syzbot


uvm_fault: alltraps_kern_meltdown

Status: upstream: reported on 2025/08/10 20:55
Reported-by: syzbot+a3a7ecde40e4e2e41825@syzkaller.appspotmail.com
First crash: 196d, last: 45d

Sample crash report:
uvm_fault(0xfffffd806c4c15d8, 0x0, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff827b8638 cs 8 rflags 10207 cr2 0 cpl 0 rsp ffff80003c43ab30
gsbase 0xffff8000299ddff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff827b8638
Starting stack trace...
panic(ffffffff833e8951) at panic+464
kerntrap(ffff80003c43aa80) at kerntrap+779
alltraps_kern_meltdown() at alltraps_kern_meltdown+123
dt_ioctl_record_stop(ffff8000016ec000) at dt_ioctl_record_stop+264
dtclose(221e5f,81,2000,ffff80003bbf8d30) at dtclose+265
spec_close(ffff80003c43ac30) at spec_close+1126
VOP_CLOSE(fffffd805e69f538,81,fffffd80097fd2d8,ffff80003bbf8d30) at VOP_CLOSE+306
vn_closefile(fffffd805c3ff8f0,ffff80003bbf8d30) at vn_closefile+299
fdrop(fffffd805c3ff8f0,ffff80003bbf8d30) at fdrop+289
closef(fffffd805c3ff8f0,ffff80003bbf8d30) at closef+402
syscall(ffff80003c43ae90) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0x109c1ed5280, count: 245
End of stack trace.
WARNING: SPL NOT LOWERED ON TRAP EXIT 4 0
Stopped at      alltraps_kern_meltdown+184:     movl    %ebx,%gs:1672
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 417829   2884      0           0  0x4000000    0  syz-executor
*216588  68635      0      0x1000  0x4080000    1  syz-executor
alltraps_kern_meltdown() at alltraps_kern_meltdown+184
_copyin() at _copyin+91
ffs_write(ffff80003703c1a0) at ffs_write+1897
VOP_WRITE(fffffd805c76b550,ffff80003703c358,7,fffffd80097fd2d8) at VOP_WRITE+257
vn_write(fffffd8069a36ce0,ffff80003703c358,0) at vn_write+467
dofilewritev(ffff8000fffef4d8,4,ffff80003703c358,0,ffff80003703c410) at dofilewritev+578
sys_write(ffff8000fffef4d8,ffff80003703c4c0,ffff80003703c410) at sys_write+162
syscall(ffff80003703c4c0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xfa994f9fd70, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffffd806c4c15d8, 0x0, 0, 1) -> e
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+184
_copyin() at _copyin+91
ffs_write(ffff80003703c1a0) at ffs_write+1897
VOP_WRITE(fffffd805c76b550,ffff80003703c358,7,fffffd80097fd2d8) at VOP_WRITE+257
vn_write(fffffd8069a36ce0,ffff80003703c358,0) at vn_write+467
dofilewritev(ffff8000fffef4d8,4,ffff80003703c358,0,ffff80003703c410) at dofilewritev+578
sys_write(ffff8000fffef4d8,ffff80003703c4c0,ffff80003703c410) at sys_write+162
syscall(ffff80003703c4c0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xfa994f9fd70, count: -9
ddb{1}> show registers
rdi                                0
rsi                                0
rbp             18446603337144188896
rbx                                0
rdx             18446603336245285056
rcx             18446603340516095192
rax                               42
r8              18446603337144188688
r9                                 1
r10             10425252353588431283
r11              1324104841645973185
r12                   35184385901760
r13                            16384    __ALIGN_SIZE+12288
r14             18446603337144189784
r15                            16384    __ALIGN_SIZE+12288
rip             18446744071615660555    alltraps_kern_meltdown+184
cs                                 8
rflags                           582
rsp             18446603337144188768
ss                                16
alltraps_kern_meltdown+184:     movl    %ebx,%gs:1672
ddb{1}> show proc
PROC (syz-executor) tid=216588 pid=68635 tcnt=2 stat=onproc
    flags process=1000<SINGLEEXIT> proc=4080000<SUSPSINGLE,THREAD>
    runpri=80, usrpri=80, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff8000fffee2b0 scnt=1 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000fffee2b0,0xffff80003bbfbcc0
    process=0xffff800037041d18 user=0xffff800037037000, vmspace=0xfffffd807b74f3f8
    estcpu=30, cpticks=10, pctcpu=0.3, user=0, sys=9, intr=1
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 28658  226627  40676      0  2           0                syz-executor
