syzbot


panic: kernel diagnostic assertion "pg->wire_count == NUM" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uv

Status: upstream: reported on 2025/12/19 13:23
Reported-by: syzbot+beae8c85fac6090e135c@syzkaller.appspotmail.com
First crash: 64d, last: 61d

Sample crash report:
panic:W AkReNrInNGel:  dSPiLag nNoOsTt iLcO aWEssReEDr tOioN n S"YSpgC-AL>wL ir2 e1_c12ou9n7t4 4=7=9 30 "E XfIaiTle d0: d f
ilStopped at   savectx+0xae:   movl    $0,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 75834  91650      0         0x2          0    1  syz-executor
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f4b09e082b0, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu0: kernel diagnostic assertion "pg->wire_count == 0" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_page.c", line 1326
ddb{1}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f4b09e082b0, count: -1
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003c46bf30
rbx                                0
rdx                                0
rcx               0xffff80003c3ff248
rax                             0x3a
r8                0xffff80003c46be60
r9                0xffff8000fffeefa8
r10               0x1867bac8d9a21fe5
r11               0xc837f88598e1a5ef
r12                                0
r13                                0
r14               0xffff80003c3ff248
r15                                0
rip               0xffffffff829fa3ee    savectx+0xae
cs                               0x8
rflags                          0x46
rsp               0xffff80003c46beb0
ss                              0x10
savectx+0xae:   movl    $0,%gs:0x688
ddb{1}> show proc
PROC (syz-executor) tid=75834 pid=91650 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=17, usrpri=50, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c453a28,0xffff8000333d6568
    process=0xffff80003c4ca1d8 user=0xffff80003c466000, vmspace=0xfffffd8075c5f018
    estcpu=36, cpticks=31, pctcpu=0.18, user=1, sys=28, intr=2
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 16150  453827  91650      0  2           0                syz-executor
 52234  184537  85949      0  3        0x80  nanoslp       syz-executor
 52234  411273  85949      0  3   0x4000080  fsleep        syz-executor
 52234  465963  85949      0  3   0x4000080  fsleep        syz-executor
 52234  408233  85949      0  3   0x4000080  fsleep        syz-executor
 35189    6338  14536      0  3        0x80  nanoslp       syz-executor
 35189  190265  14536      0  3   0x4000080  netacc        syz-executor
 35189  480324  14536      0  3   0x4000080  fsleep        syz-executor
 67484  119930  42540      0  3        0x80  nanoslp       syz-executor
 67484  173220  42540      0  3   0x4000080  fsleep        syz-executor
 67484  115502  42540      0  3   0x4000080  ttyout        syz-executor
 67484   66846  42540      0  3   0x4000080  fsleep        syz-executor
 30558  138202  85315  60929  3        0x90  nanoslp       syz-executor
 30558  352028  85315  60929  3   0x4000090  ttyout        syz-executor
 30558  399721  85315  60929  3   0x4000090  fsleep        syz-executor
 66845  191928  50492      0  3        0x80  nanoslp       syz-executor
 66845  503326  50492      0  3   0x4000080  ttyin         syz-executor
*91650   75834  85407      0  7         0x2                syz-executor
 61254  191807      0      0  3     0x14200  acct          acct
 42540  147013  85407      0  3        0x82  nanoslp       syz-executor
 14536  308690  85407      0  3        0x82  nanoslp       syz-executor
 85949  373482  85407      0  3        0x82  nanoslp       syz-executor
 48041  223871  85407      0  3        0x82  nanoslp       syz-executor
 50492  302694  85407      0  3        0x82  nanoslp       syz-executor
 94137   27800  85407      0  3        0x82  wait          syz-executor
 85315   65798  85407      0  3        0x82  nanoslp       syz-executor
 85407  225401  66730      0  3        0x82  kqread        syz-executor
 66730  138756  66504      0  3    0x10008a  sigsusp       ksh
 66504  109705   8602      0  3        0x98  kqread        sshd-session
  8602  229518  56579      0  3        0x92  kqread        sshd-session
