3      1K       9K 166960K         8        0
       counters    31     17K      18K 166960K       125        0
       ioctlops     0      0K       4K 166960K       232        0
            iov     0      0K      16K 166960K       202        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1489     94K      94K 166960K      2663        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem    22      2K       2K 166960K        26        0
        dirhash    15      2K       2K 166960K        15        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     57K      97K 166960K      1584        0
          sigio     0      0K       0K 166960K         1        0
           proc    75     75K     124K 166960K      2548        0
        subproc    72      4K       4K 166960K       729        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        23        0
       in_multi    77      5K       6K 166960K       894        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     0      0K       0K 166960K        37        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    67    307K     307K 166960K        67        0
           exec     0      0K       1K 166960K      1317        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   187    152K     167K 166960K     12062        0
       UVM aobj     9      5K       6K 166960K        12        0
     pinsyscall    37     74K      96K 166960K      4548        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        16        0
            NDP    15      0K       2K 166960K       251        0
           temp    40   9111K    9183K 166960K     24658        0
         kqueue    13     20K      27K 166960K        78        0
      SYN cache     2     16K      24K 166960K         3        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      278    0      275     3     0     3     3     0     8    2
rtentry    136      912    0      834     4     0     4     4     0     8    0
unpcb      144      414    0      397     6     0     6     6     0     8    5
syncache   336       12    0       12     1     0     1     1     0     8    1
tcpqe       32        3    0        3     1     0     1     1     0     8    1
tcpcb      736      360    0      353     7     0     7     7     0     8    6
arp         96      162    0      149     1     0     1     1     0     8    0
ipq         40        2    0        0     1     0     1     1     0     8    0
ipqe        40      199    0      196     1     0     1     1     0     8    0
inpcb      328     1102    0     1090     8     0     8     8     0     8    6
nd6        112      243    0      225     1     0     1     1     0     8    0
pkpcb       40        9    0        9     1     0     1     1     0     8    1
kcovpl      48       81    0       73     1     0     1     1     0     8    0
ppxss      1072      15    0       15     1     0     1     1     0     8    1
pppxif     1416       4    0        4     1     0     1     1     0     8    1
pfstscr     40       72    0       66     1     0     1     1     0     8    0
pfsrclim   320        1    0        1     1     0     1     1     0     8    1
pfanchor   1288       2    0        0     1     0     1     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfqueue    320        1    0        0     1     0     1     1     0     8    0
pfstitem    24       10    0        2     1     0     1     1     0     8    0
pfstkey    128       45    0       38     1     0     1     1     0     8    0
pfstate    384       39    0       34     1     0     1     1     0     8    0
pfrule     1360       4    0        1     1     0     1     1     0     8    0
rttmr      136        2    0        2     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     3748    0     3381    36     4    32    34     0     8    7
art_table   40     3749    0     3381     6     0     6     6     0     8    0
art_node    32      911    0      842     1     0     1     1     0     8    0
sysvmsgpl   40        4    0        2     1     0     1     1     0     8    0
semupl     112        2    0        2     1     0     1     1     0     8    1
semapl      72       22    0        2     1     0     1     1     0     8    0
shmpl      112        9    0        3     1     0     1     1     0     8    0
dirhash    1024      19    0        0     3     0     3     3     0     8    0
dino2pl    256     2352    0      747   101     0   101   101     0     8    0
ffsino     256     2352    0      747   101     0   101   101     0     8    0
nchpl      144     3033    0     1100    72     0    72    72     0     8    0
rtmask      32        4    0        4     1     0     1     1     0     8    1
vnodes     216     3561    0        0   198     0   198   198     0     8    0
namei      1024   16597    0    16597     2     0     2     2     0     8    2
kstatmem   264      187    0      168     2     0     2     2     0     8    0
scxspl     216    11897    0    11896     8     0     8     8     1     8    7
plimitpl   152      153    0      137     1     0     1     1     0     8    0
sigapl     424     1737    0     1696     6     0     6     6     0     8    1
knotepl    120    13311    0    13264    10     0    10    10     0     8    7
kqueuepl   184      192    0      182     4     0     4     4     0     8    3
pipepl     304      396    0      369     3     0     3     3     0     8    0
fdescpl    448     1723    0     1695     5     0     5     5     0     8    1
filepl     120     7388    0     7181    15     0    15    15     0     8    8
lockfpl    104      512    0      510     2     0     2     2     0     8    1
lockfspl    48      212    0      210     1     0     1     1     0     8    0
sessionpl  144      244    0      236     1     0     1     1     0     8    0
pgrppl      48      330    0      314     1     0     1     1     0     8    0
ucredpl    104      874    0      863     1     0     1     1     0     8    0
zombiepl   144     1698    0     1696     1     0     1     1     0     8    0
processpl  1152    1737    0     1696     4     0     4     4     0     8    0
procpl     664     2429    0     2383     7     0     7     7     0     8    2
sosppl     176        3    0        3     1     0     1     1     0     8    1
sockpl     552     1812    0     1780    17     6    11    17     0     8    8
mcl64k     65536    212    0      212     1     0     1     1     0     8    1