 28658   50572  40676      0  3   0x4000000  sbar          syz-executor
 28658    5556  40676      0  3   0x4000080  fsleep        syz-executor
 28658  136881  40676      0  3   0x4000080  fsleep        syz-executor
   251  517771  69792      0  2    0x100002                sh
 73132   72639  76732      0  2           0                syz-executor
 73132  121701  76732      0  2   0x4000000                syz-executor
 73132  299705  76732      0  3   0x4000080  fsleep        syz-executor
 88148  162805  15511     -1  2       0xc90                syz-executor
 88148  228964  15511     -1  3   0x4000090  fsleep        syz-executor
 88148  271908  15511     -1  3   0x4000090  fsleep        syz-executor
 88148   70108  15511     -1  3   0x4000090  fsleep        syz-executor
  2884  135677   7242      0  2           0                syz-executor
  2884   21033   7242      0  3   0x4000080  lockf         syz-executor
  2884  417829   7242      0  7   0x4000000                syz-executor
  2884   49579   7242      0  3   0x4000080  fsleep        syz-executor
  2884  330153   7242      0  3   0x4000080  fsleep        syz-executor
 61348  348773   2276      0  3      0x3000  suspend       syz-executor
 61348  313769   2276      0  2   0x4081000                syz-executor
 68635   42686  27656      0  3      0x3000  suspend       syz-executor
*68635  216588  27656      0  7   0x4081000                syz-executor
 69792  366642  52210      0  3        0x82  wait          syz-executor
 49774  443193      0      0  3     0x14200  acct          acct
 79069  518140      1      0  2    0x100083                getty
 57803  144663  52210      0  2       0xc82                syz-executor
  7242  445235  52210      0  2       0xc82                syz-executor
  2276  441316  52210      0  2       0xc82                syz-executor
 15511  347896  52210      0  2       0xc82                syz-executor
 27656  387038  52210      0  3        0x82  wait          syz-executor
 40676  359061  52210      0  2       0xc82                syz-executor
 76732  523264  52210      0  2       0xc82                syz-executor
 52210  303416  51844      0  3        0x82  kqread        syz-executor
 51844  240556  86372      0  3    0x10008a  sigsusp       ksh
 86372  521140  81982      0  3        0x98  kqread        sshd-session
 81982  412856  71202      0  3        0x92  kqread        sshd-session
 71202  184775      1      0  3        0x88  kqread        sshd
  4953  405335  21089     74  3   0x1100092  bpf           pflogd
 21089  394411      1      0  3        0x80  sbwait        pflogd
  9575  307536  86601     73  3   0x1100090  kqread        syslogd
 86601  159811      1      0  3    0x100082  sbwait        syslogd
  9030  169192      1      0  3    0x100080  kqread        resolvd
 37890  387133  54388     77  3    0x100092  kqread        dhcpleased
 93984   67062  54388     77  3    0x100092  kqread        dhcpleased
 54388  372329      1      0  3        0x80  kqread        dhcpleased
 55802  309763      0      0  2  0x40014200                smr
 74479  316738      0      0  2     0x14200                zerothread
 22149  511999      0      0  3     0x14200  aiodoned      aiodoned
 42699  140972      0      0  3     0x14200  syncer        update
 40350  167289      0      0  3     0x14200  cleaner       cleaner
 23049  450905      0      0  3     0x14200  reaper        reaper
 69394  361912      0      0  3     0x14200  pgdaemon      pagedaemon
 51259  146206      0      0  3     0x14200  bored         viomb
 75967   55303      0      0  3  0x40014200  acpi0         acpi0
 51280  157567      0      0  3  0x40014200                idle1
 30794   43235      0      0  3     0x14200  bored         softnet1
 96533  146189      0      0  2     0x14200                softnet0
 71604   96600      0      0  2     0x14200                systqmp
 76363  115786      0      0  3     0x14200  bored         systq
 93786   92121      0      0  3     0x14200  netlock       softclockmp
 25631  316000      0      0  3  0x40014200  tmoslp        softclock
 96068  208831      0      0  3  0x40014200                idle0
