syzbot
KASAN: invalid memory access in in_ifdetach
Status:
upstream: reported on 2026/09/21 01:39
Reported-by: syzbot+b10e9391817d32ad31ad@syzkaller.appspotmail.com
First crash: 27d, last: 24d
Sample crash report:
panic: Caught invalid memory access at ffff8000001a4d00 size 8 op 0
Stopped at db_enter+0x17: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff8000001a4d00) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff8000001a4d00) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff80000176b800) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff80000176b800) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff80000176b800) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299cbb80) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d00,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299cbcc0) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001adde58,7,ffff800000119410,ffff8000299127d8) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001be2400,ffff8000299127d8) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001be2400,ffff8000299127d8) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001be2400,ffff8000299127d8) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001be2400,ffff8000299127d8) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000299127d8) at fdfree+0x16d sys/kern/kern_descrip.c:1203
end trace frame: 0xffff8000299cc090, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: Caught invalid memory access at ffff8000001a4d00 size 8 op 0
ddb{0}> show kasan
KASAN: invalid read of 8 bytes at 0xffff8000001a4d00 from pc 0xffffffff83146c58
KASAN: first bad byte at 0xffff8000001a4d00 (+0); shadow 0xfc: malloc use-after-free
KASAN: 0xffff8000001a4d00 is 0 bytes inside the 128-byte malloc slot [0xffff8000001a4d00..0xffff8000001a4d80)
KASAN: allocated at:
#0 malloc+0xf70 sys/kern/kern_malloc.c:493
#1 in_addmulti+0x248 sys/netinet/in.c:891
#2 ip_setmoptions+0x1534 sys/netinet/ip_output.c:1603
#3 sosetopt+0x19e sys/kern/uipc_socket.c:1899
#4 sys_setsockopt+0x466 sys/kern/uipc_syscalls.c:1234
#5 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#6 Xsyscall+0x128
KASAN: freed at:
#0 free+0x41b kasan_quarantine_push sys/kern/kern_malloc.c:168 [inline]
#0 free+0x41b sys/kern/kern_malloc.c:665
#1 in_delmulti+0x2e7 sys/netinet/in.c:985
#2 ip_freemoptions+0x9f sys/netinet/ip_output.c:-1
#3 in_pcbdetach+0x187 sys/netinet/in_pcb.c:605
#4 rip_detach+0x72 sys/netinet/raw_ip.c:509
#5 soclose+0x10a pru_detach sys/sys/protosw.h:281 [inline]
#5 soclose+0x10a sys/kern/uipc_socket.c:403
#6 soo_close+0x72 sys/kern/sys_socket.c:169
#7 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#8 closef+0x263 sys/kern/kern_descrip.c:1265
#9 fdfree+0x16d sys/kern/kern_descrip.c:1203
#10 exit1+0x81e sys/kern/kern_exit.c:217
#11 sys_exit+0x4a
#12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#13 Xsyscall+0x128
KASAN: pc: in_ifdetach+0x78
KASAN: call trace:
#0 __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0 __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1 in_ifdetach+0x78 sys/netinet/in.c:1017
#2 if_detach+0x491 sys/net/if.c:1311