 93799  457114      1      0  3    0x100083  ttyopn        getty
 56579  302647      1      0  3        0x88  kqread        sshd
 55079  363191  97172     74  3   0x1100092  bpf           pflogd
 97172  163067      1      0  3        0x80  sbwait        pflogd
 60369  367516   9466     73  3   0x1100090  kqread        syslogd
  9466  302051      1      0  3    0x100082  sbwait        syslogd
 43523  255198      1      0  3    0x100080  kqread        resolvd
 99796  318930  94665     77  3    0x100092  kqread        dhcpleased
 54553  349321  94665     77  3    0x100092  kqread        dhcpleased
 94665  402926      1      0  3        0x80  kqread        dhcpleased
 25592  366838      0      0  3     0x14200  bored         smr
 37956   99218      0      0  2     0x14200                zerothread
 39630  307919      0      0  3     0x14200  aiodoned      aiodoned
 98689  476689      0      0  3     0x14200  syncer        update
 22537   42805      0      0  3     0x14200  cleaner       cleaner
 10376  486320      0      0  3     0x14200  reaper        reaper
 53604  148356      0      0  3     0x14200  pgdaemon      pagedaemon
 33365  513860      0      0  3     0x14200  bored         viomb
  5065  188631      0      0  3  0x40014200  acpi0         acpi0
 36504  216666      0      0  3  0x40014200                idle1
 13494  444909      0      0  3     0x14200  bored         softnet1
 75525  523497      0      0  3     0x14200  bored         softnet0
 77518  244010      0      0  3     0x14200  bored         systqmp
 65458  164208      0      0  3     0x14200  bored         systq
 33899  248702      0      0  3     0x14200  tmoslp        softclockmp
 13329  520574      0      0  3  0x40014200  tmoslp        softclock
 92957  249955      0      0  3  0x40014200                idle0
     1  277840      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
CPU 0:
exclusive mutex &uvm.pageqlock r = 0 (0xffffffff838cfbc8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  uvm_pageclean+0x29c sys/uvm/uvm_page.c:980
#3  uvm_pagefree+0x26 sys/uvm/uvm_page.c:1020
#4  uvm_anfree+0xe9 sys/uvm/uvm_anon.c:112
#5  amap_wipeout+0x246 sys/uvm/uvm_amap.c:-1
#6  uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
#7  uvm_map_teardown+0x360 sys/uvm/uvm_map.c:2525
#8  exit1+0x6fc sys/kern/kern_exit.c:260
#9  sys_exit+0x1a sys/kern/kern_exit.c:-1
#10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#11 Xsyscall+0x128
CPU 1:
exclusive mutex &pr->ps_mtx r = 0 (0xffff80003c4ca2f0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  lim_fork+0x40 sys/kern/kern_resource.c:692
#3  process_new+0x2db sys/kern/kern_fork.c:238
#4  fork1+0x3f6 sys/kern/kern_fork.c:-1
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#6  Xsyscall+0x128
Process 91650 (syz-executor) thread 0xffff80003c3ff248 (75834)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff838bcc48)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:775
#2  Xsyscall+0x128
exclusive mutex &pr->ps_mtx r = 0 (0xffff80003c4ca2f0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  lim_fork+0x40 sys/kern/kern_resource.c:692
#3  process_new+0x2db sys/kern/kern_fork.c:238
#4  fork1+0x3f6 sys/kern/kern_fork.c:-1
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#6  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10253  11189K   11432K 166960K     13788        0
            pcb    19     13K      14K 166960K       329        0
         rtable   211     10K      11K 166960K       614        0
             pf    39     18K      82K 166960K       184        0
         ifaddr    37      6K       7K 166960K       122        0
        ifgroup    62      2K       3K 166960K       222        0
         sysctl     4      1K       9K 166960K        83        0
       counters    72     37K      38K 166960K       318        0
       ioctlops     0      0K       8K 166960K      1869        0
            iov     1      1K      16K 166960K       183        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1455     91K      92K 166960K      3092        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        26        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        63        0