     1  327205      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 28658 (syz-executor) thread 0xffff80003bbf8d30 (50572)
exclusive rwlock dtlk r = 0 (0xffffffff83868938)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  dt_ioctl_record_stop+46
#3  dtclose+265
#4  spec_close+1126
#5  VOP_CLOSE+306
#6  vn_closefile+299
#7  fdrop+289
#8  closef+402
#9  syscall+3028
#10 Xsyscall+296
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff839bac88)
#0  witness_lock+1521
#1  vn_closefile+65
#2  fdrop+289
#3  closef+402
#4  syscall+3028
#5  Xsyscall+296
Process 73132 (syz-executor) thread 0xffff80003bbfa558 (121701)
exclusive rrwlock inode r = 0 (0xfffffd806e8658c0)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  rrw_enter+198
#3  VOP_LOCK+189
#4  vn_lock+164
#5  vn_write+399
#6  dofilewritev+578
#7  sys_write+162
#8  syscall+3028
#9  Xsyscall+296
Process 2884 (syz-executor) thread 0xffff80003bbfa7f0 (417829)
exclusive rrwlock inode r = 0 (0xfffffd806e700478)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  rrw_enter+198
#3  VOP_LOCK+189
#4  vn_lock+164
#5  vn_write+399
#6  dofilewritev+578
#7  sys_write+162
#8  syscall+3028
#9  Xsyscall+296
Process 61348 (syz-executor) thread 0xffff80003bbfb4e8 (313769)
exclusive rrwlock inode r = 0 (0xfffffd806ea42810)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  rrw_enter+198
#3  VOP_LOCK+189
#4  vn_lock+164
#5  vn_write+399
#6  dofilewritev+578
#7  sys_write+162
#8  syscall+3028
#9  Xsyscall+296
Process 68635 (syz-executor) thread 0xffff8000fffef4d8 (216588)
exclusive rwlock vmmaplk r = 0 (0xfffffd807b74f4f8)
#0  witness_lock+1521
#1  rw_do_enter_read+1000
#2  uvmfault_lookup+290
#3  uvm_fault_check+79
#4  uvm_fault+262
#5  kpageflttrap+756
#6  kerntrap+412
#7  alltraps_kern_meltdown+123
#8  _copyin+91
#9  ffs_write+1897
#10 VOP_WRITE+257
#11 vn_write+467
#12 dofilewritev+578
#13 sys_write+162
#14 syscall+3028
#15 Xsyscall+296
exclusive rrwlock inode r = 0 (0xfffffd805eadbdb8)
#0  witness_lock+1521
#1  rw_do_enter_write+1049
#2  rrw_enter+198
#3  VOP_LOCK+189
#4  vn_lock+164
#5  vn_write+399
#6  dofilewritev+578
#7  sys_write+162
#8  syscall+3028
#9  Xsyscall+296
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11246  12802K   13526K 166960K     17776        0
            pcb    43     16K      32K 166960K      1264        0
         rtable   237     18K      18K 166960K      1349        0
             pf    38     18K      81K 166960K       451        0
         ifaddr    38      7K       9K 166960K       337        0
        ifgroup    56      2K       3K 166960K       598        0
         sysctl     4      1K       9K 166960K        38        0
       counters    76     37K      38K 166960K       850        0
       ioctlops     0      0K       4K 166960K      2839        0
            iov     0      0K      26K 166960K       348        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1576     99K     100K 166960K      5664        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      2K      10K 166960K        70        0
         VM map     2      1K       1K 166960K         2        0
            sem    23    137K     137K 166960K       184        0
        dirhash    12      2K       3K 166960K        99        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     244K 166960K      4724        0
          sigio     0      0K       0K 166960K       100        0
           proc    75    131K     164K 166960K      1557        0
        subproc    72      4K       4K 166960K       216        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       804        0
       in_multi    73      5K       7K 166960K       500        0
    ether_multi     1      0K       0K 166960K        65        0
            mrt     1      0K       0K 166960K        46        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   259   1155K    1155K 166960K       259        0
           exec     0      0K       1K 166960K      1637        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         8        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   291    162K     180K 166960K     44307        0