#3 tun_clone_destroy+0x43b sys/net/if_tun.c:343
#4 if_clone_destroy+0x24d sys/net/if.c:1480
#5 tun_dev_close+0x2c0 sys/net/if_tun.c:526
#6 spec_close+0x56b sys/kern/spec_vnops.c:538
#7 VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
#8 vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
#8 vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
#9 fdrop+0x1c3 sys/kern/kern_descrip.c:1281
#10 closef+0x263 sys/kern/kern_descrip.c:1265
#11 fdfree+0x16d sys/kern/kern_descrip.c:1203
#12 exit1+0x81e sys/kern/kern_exit.c:217
#13 sys_exit+0x4a
#14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
KASAN: shadow of 0xffff8000001a4c00..0xffff8000001a4e80 (1 cell = 8 bytes):
0xffff8000001a4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff8000001a4c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>0xffff8000001a4d00:[fc]fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff8000001a4d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
0xffff8000001a4e00: 08 08 08 08 08 08 08 08 fb fc fc fc fc fc fc fc
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff8000001a4d00) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff8000001a4d00) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff80000176b800) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff80000176b800) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff80000176b800) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299cbb80) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d00,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299cbcc0) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001adde58,7,ffff800000119410,ffff8000299127d8) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001be2400,ffff8000299127d8) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001be2400,ffff8000299127d8) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001be2400,ffff8000299127d8) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001be2400,ffff8000299127d8) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000299127d8) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff8000299127d8,43,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff8000299127d8,ffff8000299cc260,ffff8000299cc1c0) at sys_exit+0x4a
syscall(ffff8000299cc260) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299cc260) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x760b68d96ea0, count: -18
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff8000299cb7f0
rbx 0xffff8000299cb860
rdx 0
rcx 0xffffffff853d8ff0 cpu_info_full_primary+0x1ff0
rax 0
r8 0x101010101010101
r9 0x8080808080808080
r10 0xffff8000299cb5d8
r11 0xffffffff8399cf40 x86_bus_space_io_read_1
r12 0xffffffff846453fc switch.table.intel_memory_region_create+0x9d43c
r13 0xffffffff853d9c10 cpu_info_full_primary+0x2c10
r14 0xffffffff853d9e0f cpu_info_full_primary+0x2e0f
r15 0x1
rip 0xffffffff82176867 db_enter+0x17
cs 0x8
rflags 0x246
rsp 0xffff8000299cb7f0
ss 0x10
db_enter+0x17: popq %rbp
ddb{0}> show proc
PROC (syz-executor) tid=232915 pid=6225 tcnt=0 stat=onproc
flags process=a<EXEC,EXITING> proc=2000<WEXIT>
runpri=32, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1
