syzbot


protection_fault: __x86_indirect_thunk_r11 (5)

Status: upstream: reported on 2026/06/01 11:48
Reported-by: syzbot+a744ddf81e1436efdab0@syzkaller.appspotmail.com
First crash: 5d18h, last: 5d18h
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: __x86_indirect_thunk_r11 (2) -1 15 740d 822d 0/3 auto-obsoleted due to no activity on 2024/08/17 10:13
openbsd protection_fault: __x86_indirect_thunk_r11 (4) -1 4 350d 403d 0/3 auto-obsoleted due to no activity on 2025/09/19 11:51
openbsd protection_fault: __x86_indirect_thunk_r11 (3) -1 9 605d 657d 0/3 auto-obsoleted due to no activity on 2025/01/07 17:39
openbsd protection_fault: __x86_indirect_thunk_r11 -1 1 950d 950d 0/3 auto-obsoleted due to no activity on 2024/01/28 10:43

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      __x86_indirect_thunk_r11+0x14:  ret
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
spec_write(ffff80002a789450) at spec_write+0x116 sys/kern/spec_vnops.c:302
VOP_WRITE(fffffd8074ba7db8,ffff80002a789680,11,fffffd8007ffdd00) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd807ceb8358,ffff80002a789680,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414
dofilewritev(ffff80002a737c90,b,ffff80002a789680,0,ffff80002a789730) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_writev(ffff80002a737c90,ffff80002a7897e0,ffff80002a789730) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a7897e0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7897e0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x727540415a50, count: -8
ddb> show registers
rdi               0xffff8000015e5800
rsi               0xfffffd806d6d7400
rbp               0xffff80002a7893a0
rbx                          0xbec00    acpi_pdirpa+0xaaa71
rdx               0xffff80002a789240
rcx                                0
rax                                0
r8                    0x7f7fffffc000
r9                                 0
r10               0xf57bcb93fa921bce
r11                  0xadf39000f97f9
r12               0xffff8000015e5800
r13               0xfffffd806d6d7400
r14               0xffff80000166c400
r15               0xffff80000166c4a0
rip               0xffffffff82285304    __x86_indirect_thunk_r11+0x14
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a789230
ss                              0x10
__x86_indirect_thunk_r11+0x14:  ret
ddb> show proc
PROC (dhcpleased) tid=362235 pid=88628 tcnt=1 stat=onproc
    flags process=100012<EXEC,SUGID,PLEDGE> proc=0
    runpri=0, usrpri=50, slppri=0, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a7374c8,0xffff80002a778fb0
    process=0xffff80002a745688 user=0xffff80002a784000, vmspace=0xfffffd807ec60170
    estcpu=0, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 97660  344079  34524      0  2           0                syz-executor
 97660  203367  34524      0  3   0x4000080  fsleep        syz-executor
 58759  375182   5503      0  2           0                syz-executor
 58759  196763   5503      0  3   0x4000080  fsleep        syz-executor
  7252   28417  83581      0  2           0                syz-executor
 49505  184514      0      0  3     0x14280  nfsidl        nfsio
 11597  157711      0      0  3     0x14280  nfsidl        nfsio
 14977  474604      0      0  3     0x14280  nfsidl        nfsio
 44118  306166      0      0  3     0x14280  nfsidl        nfsio
  9009  507318      0      0  3     0x14280  nfsidl        nfsio
 78732   44074      0      0  3     0x14280  nfsidl        nfsio
 94526  414064      0      0  3     0x14280  nfsidl        nfsio
 74384  522430      0      0  3     0x14280  nfsidl        nfsio
 53659  365949      0      0  3     0x14280  nfsidl        nfsio
 92220   13849      0      0  3     0x14280  nfsidl        nfsio
 87814  183370      0      0  3     0x14280  nfsidl        nfsio
 41459  342116      0      0  3     0x14280  nfsidl        nfsio
 98738  304397      0      0  3     0x14280  nfsidl        nfsio
 32600  505615      0      0  3     0x14280  nfsidl        nfsio
 46449  506899      0      0  3     0x14280  nfsidl        nfsio
 56203  402717      0      0  3     0x14280  nfsidl        nfsio
 13181  294104      0      0  3     0x14280  nfsidl        nfsio
 39773  469017      0      0  3     0x14280  nfsidl        nfsio
 85385  126577      0      0  3     0x14280  nfsidl        nfsio
 86723  286821      0      0  3     0x14280  nfsidl        nfsio
 34524  317292  14942      0  2       0xc82                syz-executor
  5503  354496  14942      0  3        0x82  nanoslp       syz-executor
 83581   53078  14942      0  3        0x82  nanoslp       syz-executor
 14942  434557  68952      0  3        0x82  nanoslp       syz-executor
 68952   77244  92542      0  3    0x10008a  sigsusp       ksh
 92542  198984  10070      0  3        0x98  kqread        sshd-session
 10070  202233   7626      0  3        0x92  kqread        sshd-session
 70685  359312      1      0  3    0x100083  ttyin         getty
  7626  463220      1      0  3        0x88  kqread        sshd
  1018   49888  27945     73  3   0x1100090  kqread        syslogd
 27945   96073      1      0  3    0x100082  sbwait        syslogd
 55346    3416      1      0  3    0x100080  kqread        resolvd
*88628  362235   1981     77  7    0x100012                dhcpleased
 85609   25414   1981     77  3    0x100092  kqread        dhcpleased
  1981  376716      1      0  3        0x80  kqread        dhcpleased
 78361  491958      0      0  3     0x14200  bored         smr
 91456  341911      0      0  2     0x14200                zerothread
 37536  253174      0      0  3     0x14200  aiodoned      aiodoned