       UVM aobj    24     20K      22K 166960K        31        0
     pinsyscall    43     86K     103K 166960K      6291        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       422        0
            NDP    16      0K       2K 166960K       244        0
           temp    88   8680K    8936K 166960K    240169        0
         kqueue    14     22K      34K 166960K       888        0
      SYN cache     2      8K      16K 166960K         3        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      596    0      593     5     2     3     3     0     8    2
rtentry    176      400    0      321     6     0     6     6     0     8    0
unpcb      144     2925    0     2907    18    17     1     6     0     8    0
syncache   336       14    0       14     5     5     0     1     0     8    0
tcpqe       32        5    0        5     3     3     0     1     0     8    0
tcpcb      736     1648    0     1644    35    28     7     7     0     8    6
arp        136       59    0       45     1     0     1     1     0     8    0
inpcb      328     5582    0     5548    49    42     7    13     0     8    4
nd6        152       83    0       64     2     0     2     2     0     8    0
pkpcb       40       45    0       45     8     7     1     1     0     8    1
kcovpl      48       24    0       16     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1192     321    0      318     4     3     1     1     0     8    0
pppxif     1504      34    0       34     9     8     1     1     0     8    1
pffrag     232       73    0       69     1     0     1     1     0   482    0
pffrnode    88       21    0       17     1     0     1     1     0     8    0
pffrent     40      138    0      134     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       5    0        5     4     4     0     1     0     8    0
rttmr      136        6    0        6     5     5     0     1     0     8    0
art_heap8  4096       6    0        0     6     0     6     6     0     8    0
art_heap4  256     1843    0     1521    41    18    23    31     0     8    1
art_table   40     1849    0     1521     6     1     5     6     0     8    0
art_node    32      397    0      328     1     0     1     1     0     8    0
semupl     112        5    0        5     3     2     1     1     0     8    1
semapl     112      179    0      158     1     0     1     1     0     8    0
shmpl      112       13    0        1     1     0     1     1     0     8    0
dirhash    1024      76    0       59     3     0     3     3     0     8    0
dino2pl    256    10463    0     8916    97     0    97    97     0     8    0
ffsino     296    10463    0     8916   121     1   120   120     0     8    0
nchpl      144    16891    0    15135    66     0    66    66     0     8    0
rtmask      32       56    0       55     8     7     1     1     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   64549    0    64549     8     7     1     2     0     8    1
percpumem   16      440    0      387     1     0     1     1     0     8    0
vcpupl     3968      10    0        1     2     0     2     2     0     8    0
vmpool     848       15    0        6     2     1     1     2     0     8    0
kstatmem   264      394    0      362     7     4     3     3     0     8    0
acpiwqpl    32        3    0        3     1     0     1     1     1     8    1
scsiplug    72       28    0       28     8     7     1     1     0     8    1
scxspl     216   102704    0   102704    16    15     1     8     1     8    1
plimitpl   152     1921    0     1900     1     0     1     1     0     8    0
sigapl     424     5031    0     4982     9     2     7     8     0     8    0
knotepl    120      786    0        0    24     0    24    24     0     8    0
kqueuepl   224     1762    0     1752    19    18     1     5     0     8    0
pipepl     344      640    0      612     6     3     3     6     0     8    0
fdescpl    528     4965    0     4933     3     0     3     3     0     8    0
filepl     160    36284    0    35999    51    35    16    21     0     8    1
