panic: Caught invalid memory access at ffff8000018cd3f8 size 8 op 0
Stopped at      db_enter+0x17:  popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*426417  98407      0           0  0x4000000    0K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff8463e0d9) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff8000018cd3f8) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff8000018cd3f8) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
pf_remove_if_empty_ruleset(ffff8000018cd3a8) at pf_remove_if_empty_ruleset+0x5c sys/net/pf_ruleset.c:292
pfi_dynaddr_setup(ffff800001782ff8,0,1) at pfi_dynaddr_setup+0x837 sys/net/pf_if.c:508
pf_addr_setup(ffffffff85e49b50,ffff800001782ff8,0) at pf_addr_setup+0x3a sys/net/pf_ioctl.c:948
pfioctl(14900,cd604404,ffff800001c61000,2,ffff8000298947d0) at pfioctl+0xe43e sys/net/pf_ioctl.c:2379
VOP_IOCTL(ffff800001b55040,cd604404,ffff800001c61000,2,ffff800000119410,ffff8000298947d0) at VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
vn_ioctl(ffff8000018d5ab0,cd604404,ffff800001c61000,ffff8000298947d0) at vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
sys_ioctl(ffff8000298947d0,ffff800029956f50,ffff800029956ec0) at sys_ioctl+0x868 sys/kern/sys_generic.c:510
syscall(ffff800029956f50) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800029956f50) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xca5450c76d0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff8000018cd3f8 size 8 op 0
ddb{0}> show kasan
KASAN: invalid read of 8 bytes at 0xffff8000018cd3f8 from pc 0xffffffff83f1170c
KASAN: first bad byte at 0xffff8000018cd3f8 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff8000018cd3f8 is 1248 bytes inside the 1288-byte item [0xffff8000018ccf18..0xffff8000018cd420) in pool 'pfanchor'
KASAN: allocated at:
#0  pool_get+0x770 sys/kern/subr_pool.c:834
#1  pf_create_anchor+0x123 sys/net/pf_ruleset.c:-1
#2  pf_find_or_create_ruleset+0x3eb sys/net/pf_ruleset.c:-1
#3  pfi_dynaddr_setup+0x619 sys/net/pf_if.c:-1
#4  pf_addr_setup+0x3a sys/net/pf_ioctl.c:948
#5  pfioctl+0xe43e sys/net/pf_ioctl.c:2379
#6  VOP_IOCTL+0x131 sys/kern/vfs_vops.c:264
#7  vn_ioctl+0x18c sys/kern/vfs_vnops.c:537
#8  sys_ioctl+0x868 sys/kern/sys_generic.c:510
#9  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#10 Xsyscall+0x128
KASAN: freed at:
#0  pool_put+0x79 sys/kern/subr_pool.c:1019
#1  pf_remove_if_empty_ruleset+0x2cc sys/net/pf_ruleset.c:-1
#2  pfr_destroy_ktable+0x464 sys/net/pf_table.c:2401
#3  pfr_attach_table+0x5f6 sys/net/pf_table.c:2576
#4  pfi_dynaddr_setup+0x63e sys/net/pf_if.c:-1
#5  pf_addr_setup+0x3a sys/net/pf_ioctl.c:948
#6  pfioctl+0xe43e sys/net/pf_ioctl.c:2379
#7