forw=0xffffffffffffffff, list=0xffff800029894a68,0xffff800029912020
process=0xffff800029914e98 user=0xffff8000299c1000, vmspace=0xffff800001acb998
estcpu=36, cpticks=44, pctcpu=0.14, user=0, sys=25, intr=0
ddb{0}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
66212 213279 90803 0 2 0x10100002 0x88 sh
79506 317931 83483 0 2 0 0 syz-executor
79506 373078 83483 0 3 0 0x4000080 fsleep syz-executor
79506 421700 83483 0 3 0 0x4000080 fsleep syz-executor
78381 168527 85860 0 2 0x10 0 syz-executor
78381 97324 85860 0 3 0x10 0x4000080 fsleep syz-executor
92262 433764 49337 0 2 0x100002 0 sh
49337 52799 95019 0 3 0x2 0x80 wait syz-executor
90803 149129 95019 0 3 0x2 0x80 wait syz-executor
85860 125256 95019 0 3 0x2 0x80 nanoslp syz-executor
55650 384205 95019 0 3 0x2 0x80 piperd syz-executor
31263 181634 95019 0 3 0x2 0x80 piperd syz-executor
83483 241761 95019 0 3 0x2 0x80 nanoslp syz-executor
46106 270380 95019 0 3 0x2 0x80 piperd syz-executor
95019 232893 44947 0 3 0x2 0x80 wait syz-executor
44947 153683 46807 0 3 0x100002 0x88 sigsusp ksh
46807 172194 19398 0 3 0x10 0x88 kqread sshd-session
19398 512320 30961 0 3 0x12 0x80 kqread sshd-session
49368 354646 1 0 3 0x100003 0x80 ttyin getty
30961 328884 1 0 3 0 0x88 kqread sshd
85610 256268 63562 74 3 0x1100012 0x80 bpf pflogd
63562 110046 1 0 3 0 0x80 sbwait pflogd
51880 400501 23787 73 3 0x1100010 0x80 kqread syslogd
23787 220999 1 0 3 0x100002 0x80 sbwait syslogd
79352 161567 1 0 3 0x100000 0x80 kqread resolvd
91104 459958 36079 77 3 0x100012 0x80 kqread dhcpleased
26425 33373 36079 77 3 0x100012 0x80 kqread dhcpleased
36079 20339 1 0 3 0 0x80 kqread dhcpleased
74693 159860 0 0 3 0x14000 0x200 bored smr
25815 450412 0 0 2 0x14000 0x200 zerothread
84873 272068 0 0 3 0x14000 0x200 aiodoned aiodoned
12418 97468 0 0 3 0x14000 0x200 syncer update
89071 170987 0 0 3 0x14000 0x200 cleaner cleaner
13650 68706 0 0 3 0x14000 0x200 reaper reaper
89533 18580 0 0 3 0x14000 0x200 pgdaemon pagedaemon
76417 150498 0 0 3 0x14000 0x200 bored viomb
90416 489195 0 0 3 0x14000 0x40000200 acpi0 acpi0
60968 358144 0 0 7 0x14000 0x40000200 idle1
20483 144286 0 0 3 0x14000 0x200 bored softnet1
14743 181897 0 0 3 0x14000 0x200 bored softnet0
16789 39030 0 0 3 0x14000 0x200 bored systqmp
80194 361780 0 0 3 0x14000 0x200 bored systq
30795 180220 0 0 3 0x14000 0x200 tmoslp softclockmp
94721 207816 0 0 3 0x14000 0x40000200 tmoslp softclock
6255 38984 0 0 3 0x14000 0x40000200 idle0
1 246395 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{0}> show all locks
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11060 12254K 12473K 166960K 12215 0
pcb 17 24K 24K 166960K 30 0
rtable 215 14K 29K 166960K 439 0
pf 34 22K 29K 166960K 65 0
ifaddr 40 11K 14K 166960K 63 0
ifgroup 55 2K 2K 166960K 79 0
sysctl 1 1K 13K 166960K 5 0
counters 70 42K 45K 166960K 84 0
ioctlops 1 0K 194K 166960K 1501 0
iov 0 0K 16K 166960K 65 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1301 84K 86K 166960K 1449 0
UFS quota 1 36K 36K 166960K 1 0
UFS mount 5 44K 44K 166960K 5 0
shm 2 2K 2K 166960K 2 0
VM map 2 1K 1K 166960K 2 0
sem 6 0K 0K 166960K 8 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 405K 166960K 12470 0