lockfpl    104     1756    0     1740     3     2     1     2     0     8    0
lockfspl    48      595    0      582     1     0     1     1     0     8    0
sessionpl  144       51    0       42     1     0     1     1     0     8    0
pgrppl      48      225    0      208     1     0     1     1     0     8    0
ucredpl    104     6140    0     6126     1     0     1     1     0     8    0
zombiepl   144     6031    0     6028     1     0     1     1     0     8    0
processpl  1232    5031    0     4982     8     3     5     6     0     8    0
procpl     664    12618    0    12555     8     1     7     8     0     8    0
sosppl     176       34    0       34    10     9     1     1     0     8    1
sockpl     752     9592    0     9537    74    62    12    18     0     8    6
mcl64k     65536      8    0        0     1     0     1     1     0     8    0
mcl16k     16384     13    0        0     2     0     2     2     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       6    0        0     1     0     1     1     0     8    0
mcl4k      4096     119    0        0    15     1    14    15     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048     106    0        0    11     0    11    11     0     8    0
mtagpl      96      150    0        0     4     0     4     4     0     8    0
mbufpl     256      809    0        0    48     0    48    48     0     8    0
bufpl      280    40667    0    34530   439     0   439   439     0     8    0
anonpl      32    15663    0        0   126     0   126   126     0   246    0
amapchunkpl 152  178432    0   177620    98    62    36    45     0   158    4
amappl16   200    15720    0    15271   125   100    25    32     0     8    0
amappl15   192       15    0       15     2     2     0     1     0     8    0
amappl14   184        7    0        7     1     1     0     1     0     8    0
amappl13   176      615    0      613     1     0     1     1     0     8    0
amappl12   168     5470    0     5427     3     0     3     3     0     8    0
amappl11   160        5    0        4     1     0     1     1     0     8    0
amappl10   152       50    0       36     1     0     1     1     0     8    0
amappl9    144      264    0      263     1     0     1     1     0     8    0
amappl8    136       31    0       28     1     0     1     1     0     8    0
amappl7    128      142    0      141     1     0     1     1     0     8    0
amappl6    120      490    0      473     1     0     1     1     0     8    0
amappl5    112       85    0       74     1     0     1     1     0     8    0
amappl4    104      563    0      533     1     0     1     1     0     8    0
amappl3     96    27526    0    27409     4     1     3     3     0     8    0
amappl2     88     5115    0     5035     2     0     2     2     0     8    0
amappl1     80    31776    0    31176    16     2    14    15     0     8    0
amappl      88    42459    0    42247     5     0     5     5     0    92    0
uvmvnodes   80      227    0        0     5     0     5     5     0     8    0
dma65536   65536      1    0        1     1     1     0     1     0     8    0
dma32768   32768      2    0        2     2     2     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       4    0        3     1     0     1     1     0     8    0
dma512     512        1    0        1     1     1     0     1     0     8    0
dma256     256       10    0       10     4     4     0     1     0     8    0
dma128     128      257    0      257     4     4     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32       73    0       73     3     3     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       30    0        7     1     0     1     1     0     8    0
uaddrrnd    24     4965    0     4933     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     4965    0     4933     1     0     1     1     0     8    0
vmmpekpl   168    35275    0    35201     5     1     4     4     0     8    0
vmmpepl    168   316417    0   313959   157    50   107   113     0   357    0
vmsppl     488     4964    0     4933     6     1     5     5     0     8    0
