uvm_fault: dt_ioctl_record_stop (4)

Status: upstream: reported on 2026/08/20 01:53
Reported-by: syzbot+aadb41330e2bc0e0af01@syzkaller.appspotmail.com
First crash: 51d, last: 5d17h
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: dt_ioctl_record_stop (2) -1 4591 200d 435d 3/4 fixed on 2026/03/24 12:14
openbsd uvm_fault: dt_ioctl_record_stop -1 1306 435d 552d 3/4 fixed on 2025/08/01 00:18
openbsd uvm_fault: dt_ioctl_record_stop (3) -1 32 134d 200d 0/4 auto-obsoleted due to no activity on 2026/07/18 14:20

Sample crash report:
uvm_fault(0xffffee006cfb6468, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      dt_ioctl_record_stop+0x108:     movq    0(%r14),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
dt_ioctl_record_stop(ffff80000159d780) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff800037cdb420) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(ffffee006666a648,81,ffffee0007ffd750,ffff80002a774548) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(ffffee006d191168,ffff80002a774548) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(ffffee006d191168,ffff80002a774548) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a774548) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a774548,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a774548,ffff800037cdb780,ffff800037cdb6d0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800037cdb780) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800037cdb780) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c12fb722020, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffee006cfb6468, 0x0, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
dt_ioctl_record_stop(ffff80000159d780) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff800037cdb420) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(ffffee006666a648,81,ffffee0007ffd750,ffff80002a774548) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(ffffee006d191168,ffff80002a774548) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(ffffee006d191168,ffff80002a774548) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a774548) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a774548,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a774548,ffff800037cdb780,ffff800037cdb6d0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800037cdb780) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800037cdb780) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c12fb722020, count: -12
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff800037cdb350
rbx                              0x1
rdx                                0
rcx               0xffff80002a774548
rax               0xffffffff8390d098    dt_prov_syscall
r8                                 0
r9                                 0
r10               0x1b254541e9a6ff72
r11               0xeaef5e651a7ec42d
r12                                0
r13                                0
r14                                0
r15               0xffff8000015a9400
rip               0xffffffff830795e8    dt_ioctl_record_stop+0x108
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff800037cdb320
ss                                 0
dt_ioctl_record_stop+0x108:     movq    0(%r14),%r14
ddb> show proc
PROC (syz-executor) tid=285676 pid=48980 tcnt=0 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    runpri=32, usrpri=74, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80002a774548 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80002a7742b0,0xffff80002a775a18
    process=0xffff80003a4ca8e0 user=0xffff800037cd6000, vmspace=0xffffee006cfb6468
    estcpu=24, cpticks=4, pctcpu=0.4, user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 12240  155820  83227     0  2           0          0           syz-executor
 12240  224839  83227     0  2           0  0x4000000           syz-executor
 12240  480274  83227     0  2           0  0x4000000           syz-executor
 70820  194576  36651     0  2           0          0           syz-executor
 70820   15721  36651     0  3           0  0x4000080 fsleep    syz-executor
 36551  327895  50609     0  2           0          0           syz-executor
 36551  274954  50609     0  2           0  0x4000000           syz-executor
 90475  253317  79095     0  2           0          0           syz-executor
 90475  410563  79095     0  3           0  0x4000080 fsleep    syz-executor
 90475   25112  79095     0  2           0  0x4000000           syz-executor
 83227  300662  87489     0  3         0x2       0x80 nanoslp   syz-executor
 36651  122021  87489     0  3         0x2       0x80 nanoslp   syz-executor
 12290   69321  87489     0  3         0x2       0x80 nanoslp   syz-executor
 50609  176489  87489     0  3         0x2       0x80 nanoslp   syz-executor
 79095   32594  87489     0  3         0x2       0x80 nanoslp   syz-executor
 26063  153605  87489     0  3         0x2       0x80 nanoslp   syz-executor
 61912   52192  87489     0  2         0x2          0           syz-executor
 87489  243806  13282     0  3         0x2       0x80 wait      syz-executor
 13282  174707  92055     0  3    0x100002       0x88 sigsusp   ksh
 92055   30805  24378     0  3        0x10       0x88 kqread    sshd-session
 24378  404132  55313     0  3        0x12       0x80 kqread    sshd-session
 52152   35891      1     0  3    0x100003       0x80 ttyin     getty
 55313   13548      1     0  3           0       0x88 kqread    sshd
 99626  277566  32076    73  2   0x1100010          0           syslogd
 32076  481516      1     0  3    0x100002       0x80 sbwait    syslogd
 43065  120196      1     0  3    0x100000       0x80 kqread    resolvd
  4632  111453  51611    77  3    0x100012       0x80 kqread    dhcpleased
 21350  484237  51611    77  3    0x100012       0x80 kqread    dhcpleased
 51611  118810      1     0  3           0       0x80 kqread    dhcpleased
 26685  300357      0     0  3     0x14000      0x200 bored     smr
 45622  231750      0     0  2     0x14000      0x200           zerothread