file desc 14 49K 117K 166960K 250 0
sigio 0 0K 0K 166960K 2 0
proc 82 129K 195K 166960K 650 0
subproc 72 9K 11K 166960K 108 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 20K 20K 166960K 1 0
ip_moptions 2 0K 0K 166960K 2 0
in_multi 89 6K 8K 166960K 133 0
ether_multi 1 0K 0K 166960K 1 0
mrt 2 0K 0K 166960K 9 0
ISOFS mount 1 36K 36K 166960K 1 0
MSDOSFS mount 1 20K 20K 166960K 1 0
ttys 55 384K 384K 166960K 55 0
exec 71 17K 17K 166960K 496 0
fusefs mount 1 36K 36K 166960K 1 0
tdb 3 1K 1K 166960K 3 0
VM swap 14 124K 124K 166960K 15 0
UVM amap 326 276K 370K 166960K 4001 0
UVM aobj 72 10K 10K 166960K 72 0
pinsyscall 67 126K 379K 166960K 1494 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 1 0K 0K 166960K 1 0
NDP 16 0K 2K 166960K 41 0
temp 795 9238K 9449K 166960K 6502 0
kqueue 18 53K 84K 166960K 44 0
SYN cache 2 16K 16K 166960K 2 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 39 0 36 1 0 1 1 0 8 0
rtentry 176 148 0 48 6 0 6 6 0 8 0
unpcb 144 67 0 48 1 0 1 1 0 8 0
syncache 336 4 0 4 1 0 1 1 0 8 1
tcpcb 736 13 0 8 1 0 1 1 0 8 0
arp 136 25 0 9 1 0 1 1 0 8 0
inpcb 328 119 0 111 2 0 2 2 0 8 0
nd6 152 34 0 12 1 0 1 1 0 8 0
kcovpl 48 12 0 4 1 0 1 1 0 8 0
ppxss 1192 2 0 2 1 0 1 1 0 8 1
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pftag 88 1 0 0 1 0 1 1 0 8 0
pfstitem 24 33 0 0 1 0 1 1 0 8 0
pfstkey 128 33 0 0 2 0 2 2 0 8 0
pfstate 448 33 0 0 4 0 4 4 0 8 0
pfrule 1360 22 0 17 2 1 1 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 594 0 178 29 0 29 29 0 8 3
art_table 40 595 0 178 5 0 5 5 0 8 0
art_node 32 148 0 57 1 0 1 1 0 8 0
semapl 72 6 0 3 1 0 1 1 0 8 0
shmpl 120 69 0 0 3 0 3 3 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 1684 0 206 93 0 93 93 0 8 0
ffsino 296 1684 0 206 114 0 114 114 0 8 0
nchpl 144 1975 0 266 64 0 64 64 0 8 0
vnodes 216 1841 0 0 103 0 103 103 0 8 0
namei 1024 7590 0 7590 1 0 1 1 0 8 1
percpumem 16 58 0 7 1 0 1 1 0 8 0
kstatmem 264 41 0 14 2 0 2 2 0 8 0
scxspl 216 7561 0 7561 6 3 3 3 1 8 3
plimitpl 152 44 0 27 1 0 1 1 0 8 0
sigapl 424 559 0 514 7 0 7 7 0 8 1
knotepl 120 57 0 0 2 0 2 2 0 8 0
kqueuepl 224 53 0 43 1 0 1 1 0 8 0
pipepl 344 149 0 122 3 0 3 3 0 8 0
fdescpl 528 543 0 515 3 0 3 3 0 8 0
filepl 160 2164 0 1951 10 0 10 10 0 8 0
lockfpl 104 20 0 18 1 0 1 1 0 8 0
lockfspl 48 11 0 9 1 0 1 1 0 8 0
sessionpl 144 100 0 91 1 0 1 1 0 8 0
pgrppl 48 112 0 95 1 0 1 1 0 8 0
ucredpl 104 197 0 182 1 0 1 1 0 8 0
zombiepl 144 516 0 514 1 0 1 1 0 8 0
processpl 1240 559 0 514 5 0 5 5 0 8 1
procpl 664 676 0 628 7 0 7 7 0 8 0
sockpl 752 226 0 196 4 0 4 4 0 8 0
mcl64k 65536 2 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl9k128 9344 1 0 0 1 0 1 1 0 8 0
mcl8k 8192 2 0 0 1 0 1 1 0 8 0
mcl4k 4096 116 0 0 15 0 15 15 0 8 0
mcl2k 2048 20 0 0 3 0 3 3 0 8 0
mextrefs 64 18 0 0 1 0 1 1 0 8 0
mtagpl 96 2 0 0 1 0 1 1 0 8 0
mbufpl 256 278 0 0 18 0 18 18 0 8 0
bufpl 272 2498 0 106 160 0 160 160 0 8 0
anonpl 32 5479 0 0 45 0 45 45 0 222 0
amapchunkpl 152 11129 0 10780 24 0 24 24 0 158 4
amappl16 200 2015 0 1995 5 3 2 5 0 8 0
amappl15 192 34 0 34 1 1 0 1 0 8 0
amappl14 184 474 0 471 1 0 1 1 0 8 0
