syzbot


kernel: protection fault trap, code=NUM (9)

Status: upstream: reported on 2025/11/28 00:38
Reported-by: syzbot+b316677cd826c26c7b79@syzkaller.appspotmail.com
First crash: 154d, last: 34d
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=NUM (3) -1 1 1501d 1501d 0/3 closed as invalid on 2022/03/22 11:48
openbsd kernel: protection fault trap, code=NUM (5) -1 2 1341d 1342d 0/3 closed as dup on 2022/08/29 15:02
openbsd kernel: protection fault trap, code=NUM (7) -1 6 562d 612d 0/3 auto-obsoleted due to no activity on 2025/01/13 22:53
openbsd kernel: protection fault trap, code=NUM (2) -1 C 16 1583d 1606d 0/3 closed as invalid on 2021/12/31 06:19
openbsd kernel: protection fault trap, code=NUM -1 1 1686d 1686d 0/3 closed as invalid on 2021/09/18 05:58
openbsd kernel: protection fault trap, code=NUM (8) -1 8 335d 448d 0/3 auto-obsoleted due to no activity on 2025/08/28 09:10
openbsd kernel: protection fault trap, code=NUM (4) -1 1 1464d 1464d 0/3 closed as invalid on 2022/04/28 06:52
openbsd kernel: protection fault trap, code=NUM (6) -1 42 721d 1267d 0/3 auto-obsoleted due to no activity on 2024/08/08 04:33