rwobjpl     80    79422    0    77741    46    11    35    36     0     8    0
pdppl      4096    9967    0     9887   146    64    82    85     0     8    2
pvpl        32    24001    0        0   193     1   192   192     0   265    0
pmappl     256     4979    0     4939     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      433    0      133     9     0     9     9     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+39:  addq    $8,%rsp
x86_ipi_db(ffffffff83883ff0) at x86_ipi_db+39
x86_ipi_handler() at x86_ipi_handler+217
Xresume_lapic_ipi() at Xresume_lapic_ipi+39
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+44
__mp_lock(ffffffff839baa80) at __mp_lock+419
softintr_dispatch(0) at softintr_dispatch+293
dosoftint(0) at dosoftint+84
Xsoftclock() at Xsoftclock+39
__mp_lock(ffffffff839baa80) at __mp_lock+402
__mp_acquire_count(ffffffff839baa80,1) at __mp_acquire_count+88
sleep_finish(ffffffffffffffff,1) at sleep_finish+728
biowait(fffffd806877d360) at biowait+198
bwrite(fffffd806877d360) at bwrite+743
ffs2_balloc(fffffd806e7003d8,2c4000,4000,fffffd80097fd2d8,2,ffff80003c40f0f8) at ffs2_balloc+6324
end trace frame: 0xffff80003c40f170, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff83883ff0) at x86_ipi_db+39
x86_ipi_handler() at x86_ipi_handler+217
Xresume_lapic_ipi() at Xresume_lapic_ipi+39
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+44
__mp_lock(ffffffff839baa80) at __mp_lock+419
softintr_dispatch(0) at softintr_dispatch+293
dosoftint(0) at dosoftint+84
Xsoftclock() at Xsoftclock+39
__mp_lock(ffffffff839baa80) at __mp_lock+402
__mp_acquire_count(ffffffff839baa80,1) at __mp_acquire_count+88
sleep_finish(ffffffffffffffff,1) at sleep_finish+728
biowait(fffffd806877d360) at biowait+198
bwrite(fffffd806877d360) at bwrite+743
ffs2_balloc(fffffd806e7003d8,2c4000,4000,fffffd80097fd2d8,2,ffff80003c40f0f8) at ffs2_balloc+6324
ffs_write(ffff80003c40f180) at ffs_write+1273
VOP_WRITE(fffffd806bb7cbf0,ffff80003c40f338,7,fffffd80097fd2d8) at VOP_WRITE+257
vn_write(fffffd806c54bc18,ffff80003c40f338,0) at vn_write+467
dofilewritev(ffff80003bbfa7f0,7,ffff80003c40f338,0,ffff80003c40f3f0) at dofilewritev+578
sys_write(ffff80003bbfa7f0,ffff80003c40f4a0,ffff80003c40f3f0) at sys_write+162
syscall(ffff80003c40f4a0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xadf47cbbb70, count: -21
ddb{0}> machine ddbcpu 1
Stopped at      alltraps_kern_meltdown+184:     movl    %ebx,%gs:1672
alltraps_kern_meltdown() at alltraps_kern_meltdown+184
_copyin() at _copyin+91
ffs_write(ffff80003703c1a0) at ffs_write+1897
VOP_WRITE(fffffd805c76b550,ffff80003703c358,7,fffffd80097fd2d8) at VOP_WRITE+257
vn_write(fffffd8069a36ce0,ffff80003703c358,0) at vn_write+467
dofilewritev(ffff8000fffef4d8,4,ffff80003703c358,0,ffff80003703c410) at dofilewritev+578
sys_write(ffff8000fffef4d8,ffff80003703c4c0,ffff80003703c410) at sys_write+162
syscall(ffff80003703c4c0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xfa994f9fd70, count: 6
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+184
_copyin() at _copyin+91
ffs_write(ffff80003703c1a0) at ffs_write+1897
VOP_WRITE(fffffd805c76b550,ffff80003703c358,7,fffffd80097fd2d8) at VOP_WRITE+257
vn_write(fffffd8069a36ce0,ffff80003703c358,0) at vn_write+467
dofilewritev(ffff8000fffef4d8,4,ffff80003703c358,0,ffff80003703c410) at dofilewritev+578
sys_write(ffff8000fffef4d8,ffff80003703c4c0,ffff80003703c410) at sys_write+162
syscall(ffff80003703c4c0) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xfa994f9fd70, count: -9

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/08 12:45 openbsd b9d9e3fc96bc c1f5c7d0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
2025/12/17 12:58 openbsd 3a6d4b98bde9 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: alltraps_kern_meltdown
2025/12/13 14:59 openbsd b6e97387bb5b a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: alltraps_kern_meltdown
2025/10/09 03:26 openbsd 42468faed836 7e2882b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
2025/08/10 20:54 openbsd 9abff0b24f7a 32a0e5ed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
* Struck through repros no longer work on HEAD.