        dirhash    12      2K       2K 166960K        30        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K     110K 166960K      1505        0
          sigio     0      0K       0K 166960K        31        0
           proc    73    115K     163K 166960K       734        0
        subproc    72      4K       4K 166960K        90        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       141        0
       in_multi    74      5K       7K 166960K       161        0
    ether_multi     1      0K       0K 166960K        13        0
            mrt     0      0K       0K 166960K         9        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   241   1076K    1076K 166960K       241        0
           exec     0      0K       1K 166960K       593        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   261    172K     190K 166960K     15519        0
       UVM aobj    52     17K      19K 166960K        59        0
     pinsyscall    42     84K     108K 166960K      2707        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       167        0
            NDP    13      0K       1K 166960K        87        0
           temp    79   8680K    8794K 166960K     65089        0
         kqueue    17     28K      32K 166960K       267        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      130    0      127     1     0     1     1     0     8    0
rtentry    176      163    0       84     6     0     6     6     0     8    0
unpcb      144      929    0      906     7     3     4     4     0     8    3
syncache   336        9    0        9     3     2     1     1     0     8    1
tcpqe       32        2    0        2     2     1     1     1     0     8    1
tcpcb      736      412    0      405    13     6     7     7     0     8    5
arp        136       26    0       13     1     0     1     1     0     8    0
inpcb      328     1407    0     1393    16     9     7     7     0     8    5
nd6        152       33    0       13     1     0     1     1     0     8    0
pkpcb       40       10    0       10     1     0     1     1     0     8    1
kcovpl      48       10    0        2     1     0     1     1     0     8    0
mppekey    1024       2    0        2     2     2     0     1     0     8    0
ppxss      1192     103    0      103     1     0     1     1     0     8    1
pppxif     1504       8    0        8     2     1     1     1     0     8    1
pfstscr     40        2    0        2     1     1     0     1     0     8    0
pffrag     232       10    0        2     1     0     1     1     0   482    0
pffrnode    88       10    0        2     1     0     1     1     0     8    0
pffrent     40       19    0       11     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       3    0        3     2     2     0     1     0     8    0
pfstitem    24       91    0       25     1     0     1     1     0     8    0
pfstkey    128       92    0       26     3     0     3     3     0     8    0
pfstate    448       91    0       26     8     0     8     8     0     8    0
pfrule     1344      27    0       21     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256      688    0      325    32     8    24    31     0     8    0
art_table   40      692    0      325     6     0     6     6     0     8    0
art_node    32      162    0       92     1     0     1     1     0     8    0
sysvmsgpl   40       17    0       11     1     0     1     1     0     8    0
semapl     112       57    0       47     1     0     1     1     0     8    0
shmpl      112       45    0        3     2     0     2     2     0     8    0
dirhash    1024      29    0       12     3     0     3     3     0     8    0
dino2pl    256     4309    0     2801    95     0    95    95     0     8    0
ffsino     296     4309    0     2801   117     0   117   117     0     8    0
nchpl      144     6376    0     4667    64     0    64    64     0     8    0
rtmask      32       17    0       17     3     2     1     1     0     8    1
vnodes     216     5472    0        0   304     0   304   304     0     8    0
namei      1024   22074    0    22074     2     1     1     2     0     8    1
percpumem   16      174    0      123     1     0     1     1     0     8    0