 43948  329575      0     0  3     0x14000      0x200 aiodoned  aiodoned
 23397  107473      0     0  3     0x14000      0x200 syncer    update
 81764  479182      0     0  3     0x14000      0x200 cleaner   cleaner
 46808  147367      0     0  2     0x14000      0x200           reaper
 46718  471149      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 96965  150089      0     0  3     0x14000      0x200 bored     viomb
 42368  102832      0     0  3     0x14000 0x40000200 acpi0     acpi0
 56437  358154      0     0  3     0x14000      0x200 bored     softnet0
 67624  302472      0     0  3     0x14000      0x200 bored     systqmp
 41904  371511      0     0  3     0x14000      0x200 bored     systq
 80394   96244      0     0  3     0x14000 0x40000200 tmoslp    softclock
 95369   16670      0     0  3     0x14000 0x40000200           idle0
     1  111436      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11038  12128K   12151K 166960K     12184        0
            pcb    18     14K      15K 166960K        44        0
         rtable   248      7K       8K 166960K       469        0
             pf    31     13K      17K 166960K        48        0
         ifaddr    42      7K       7K 166960K        57        0
        ifgroup    50      2K       2K 166960K        64        0
         sysctl     3      1K       9K 166960K         9        0
       counters    33     17K      18K 166960K        39        0
       ioctlops     0      0K       4K 166960K        49        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1295     82K      82K 166960K      1448        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         6        0
         VM map     2      1K       1K 166960K         2        0
            sem     8      0K       0K 166960K        72        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      89K 166960K       257        0
          sigio     0      0K       0K 166960K         2        0
           proc    61     59K      91K 166960K       590        0
        subproc    72      4K       4K 166960K        99        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         7        0
       in_multi    99      6K       6K 166960K       132        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K        13        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    55    254K     254K 166960K        55        0
           exec     0      0K       1K 166960K       407        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   216    151K     160K 166960K      3955        0
       UVM aobj     6      2K       4K 166960K        10        0
     pinsyscall    38     76K      93K 166960K      1425        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    11      0K       2K 166960K        37        0
           temp    37   9110K    9170K 166960K      4233        0
         kqueue    13     20K      26K 166960K        42        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       47    0       44     1     0     1     1     0     8    0
rtentry    136      146    0       35     4     0     4     4     0     8    0
unpcb      144      209    0      190     6     0     6     6     0     8    5
syncache   336        5    0        5     2     1     1     1     0     8    1
tcpcb      736       26    0       21     1     0     1     1     0     8    0
arp         96       24    0        6     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        1    0        0     1     0     1     1     0     8    0
inpcb      328      220    0      211     7     0     7     7     0     8    6
nd6        112       34    0        9     1     0     1     1     0     8    0
kcovpl      48       11    0        3     1     0     1     1     0     8    0
ppxss      1072       3    0        3     1     0     1     1     0     8    1
pfrktable  1344       3    0        3     1     0     1     1     0     8    1
pfstlim    224        1    0        0     1     0     1     1     0     8    0
pfanchor   1288       2    0        2     1     0     1     1     0     8    1
pftag       88        3    0        2     1     0     1     1     0     8    0
pfrule     1360       3    0        2     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      591    0      132    29     0    29    29     0     8    0
art_table   40      592    0      132     5     0     5     5     0     8    0
art_node    32      145    0       44     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semapl      72       70    0       64     1     0     1     1     0     8    0
shmpl      120        5    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1725    0      257    93     0    93    93     0     8    1
ffsino     256     1725    0      257    93     0    93    93     0     8    1
nchpl      144     2026    0      321    64     0    64    64     0     8    0
rtmask      32        1    0        1     1     0     1     1     0     8    1
vnodes     216     1862    0        0   104     0   104   104     0     8    0
namei      1024    7695    0     7695     6     3     3     3     0     8    3
vcpupl     3968      32    0       32     2     0     2     2     0     8    2
vmpool     808        2    0        2     1     0     1     1     0     8    1
pfiaddrpl  120        1    0        1     1     0     1     1     0     8    1
kstatmem   264       31    0        8     2     0     2     2     0     8    0
scxspl     216     6607    0     6607     5     3     2     4     1     8    2
plimitpl   152       42    0       26     1     0     1     1     0     8    0
sigapl     424      543    0      501     6     1     5     6     0     8    0
knotepl    120     5345    0     5297    10     0    10    10     0     8    7
kqueuepl   184       49    0       39     1     0     1     1     0     8    0
pipepl     304      130    0      103     3     0     3     3     0     8    0
fdescpl    448      530    0      501     5     1     4     5     0     8    0
filepl     120     2197    0     1980    11     0    11    11     0     8    4