 79510  136679      0      0  3     0x14200  syncer        update
 15313  202602      0      0  3     0x14200  cleaner       cleaner
 55713  453436      0      0  3     0x14200  reaper        reaper
 76863  206276      0      0  3     0x14200  pgdaemon      pagedaemon
  1378  381555      0      0  3     0x14200  bored         viomb
 27870  292646      0      0  3  0x40014200  acpi0         acpi0
 36498  374453      0      0  2     0x14200                softnet0
 73861   16083      0      0  3     0x14200  bored         systqmp
 87692   43559      0      0  3     0x14200  bored         systq
 89701  276397      0      0  2  0x40014200                softclock
 87040   48074      0      0  3  0x40014200                idle0
     1    2548      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11031  12099K   12458K 166960K     12294        0
            pcb    20     12K      12K 166960K        67        0
         rtable   131     11K      14K 166960K       403        0
             pf    25     12K      19K 166960K        66        0
         ifaddr    22      3K       8K 166960K        55        0
        ifgroup    34      1K       2K 166960K        80        0
         sysctl     3      1K       9K 166960K         7        0
       counters    29     17K      18K 166960K        40        0
       ioctlops     0      0K       4K 166960K       190        0
            iov     0      0K      12K 166960K         9        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1331     84K      84K 166960K      1745        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        18        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc     9     29K      81K 166960K       417        0
          sigio     0      0K       0K 166960K       105        0
           proc    60     59K      83K 166960K       515        0
        subproc    36      2K       5K 166960K       180        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        20        0
       in_multi    43      3K       7K 166960K       105        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K        16        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    61    281K     281K 166960K        61        0
           exec     0      0K       1K 166960K       414        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   151    116K     169K 166960K      5280        0
       UVM aobj    12      2K       2K 166960K        13        0
     pinsyscall    30     60K      89K 166960K      1559        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         8        0
            NDP     7      0K       2K 166960K        35        0
           temp    24   9102K    9166K 166960K     14642        0
         kqueue    14     22K      26K 166960K        62        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       52    0       49     1     0     1     1     0     8    0
rtentry    136      121    0       70     4     0     4     4     0     8    1
unpcb      144      255    0      239     4     0     4     4     0     8    3
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      736       96    0       92     4     0     4     4     0     8    3
arp         96       20    0       14     1     0     1     1     0     8    0
ipq         40        1    0        1     1     0     1     1     0     8    1
ipqe        40        3    0        3     1     0     1     1     0     8    1
inpcb      328      321    0      311     7     0     7     7     0     8    6
nd6        112       26    0       17     1     0     1     1     0     8    0
pkpcb       40       66    0       66     1     0     1     1     0     8    1
kcovpl      48       20    0       16     1     0     1     1     0     8    0
ppxss      1072       1    0        1     1     0     1     1     0     8    1
pfstscr     40       71    0        0     1     0     1     1     0     8    0
pfstitem    24       72    0       64     1     0     1     1     0     8    0
pfstkey    128       72    0       32     2     0     2     2     0     8    0
pfstate    384       36    0        0     4     0     4     4     0     8    0
pfrule     1360       2    0        2     1     0     1     1     0     8    1
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      496    0      268    30     3    27    30     0     8    8
art_table   40      497    0      268     5     0     5     5     0     8    0
art_node    32      121    0       75     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl      72       15    0        5     1     0     1     1     0     8    0
shmpl      112       10    0        1     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     2069    0      605    92     0    92    92     0     8    0
ffsino     256     2087    0      623    92     0    92    92     0     8    0
nchpl      144     2591    0      888    64     0    64    64     0     8    0
vnodes     216     2398    0        0   134     0   134   134     0     8    0
namei      1024    8290    0     8290     1     0     1     1     0     8    1
kstatmem   264       37    0       22     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     0     1     1     0     8    1
scxspl     216    10421    0    10421     3     0     3     3     1     8    3
plimitpl   152       88    0       73     1     0     1     1     0     8    0
sigapl     424      711    0      654     8     0     8     8     0     8    1
knotepl    120    11969    0    11691    10     0    10    10     0     8    1
kqueuepl   184      109    0       99     3     0     3     3     0     8    2