vcpupl     3968       8    0        1     1     0     1     1     0     8    0
vmpool     848       11    0        4     1     0     1     1     0     8    0
kstatmem   264      140    0      108     3     0     3     3     0     8    0
scsiplug    72        6    0        6     3     2     1     1     0     8    1
scxspl     216    33829    0    33829     7     5     2     5     1     8    2
plimitpl   152      379    0      361     1     0     1     1     0     8    0
sigapl     424     1831    0     1782     9     3     6     8     0     8    0
knotepl    120      825    0        0    25     0    25    25     0     8    0
kqueuepl   224      612    0      598    11     6     5     5     0     8    3
pipepl     344      300    0      273     9     6     3     9     0     8    0
fdescpl    528     1793    0     1762     4     1     3     4     0     8    0
filepl     160    11937    0    11694    24     8    16    21     0     8    4
lockfpl    104      744    0      741     2     1     1     2     0     8    0
lockfspl    48      287    0      284     1     0     1     1     0     8    0
sessionpl  144       30    0       21     1     0     1     1     0     8    0
pgrppl      48       47    0       30     1     0     1     1     0     8    0
ucredpl    104     2018    0     2004     1     0     1     1     0     8    0
zombiepl   144     1784    0     1782     1     0     1     1     0     8    0
processpl  1232    1831    0     1782     6     0     6     6     0     8    0
procpl     664     4186    0     4126     8     1     7     8     0     8    0
sosppl     176       16    0       16     3     2     1     1     0     8    1
sockpl     752     2549    0     2508    25    13    12    17     0     8    7
mcl64k     65536     18    0        0     3     0     3     3     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     116    0        0    15     0    15    15     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      51    0        0     6     0     6     6     0     8    0
mtagpl      96       38    0        0     1     0     1     1     0     8    0
mbufpl     256      228    0        0    13     0    13    13     0     8    0
bufpl      280    13442    0     7306   439     0   439   439     0     8    0
anonpl      32    11889    0        0    97     1    96    96     0   246    0
amapchunkpl 152   53309    0    52730    40     2    38    39     0   158   10
amappl16   200     5853    0     5790    33    18    15    21     0     8    8
amappl15   192        1    0        1     1     1     0     1     0     8    0
amappl14   184        5    0        5     1     1     0     1     0     8    0
amappl13   176      455    0      454     1     0     1     1     0     8    0
amappl12   168     2179    0     2138     3     0     3     3     0     8    0
amappl11   160        5    0        3     1     0     1     1     0     8    0
amappl10   152       72    0       58     1     0     1     1     0     8    0
amappl9    144      245    0      245     1     1     0     1     0     8    0
amappl8    136       36    0       32     1     0     1     1     0     8    0
amappl7    128      107    0      105     1     0     1     1     0     8    0
amappl6    120      309    0      295     1     0     1     1     0     8    0
amappl5    112       90    0       77     1     0     1     1     0     8    0
amappl4    104      455    0      425     1     0     1     1     0     8    0
amappl3     96    10523    0    10415     5     1     4     4     0     8    0
amappl2     88      610    0      550     2     0     2     2     0     8    0
amappl1     80    16371    0    15780    16     1    15    15     0     8    0
amappl      88    14474    0    14293     5     0     5     5     0    92    0
uvmvnodes   80      157    0        0     4     0     4     4     0     8    0
dma65536   65536      2    0        2     1     0     1     1     0     8    1
dma8192    8192       1    0        1     1     1     0     1     0     8    0
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        7    0        7     2     2     0     1     0     8    0
dma128     128      254    0      254     2     2     0     1     0     8    0