lockfpl    104       28    0       26     1     0     1     1     0     8    0
lockfspl    48       13    0       11     1     0     1     1     0     8    0
sessionpl  144       29    0       21     1     0     1     1     0     8    0
pgrppl      48       41    0       25     1     0     1     1     0     8    0
ucredpl    104      174    0      163     1     0     1     1     0     8    0
zombiepl   144      567    0      564     2     1     1     1     0     8    0
processpl  1160     543    0      501     4     0     4     4     0     8    0
procpl     664      692    0      642     6     0     6     6     0     8    1
sockpl     552      479    0      448    13     3    10    12     0     8    7
mcl64k     65536      3    0        3     1     0     1     1     0     8    1
mcl8k      8192       4    0        4     1     1     0     1     0     8    0
mcl4k      4096    2589    0     2535    14     6     8    14     0     8    1
mcl2k      2048     235    0      235     3     1     2     2     0     8    2
mextrefs    64       93    0       93     2     1     1     1     0     8    1
mtagpl      96        6    0        6     2     1     1     1     0     8    1
mbufpl     256     5236    0     5071    16     0    16    16     0     8    3
bufpl      272     2340    0      102   152     2   150   150     0     8    0
anonpl      24    94796    0    91726    35     2    33    33     0   187   11
amapchunkpl 152   11329    0    10864    25     0    25    25     0   158    3
amappl16   200     1273    0     1253     6     3     3     4     0     8    1
amappl15   192        2    0        2     1     1     0     1     0     8    0
amappl14   184      445    0      444     1     0     1     1     0     8    0
amappl13   176      122    0      112     1     0     1     1     0     8    0
amappl12   168      774    0      747     2     0     2     2     0     8    0
amappl11   160       17    0       17     1     1     0     1     0     8    0
amappl10   152       57    0       47     1     0     1     1     0     8    0
amappl9    144      272    0      272     1     1     0     1     0     8    0
amappl8    136      123    0      122     1     0     1     1     0     8    0
amappl7    128      143    0      132     1     0     1     1     0     8    0
amappl6    120      180    0      179     1     0     1     1     0     8    0
amappl5    112       90    0       82     1     0     1     1     0     8    0
amappl4    104      267    0      251     1     0     1     1     0     8    0
amappl3     96     1906    0     1816     3     0     3     3     0     8    0
amappl2     88      626    0      561     2     0     2     2     0     8    0
amappl1     80    10850    0    10302    13     0    13    13     0     8    1
amappl      88     3217    0     3063     4     0     4     4     0    92    0
uvmvnodes   80      102    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72        9    0        4     1     0     1     1     0     8    0
uaddrrnd    24      529    0      501     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      529    0      501     1     0     1     1     0     8    0
vmmpekpl   168     6141    0     6099     3     0     3     3     0     8    0
vmmpepl    168    42797    0    41074    82     0    82    82     0   357    2
vmsppl     368      529    0      501     4     1     3     4     0     8    0
rwobjpl     40    15070    0    14136    12     1    11    11     0     8    1
pdppl      4096    1069    0     1006    94    26    68    78     0     8    5
pvpl        32   242179    0   233994    94     0    94    94     0   265   19
pmappl     216      531    0      503     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      523    0       44    14     0    14    14     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
dt_ioctl_record_stop(ffff80000159d780) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff800037cdb420) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(ffffee006666a648,81,ffffee0007ffd750,ffff80002a774548) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(ffffee006d191168,ffff80002a774548) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(ffffee006d191168,ffff80002a774548) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a774548) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a774548,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a774548,ffff800037cdb780,ffff800037cdb6d0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800037cdb780) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800037cdb780) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c12fb722020, count: -12
ddb> machine ddbcpu 1
No such command
ddb> trace
dt_ioctl_record_stop(ffff80000159d780) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80002a774548) at dtclose+0xd9 sys/dev/dt/dt_dev.c:239
spec_close(ffff800037cdb420) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(ffffee006666a648,81,ffffee0007ffd750,ffff80002a774548) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffffee006d191168,ffff80002a774548) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(ffffee006d191168,ffff80002a774548) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(ffffee006d191168,ffff80002a774548) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a774548) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002a774548,0,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a774548,ffff800037cdb780,ffff800037cdb6d0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800037cdb780) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff800037cdb780) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c12fb722020, count: -12

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 23:45 openbsd d38c249ab133 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/08/21 10:37 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/08/20 01:52 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan e6ac069a7f53 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan uvm_fault: dt_ioctl_record_stop
* Struck through repros no longer work on HEAD.