mcl16k     16384      3    0        3     1     0     1     1     0     8    1
mcl8k      8192      12    0       12     1     0     1     1     0     8    1
mcl4k      4096    3008    0     2944    15     0    15    15     0     8    6
mcl2k      2048    1882    0     1880     4     0     4     4     0     8    3
mextrefs    64      540    0      540     1     0     1     1     0     8    1
mtagpl      96       15    0       14     1     0     1     1     0     8    0
mbufpl     256    32377    0    32248    15     0    15    15     0     8    2
bufpl      272     4455    0      104   291     0   291   291     0     8    0
anonpl      24   235324    0   232379    82     0    82    82     0   187   44
amapchunkpl 152   33784    0    33430    26     0    26    26     0   158    9
amappl16   200     4207    0     4195    54    41    13    36     0     8   10
amappl15   192        4    0        4     1     0     1     1     0     8    1
amappl14   184     1270    0     1267     1     0     1     1     0     8    0
amappl13   176      256    0      246     1     0     1     1     0     8    0
amappl12   168     2271    0     2246     2     0     2     2     0     8    0
amappl11   160       16    0       16     1     0     1     1     0     8    1
amappl10   152       55    0       45     1     0     1     1     0     8    0
amappl9    144      270    0      270     1     0     1     1     0     8    1
amappl8    136      378    0      375     1     0     1     1     0     8    0
amappl7    128      281    0      269     1     0     1     1     0     8    0
amappl6    120      864    0      859     1     0     1     1     0     8    0
amappl5    112       90    0       82     1     0     1     1     0     8    0
amappl4    104      473    0      457     1     0     1     1     0     8    0
amappl3     96     6345    0     6273     3     0     3     3     0     8    0
amappl2     88     1558    0     1490     2     0     2     2     0     8    0
amappl1     80    20934    0    20391    13     0    13    13     0     8    1
amappl      88    10096    0     9973     5     0     5     5     0    92    1
uvmvnodes   80      109    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       11    0        3     1     0     1     1     0     8    0
uaddrrnd    24     1723    0     1695     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1723    0     1695     1     0     1     1     0     8    0
vmmpekpl   168    14603    0    14559     3     0     3     3     0     8    0
vmmpepl    168   119819    0   118250   106     0   106   106     0   357   28
vmsppl     368     1722    0     1695     4     0     4     4     0     8    1
rwobjpl     40    35857    0    34919    17     0    17    17     0     8    4
pdppl      4096    3452    0     3390   148    80    68    82     0     8    6
pvpl        32   668531    0   660806   181     0   181   181     0   265   92
pmappl     216     1722    0     1695     3     0     3     3     0     8    1
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      741    0       84    19     0    19    19     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_get sys/net/rtable.c:260 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_getsource sys/net/rtable.c:410 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a sys/net/rtable.c:422
rt_ifa_del(ffff80000159b100,800100,ffff80000159b168,0) at rt_ifa_del+0x37b sys/net/route.c:1342
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f2800) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f2800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff8000015f2800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a805490) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a805550) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff980703c0898,7,fffff98007ffd820,ffff80002a766010) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff9806dfc0f10,ffff80002a766010) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff9806dfc0f10,ffff80002a766010) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a766010) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a766010,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a766010,ffff80002a8058b0,ffff80002a805800) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a8058b0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8058b0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73e4fb58c220, count: -18
ddb> machine ddbcpu 1
No such command
ddb> trace
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_get sys/net/rtable.c:260 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a rtable_getsource sys/net/rtable.c:410 [inline]
rtable_clearsource(0,ffff80000159b168) at rtable_clearsource+0x15a sys/net/rtable.c:422
rt_ifa_del(ffff80000159b100,800100,ffff80000159b168,0) at rt_ifa_del+0x37b sys/net/route.c:1342
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_remove_prefix sys/netinet/in.c:810 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 in_ifscrub sys/netinet/in.c:636 [inline]
in_purgeaddr(ffff80000159b100) at in_purgeaddr+0x129 sys/netinet/in.c:751
in_ifdetach(ffff8000015f2800) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff8000015f2800) at if_detach+0x322 sys/net/if.c:1311
tun_clone_destroy(ffff8000015f2800) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80002a805490) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a805550) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff980703c0898,7,fffff98007ffd820,ffff80002a766010) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff9806dfc0f10,ffff80002a766010) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff9806dfc0f10,ffff80002a766010) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff9806dfc0f10,ffff80002a766010) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a766010) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a766010,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a766010,ffff80002a8058b0,ffff80002a805800) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a8058b0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a8058b0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73e4fb58c220, count: -18

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/28 01:31 openbsd bdb10d7135aa e2fa417d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: rtable_clearsource
2026/08/22 23:55 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: rtable_clearsource
* Struck through repros no longer work on HEAD.