pipepl     304      290    0      263     8     0     8     8     0     8    4
fdescpl    448      678    0      657     4     0     4     4     0     8    1
filepl     120     3953    0     3796    11     0    11    11     0     8    3
lockfpl    104      165    0      163     1     0     1     1     0     8    0
lockfspl    48       42    0       40     1     0     1     1     0     8    0
sessionpl  144       47    0       39     1     0     1     1     0     8    0
pgrppl      48       85    0       70     1     0     1     1     0     8    0
ucredpl    104      659    0      648     1     0     1     1     0     8    0
zombiepl   144      658    0      654     1     0     1     1     0     8    0
processpl  1152     711    0      654     5     0     5     5     0     8    0
procpl     664     1060    0     1001     7     0     7     7     0     8    1
sockpl     552      699    0      670     7     0     7     7     0     8    4
mcl64k     65536     15    0       15     1     0     1     1     0     8    1
mcl8k      8192      13    0       13     1     0     1     1     0     8    1
mcl4k      4096    2810    0     2754    14     0    14    14     0     8    5
mcl2k      2048     263  239      262     1     0     1     1     0     8    0
mtagpl      96       12    0       10     1     0     1     1     0     8    0
mbufpl     256     7061    0     6941    14     0    14    14     0     8    2
bufpl      280     3977    0      105   277     0   277   277     0     8    0
anonpl      24   112988    0   110476    45     0    45    45     0   186   17
amapchunkpl 152   15798    0    15531    29     0    29    29     0   158   15
amappl16   200     1667    0     1652    14     4    10    14     0     8    8
amappl15   192        5    0        5     1     0     1     1     0     8    1
amappl14   184      415    0      414     1     0     1     1     0     8    0
amappl13   176      113    0      103     1     0     1     1     0     8    0
amappl12   168      945    0      926     2     0     2     2     0     8    0
amappl11   160        7    0        7     1     0     1     1     0     8    1
amappl10   152      103    0       92     1     0     1     1     0     8    0
amappl9    144      274    0      274     1     0     1     1     0     8    1
amappl8    136      110    0      109     1     0     1     1     0     8    0
amappl7    128      141    0      130     1     0     1     1     0     8    0
amappl6    120      172    0      171     1     0     1     1     0     8    0
amappl5    112       93    0       86     1     0     1     1     0     8    0
amappl4    104      265    0      249     1     0     1     1     0     8    0
amappl3     96     3038    0     2973     3     0     3     3     0     8    0
amappl2     88      534    0      479     2     0     2     2     0     8    0
amappl1     80    11420    0    10916    12     0    12    12     0     8    0
amappl      88     4521    0     4428     4     0     4     4     0    92    0
uvmvnodes   80      102    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       12    0        1     1     0     1     1     0     8    0
uaddrrnd    24      678    0      657     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      678    0      657     1     0     1     1     0     8    0
vmmpekpl   168     7843    0     7809     2     0     2     2     0     8    0
vmmpepl    168    51764    0    50380    89     0    89    89     0   357   16
vmsppl     368      677    0      657     4     0     4     4     0     8    1
rwobjpl     40    16816    0    15993    13     0    13    13     0     8    2
pdppl      4096    1362    0     1314    88    34    54    74     0     8    6
pvpl        32   308478    0   301633   119     0   119   119     0   265   39
pmappl     216      677    0      657     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      355    0       37    10     0    10    10     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
spec_write(ffff80002a789450) at spec_write+0x116 sys/kern/spec_vnops.c:302
VOP_WRITE(fffffd8074ba7db8,ffff80002a789680,11,fffffd8007ffdd00) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd807ceb8358,ffff80002a789680,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414
dofilewritev(ffff80002a737c90,b,ffff80002a789680,0,ffff80002a789730) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_writev(ffff80002a737c90,ffff80002a7897e0,ffff80002a789730) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a7897e0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7897e0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x727540415a50, count: -8
ddb> machine ddbcpu 1
No such command
ddb> trace
__x86_indirect_thunk_r11() at __x86_indirect_thunk_r11+0x14
spec_write(ffff80002a789450) at spec_write+0x116 sys/kern/spec_vnops.c:302
VOP_WRITE(fffffd8074ba7db8,ffff80002a789680,11,fffffd8007ffdd00) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd807ceb8358,ffff80002a789680,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414
dofilewritev(ffff80002a737c90,b,ffff80002a789680,0,ffff80002a789730) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_writev(ffff80002a737c90,ffff80002a7897e0,ffff80002a789730) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a7897e0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7897e0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x727540415a50, count: -8

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/01 11:48 openbsd bddfd4c1ae9e cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: __x86_indirect_thunk_r11
* Struck through repros no longer work on HEAD.