uvm_fault: dt_ioctl_record_stop (4)

Status: upstream: reported on 2026/08/20 01:53
Reported-by: syzbot+aadb41330e2bc0e0af01@syzkaller.appspotmail.com
First crash: 2d05h, last: 20h34m
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: dt_ioctl_record_stop (2) -1 4591 150d 386d 3/4 fixed on 2026/03/24 12:14
openbsd uvm_fault: dt_ioctl_record_stop -1 1306 386d 503d 3/4 fixed on 2025/08/01 00:18
openbsd uvm_fault: dt_ioctl_record_stop (3) -1 32 84d 150d 0/4 auto-obsoleted due to no activity on 2026/07/18 14:20

Sample crash report:
login: uvm_fault(0xfffff1007f22e730, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      dt_ioctl_record_stop+0x108:     movq    0(%r14),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
dt_ioctl_record_stop(ffff800001649b00) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,1,2000,ffff80002a7374c8) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff80002a7374c8) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff80002a7893a0) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff10070646d98,1,fffff10007ffd5b0,ffff80002a7374c8) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff1007f160878,ffff80002a7374c8) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff1007f160878,ffff80002a7374c8) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff1007f160878,ffff80002a7374c8) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff1007f160878,ffff80002a7374c8) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a7374c8) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a7374c8,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a7374c8,ffff80002a789700,ffff80002a789650) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a789700) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a789700) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78e9fdba53d0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffff1007f22e730, 0x0, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
dt_ioctl_record_stop(ffff800001649b00) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,1,2000,ffff80002a7374c8) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff80002a7374c8) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff80002a7893a0) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff10070646d98,1,fffff10007ffd5b0,ffff80002a7374c8) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff1007f160878,ffff80002a7374c8) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff1007f160878,ffff80002a7374c8) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff1007f160878,ffff80002a7374c8) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff1007f160878,ffff80002a7374c8) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a7374c8) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a7374c8,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a7374c8,ffff80002a789700,ffff80002a789650) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a789700) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a789700) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78e9fdba53d0, count: -12
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a7892d0
rbx                              0x1
rdx                                0
rcx               0xffff80002a7374c8
rax               0xffffffff8396b8d0    dt_prov_static
r8                                 0
r9                                 0
r10               0x56e86899cd8601dd
r11               0xa5002ecf0b62999a
r12                                0
r13                                0
r14                                0
r15               0xffff80000166fb00
rip               0xffffffff81046ee8    dt_ioctl_record_stop+0x108
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff80002a7892a0
ss                              0x10
dt_ioctl_record_stop+0x108:     movq    0(%r14),%r14
ddb> show proc
PROC (syz-executor) tid=394252 pid=58758 tcnt=0 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80002a7374c8 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80002a77c2b8,0xffff80002a778a80
    process=0xffff800045ffad18 user=0xffff80002a784000, vmspace=0xfffff1007f22e730
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 55268  189922  48755     0  3           0       0x80 fsleep    syz-executor
 55268  171212  48755     0  3           0  0x4000000 biowait   syz-executor
 13796  225050  23422     0  3           0       0x80 fsleep    syz-executor
 13796  313171  23422     0  3           0  0x4000000 smrbar    syz-executor
 13796   45632  23422     0  3           0  0x4000080 fsleep    syz-executor
 90138  513490  32644     0  3           0       0x80 fsleep    syz-executor
 90138   78689  32644     0  3           0  0x4000080 lockf     syz-executor
 48964  363856  49421     0  3        0x10       0x80 fsleep    syz-executor
 48964  354069  49421     0  3        0x10  0x4000080 ttyopn    syz-executor
 76320  493222  30018     0  3           0       0x80 fsleep    syz-executor
 76320   42748  30018     0  3           0  0x4000080 rest      syz-executor
 20638  452022      1     0  3    0x100003       0x80 ttyin     getty
 30018  328157  93204     0  3         0x2       0x80 nanoslp   syz-executor
 18552  496632  93204     0  3         0x2       0x80 nanoslp   syz-executor
 66541  289243  93204     0  3         0x2       0x80 wait      syz-executor
 23422  131733  93204     0  3         0x2       0x80 nanoslp   syz-executor
 48755  161723  93204     0  3         0x2       0x80 nanoslp   syz-executor
 49421  353380  93204     0  3         0x2       0x80 nanoslp   syz-executor
 32644  382188  93204     0  3         0x2       0x80 nanoslp   syz-executor
 83390  216269  93204     0  2         0x2        0x1           syz-executor
 93204   53272      1     0  3         0x2       0x80 kqread    syz-executor
 66578  378918      0     0  3     0x14000      0x200 bored     smr
 57488  166344      0     0  2     0x14000      0x200           zerothread
 65518  495514      0     0  3     0x14000      0x200 aiodoned  aiodoned
 99584  173726      0     0  3     0x14000      0x200 syncer    update
 10046   74311      0     0  3     0x14000      0x200 cleaner   cleaner
 70211  225572      0     0  2     0x14000      0x200           reaper
 88757  215864      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
  9730  343960      0     0  3     0x14000      0x200 bored     viomb
 86284  470469      0     0  3     0x14000 0x40000200 acpi0     acpi0
 95288  215663      0     0  3     0x14000      0x200 bored     softnet0
 39748   95218      0     0  3     0x14000      0x200 smrbar    systqmp
 57768  329795      0     0  3     0x14000      0x200 bored     systq
 27408  132879      0     0  3     0x14000 0x40000200 tmoslp    softclock
 25956   35466      0     0  3     0x14000 0x40000200           idle0
     1  381870      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11055  12272K   13218K 166960K     12667        0
            pcb    21     13K      14K 166960K       108        0
         rtable   232      7K       7K 166960K       392        0
             pf    33     13K      17K 166960K        59        0
         ifaddr    42      7K       7K 166960K        57        0
        ifgroup    54      2K       2K 166960K        74        0
         sysctl     2      1K       9K 166960K         6        0
       counters    34     17K      18K 166960K        42        0
       ioctlops     0      0K       4K 166960K       100        0
            iov     0      0K      16K 166960K        14        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1426     90K      90K 166960K      1626        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K       5K 166960K         6        0
         VM map     2      1K       1K 166960K         2        0
            sem    13      2K       2K 166960K        15        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     61K      97K 166960K       305        0
          sigio     0      0K       0K 166960K         5        0
           proc    20     25K     124K 166960K       540        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        10        0
       in_multi    88      5K       6K 166960K       103        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     2      0K       0K 166960K        15        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    97    440K     440K 166960K        97        0
           exec     0      0K       1K 166960K       387        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   135     82K     175K 166960K      4359        0
       UVM aobj     7      2K       2K 166960K         8        0
     pinsyscall    19     38K      96K 166960K      1413        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         9        0
            NDP    12      0K       2K 166960K        35        0
           temp    37   9106K    9170K 166960K      7990        0
         kqueue     1      2K      26K 166960K        68        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> 

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/21 10:37 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/08/20 01:52 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan e6ac069a7f53 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan uvm_fault: dt_ioctl_record_stop
* Struck through repros no longer work on HEAD.