dma64       64        7    0        7     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       58    0        7     1     0     1     1     0     8    0
uaddrrnd    24     1793    0     1762     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1793    0     1762     1     0     1     1     0     8    0
vmmpekpl   168    16322    0    16277     4     1     3     3     0     8    0
vmmpepl    168   119480    0   117495   107     4   103   104     0   357    7
vmsppl     488     1792    0     1761     6     1     5     5     0     8    0
rwobjpl     80    33328    0    32136    35     4    31    31     0     8    2
pdppl      4096    3616    0     3537   120    39    81    88     0     8    2
pvpl        32    22032    0        0   178     0   178   178     0   265    0
pmappl     256     1803    0     1765     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      331    0       63     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff837c5ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_write_1(3f8,0,6c) at x86_bus_space_io_write_1+0x40 sys/arch/amd64/amd64/bus_space.c:790
comcnputc(800,6c) at comcnputc+0x1ab bus_space_barrier sys/dev/ic/com.c:-1 [inline]
comcnputc(800,6c) at comcnputc+0x1ab sys/dev/ic/com.c:1263
cnputc(6c) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(6c) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff83389dfa) at db_printf+0x9b sys/kern/subr_prf.c:-1
panic(ffffffff833b2750) at panic+0x103 sys/kern/subr_prf.c:217
__assert(ffffffff833ef9fe,ffffffff833e5731,52e,ffffffff83406f81) at __assert+0x29 sys/kern/subr_prf.c:-1
uvm_pagedequeue(fffffd8008b33c60) at uvm_pagedequeue+0x2dd sys/uvm/uvm_page.c:1324
uvm_pageclean(fffffd8008b33c60) at uvm_pageclean+0x2ad sys/uvm/uvm_page.c:981
uvm_pagefree(fffffd8008b33c60) at uvm_pagefree+0x26 sys/uvm/uvm_page.c:1020
end trace frame: 0xffff80002ffcf8e0, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff837c5ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
x86_bus_space_io_write_1(3f8,0,6c) at x86_bus_space_io_write_1+0x40 sys/arch/amd64/amd64/bus_space.c:790
comcnputc(800,6c) at comcnputc+0x1ab bus_space_barrier sys/dev/ic/com.c:-1 [inline]
comcnputc(800,6c) at comcnputc+0x1ab sys/dev/ic/com.c:1263
cnputc(6c) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(6c) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff83389dfa) at db_printf+0x9b sys/kern/subr_prf.c:-1
panic(ffffffff833b2750) at panic+0x103 sys/kern/subr_prf.c:217
__assert(ffffffff833ef9fe,ffffffff833e5731,52e,ffffffff83406f81) at __assert+0x29 sys/kern/subr_prf.c:-1
uvm_pagedequeue(fffffd8008b33c60) at uvm_pagedequeue+0x2dd sys/uvm/uvm_page.c:1324
uvm_pageclean(fffffd8008b33c60) at uvm_pageclean+0x2ad sys/uvm/uvm_page.c:981
uvm_pagefree(fffffd8008b33c60) at uvm_pagefree+0x26 sys/uvm/uvm_page.c:1020
uvm_anfree(fffffd8062b87150) at uvm_anfree+0xe9 sys/uvm/uvm_anon.c:112
amap_wipeout(fffffd806ee63b40) at amap_wipeout+0x246 sys/uvm/uvm_amap.c:-1
uvm_unmap_detach(ffff80002ffcf9a0,0) at uvm_unmap_detach+0x8a sys/uvm/uvm_map.c:1353
uvm_map_teardown(fffffd8075c5f5d0) at uvm_map_teardown+0x360 sys/uvm/uvm_map.c:2525
exit1(ffff8000333d6fb8,0,0,1) at exit1+0x6fc sys/kern/kern_exit.c:260
sys_exit(ffff8000333d6fb8,ffff80002ffcfb70,ffff80002ffcfac0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002ffcfb70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002ffcfb70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x779b1843e8a0, count: -22
ddb{0}> machine ddbcpu 1
Stopped at      savectx+0xae:   movl    $0,%gs:0x688
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f4b09e082b0, count: 14
ddb{1}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f4b09e082b0, count: -1

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/22 10:10 openbsd 40385d83a6c6 49b0fb03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: kernel diagnostic assertion "pg->wire_count == NUM" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uv
2025/12/19 13:23 openbsd d11ef3f2eb06 e14dbeb9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: kernel diagnostic assertion "pg->wire_count == NUM" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uv
* Struck through repros no longer work on HEAD.