amappl13 176 146 0 132 1 0 1 1 0 8 0
amappl12 168 805 0 779 2 0 2 2 0 8 0
amappl11 160 14 0 14 3 2 1 1 0 8 1
amappl10 152 70 0 56 1 0 1 1 0 8 0
amappl9 144 284 0 284 1 1 0 1 0 8 0
amappl8 136 192 0 190 1 0 1 1 0 8 0
amappl7 128 205 0 192 1 0 1 1 0 8 0
amappl6 120 192 0 189 1 0 1 1 0 8 0
amappl5 112 100 0 90 1 0 1 1 0 8 0
amappl4 104 305 0 286 1 0 1 1 0 8 0
amappl3 96 1915 0 1841 3 0 3 3 0 8 0
amappl2 88 648 0 574 2 0 2 2 0 8 0
amappl1 80 11083 0 10480 15 0 15 15 0 8 1
amappl 88 3213 0 3089 4 0 4 4 0 92 0
uvmvnodes 80 102 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 253 0 253 1 1 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 71 0 0 2 0 2 2 0 8 0
uaddrrnd 24 543 0 515 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 543 0 515 1 0 1 1 0 8 0
vmmpekpl 168 6570 0 6533 2 0 2 2 0 8 0
vmmpepl 168 44635 0 42949 88 0 88 88 0 357 3
vmsppl 488 542 0 515 5 0 5 5 0 8 0
rwobjpl 80 16155 0 15081 24 0 24 24 0 8 0
pdppl 4096 1095 0 1030 97 22 75 85 0 8 10
pvpl 32 12867 0 0 106 2 104 104 0 265 0
pmappl 256 542 0 515 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 120 437 0 25 13 0 13 13 0 8 0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff846453fc) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff8000001a4d00) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff8000001a4d00) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
in_ifdetach(ffff80000176b800) at in_ifdetach+0x78 sys/netinet/in.c:1017
if_detach(ffff80000176b800) at if_detach+0x491 sys/net/if.c:1311
tun_clone_destroy(ffff80000176b800) at tun_clone_destroy+0x43b sys/net/if_tun.c:343
if_clone_destroy(ffff8000299cbb80) at if_clone_destroy+0x24d sys/net/if.c:1480
tun_dev_close(5d00,7) at tun_dev_close+0x2c0 sys/net/if_tun.c:526
spec_close(ffff8000299cbcc0) at spec_close+0x56b sys/kern/spec_vnops.c:538
VOP_CLOSE(ffff800001adde58,7,ffff800000119410,ffff8000299127d8) at VOP_CLOSE+0x1e9 sys/kern/vfs_vops.c:156
vn_closefile(ffff800001be2400,ffff8000299127d8) at vn_closefile+0x1cc vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(ffff800001be2400,ffff8000299127d8) at vn_closefile+0x1cc sys/kern/vfs_vnops.c:621
fdrop(ffff800001be2400,ffff8000299127d8) at fdrop+0x1c3 sys/kern/kern_descrip.c:1281
closef(ffff800001be2400,ffff8000299127d8) at closef+0x263 sys/kern/kern_descrip.c:1265
fdfree(ffff8000299127d8) at fdfree+0x16d sys/kern/kern_descrip.c:1203
exit1(ffff8000299127d8,43,0,1) at exit1+0x81e sys/kern/kern_exit.c:217
sys_exit(ffff8000299127d8,ffff8000299cc260,ffff8000299cc1c0) at sys_exit+0x4a
syscall(ffff8000299cc260) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000299cc260) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x760b68d96ea0, count: -18
ddb{0}> machine ddbcpu 1
Stopped at x86_ipi_db+0x19: leave
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x63c sys/dev/acpi/acpicpu_x86.c:-1
sched_idle(ffff800028fe3ff0) at sched_idle+0x566 sys/kern/kern_sched.c:204
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x63c sys/dev/acpi/acpicpu_x86.c:-1
sched_idle(ffff800028fe3ff0) at sched_idle+0x566 sys/kern/kern_sched.c:204
end trace frame: 0x0, count: -5
Struck through repros no longer work on HEAD.