Sample crash report:
kernel: protection fault trap, code=0
Faulted in DDB; continuing...
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11079  12022K   12034K 166960K     12171        0
            pcb    17     12K      12K 166960K        17        0
         rtable   245      6K       7K 166960K       399        0
             pf    31     16K      16K 166960K        31        0
         ifaddr    42      7K       7K 166960K        44        0
        ifgroup    50      2K       2K 166960K        50        0
         sysctl     4      1K       9K 166960K         9        0
       counters    70     37K      37K 166960K        70        0
       ioctlops     0      0K       4K 166960K        64        0
            iov     0      0K      16K 166960K        36        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1288     81K      81K 166960K      1587        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        20        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        48        0
        dirhash    12      2K       2K 166960K        33        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    25     93K     121K 166960K       830        0
          sigio     0      0K       0K 166960K         9        0
           proc    58     99K     147K 166960K       620        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       160        0
       in_multi    99      7K       7K 166960K       138        0
    ether_multi     1      0K       0K 166960K        10        0
            mrt     2      0K       0K 166960K        19        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   217    970K     970K 166960K       217        0
           exec     0      0K       1K 166960K       428        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   264    161K     187K 166960K      9541        0
       UVM aobj    32      6K       6K 166960K        34        0
     pinsyscall    46     92K     110K 166960K      1951        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        49        0
            NDP    11      0K       1K 166960K        27        0
           temp    63   9085K    9149K 166960K      6927        0
         kqueue    15     21K      32K 166960K       162        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      103    0      100     1     0     1     1     0     8    0
rtentry    176      121    0        7     6     0     6     6     0     8    0
unpcb      144      714    0      693     6     4     2     6     0     8    1
syncache   336       12    0       12     1     0     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      736      422    0      410     5     0     5     5     0     8    3
arp        136       19    0        0     1     0     1     1     0     8    0
ipq         40        5    0        0     1     0     1     1     0     8    0
ipqe        40        9    0        2     1     0     1     1     0     8    0
inpcb      328      821    0      803     5     0     5     5     0     8    3
ip6q        72        6    0        1     1     0     1     1     0     8    0
ip6af       40        7    0        2     1     0     1     1     0     8    0
nd6        152       33    0        6     2     0     2     2     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      482    0       23    30     0    30    30     0     8    0
art_table   40      483    0       23     5     0     5     5     0     8    0
art_node    32      121    0       16     1     0     1     1     0     8    0
sysvmsgpl   40       11    0        7     1     0     1     1     0     8    0
semupl     112        3    0        3     2     1     1     1     0     8    1
semapl     112       43    0       33     1     0     1     1     0     8    0
shmpl      112       31    0        2     1     0     1     1     0     8    0
pool(0xffffffff83a0c6b8:shmpl): page inconsistency: page 0xfffffd806b0b8000; 5 on list, 29 missing, 35 items per page
dirhash    1024      31    0       14     3     0     3     3     0     8    0
dino2pl    256     2788    0     1319    93     0    93    93     0     8    0
ffsino     296     2788    0     1319   114     0   114   114     0     8    0
nchpl      144     4021    0     2331    63     0    63    63     0     8    0
vnodes     216     2869    0        0   160     0   160   160     0     8    0
namei      1024   13106    0    13105     3     1     2     2     0     8    1
percpumem   16       50    0        0     1     0     1     1     0     8    0
kstatmem   264       24    0        0     2     0     2     2     0     8    0
scxspl     216    13050    0    13049    11     3     8     8     1     8    7
plimitpl   152      228    0      203     2     0     2     2     0     8    1
sigapl     424     1128    0     1075     7     0     7     7     0     8    0
knotepl    120      310    0        0    10     0    10    10     0     8    0
kqueuepl   224      230    0      219     2     0     2     2     0     8    1
pipepl     344      314    0      286     9     0     9     9     0     8    6
fdescpl    528     1112    0     1075     3     0     3     3     0     8    0
filepl     160     6983    0     6749    16     1    15    16     0     8    4
lockfpl    104      267    0      260     1     0     1     1     0     8    0
lockfspl    48       89    0       84     1     0     1     1     0     8    0
sessionpl  144       67    0       50     1     0     1     1     0     8    0
pgrppl      48      152    0      127     1     0     1     1     0     8    0
ucredpl    104     1635    0     1616     1     0     1     1     0     8    0
zombiepl   144     1075    0     1075     1     0     1     1     0     8    1
processpl  1232    1128    0     1075     5     0     5     5     0     8    0
procpl     664     2307    0     2239     7     0     7     7     0     8    0
sosppl     176        8    0        8     1     0     1     1     0     8    1
sockpl     752     1647    0     1605    17     9     8    17     0     8    3
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     114    0        0    15     0    15    15     0     8    0
mcl2k      2048      23    0        0     3     0     3     3     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      296    0        0    19     0    19    19     0     8    0
bufpl      280     3787    0      102   264     0   264   264     0     8    0
anonpl      32     7910    0        0    64     0    64    64     0   246    0
amapchunkpl 152   31736    0    31135    35     3    32    32     0   158    6
amappl16   200     3726    0     3696    24     8    16    16     0     8   11
amappl15   192        8    0        8     1     1     0     1     0     8    0
amappl14   184      397    0      396     1     0     1     1     0     8    0
amappl13   176      136    0      126     1     0     1     1     0     8    0
amappl12   168     1348    0     1312     2     0     2     2     0     8    0
amappl11   160        8    0        6     1     0     1     1     0     8    0
amappl10   152       88    0       78     1     0     1     1     0     8    0
amappl9    144      257    0      256     2     1     1     1     0     8    0
amappl8    136      130    0      129     1     0     1     1     0     8    0
amappl7    128      169    0      157     1     0     1     1     0     8    0
amappl6    120      185    0      183     1     0     1     1     0     8    0
amappl5    112      109    0      101     1     0     1     1     0     8    0
amappl4    104      287    0      271     1     0     1     1     0     8    0
amappl3     96     6091    0     5948     5     1     4     4     0     8    0
amappl2     88      686    0      632     2     0     2     2     0     8    0
amappl1     80    14848    0    14265    18     0    18    18     0     8    3
amappl      88     8658    0     8459     5     0     5     5     0    92    0
uvmvnodes   80      137    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       33    0        2     1     0     1     1     0     8    0
uaddrrnd    24     1112    0     1075     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1112    0     1075     1     0     1     1     0     8    0
vmmpekpl   168    11810    0    11771     3     0     3     3     0     8    0
vmmpepl    168    81126    0    79026   114     0   114   114     0   357   15
vmsppl     488     1111    0     1075     7     1     6     6     0     8    0
rwobjpl     80    25325    0    24268    29     0    29    29     0     8    2
pdppl      4096    2231    0     2150   123    38    85    95     0     8    4
pvpl        32    16035    0        0   131     1   130   131     0   265    0
pmappl     256     1111    0     1075     4     1     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      306    0       42     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff838d8ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670
comcnputc(800,66) at comcnputc+0x250 comcn_read_reg sys/dev/ic/com.c:1655 [inline]
comcnputc(800,66) at comcnputc+0x250 sys/dev/ic/com.c:1269
cnputc(66) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(66) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff834267a8) at db_printf+0x9b sys/kern/subr_prf.c:-1
panic(ffffffff83444d2f) at panic+0x103 sys/kern/subr_prf.c:217
pool_do_get(ffffffff83a0c6b8,1,ffff80003c46b1b8) at pool_do_get+0x5df
pool_get(ffffffff83a0c6b8,1) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff8000ffff27e0,ffff80003c46b410,0,ffff80003c46b360) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff8000ffff27e0,ffff80003c46b410,ffff80003c46b360) at sys_shmget+0x195 sys/kern/sysv_shm.c:482
end trace frame: 0xffff80003c46b400, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff838d8ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 sys/arch/amd64/amd64/bus_space.c:670
comcnputc(800,66) at comcnputc+0x250 comcn_read_reg sys/dev/ic/com.c:1655 [inline]
comcnputc(800,66) at comcnputc+0x250 sys/dev/ic/com.c:1269
cnputc(66) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(66) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff834267a8) at db_printf+0x9b sys/kern/subr_prf.c:-1
panic(ffffffff83444d2f) at panic+0x103 sys/kern/subr_prf.c:217
pool_do_get(ffffffff83a0c6b8,1,ffff80003c46b1b8) at pool_do_get+0x5df
pool_get(ffffffff83a0c6b8,1) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff8000ffff27e0,ffff80003c46b410,0,ffff80003c46b360) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff8000ffff27e0,ffff80003c46b410,ffff80003c46b360) at sys_shmget+0x195 sys/kern/sysv_shm.c:482
syscall(ffff80003c46b410) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c46b410) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x397331f5ef0, count: -16
ddb{0}> machine ddbcpu 1
Stopped at      savectx+0xae:   movl    $0,%gs:0x688
savectx() at savectx+0xae
end of kernel
end trace frame: 0xd33f5ae9ac0, count: 14
ddb{1}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0xd33f5ae9ac0, count: -1

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/28 06:05 openbsd 9d790fdba930 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid kernel: protection fault trap, code=NUM
2026/02/12 15:36 openbsd 012cf974ca6d 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore kernel: protection fault trap, code=NUM
2026/01/13 07:01 openbsd a9df5e8d0934 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore kernel: protection fault trap, code=NUM
2025/11/28 00:38 openbsd 7de01a79e4ba e8331348 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid kernel: protection fault trap, code=NUM
* Struck through repros no longer work on HEAD.