syzbot


assert "refs > NUM" failed in kern_synch.c

Status: upstream: reported on 2025/09/09 19:41
Reported-by: syzbot+e0d831b30701aaff71bd@syzkaller.appspotmail.com
First crash: 128d, last: 46d

Sample crash report:
panic: kernel diagnostic assertion "refs > 1" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 920
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 43504  69251      0           0  0x4000000    0  syz-executor
  78522  86413      0         0x2          0    1  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833aa43c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e8e72,ffffffff833f5f7c,398,ffffffff833b1271) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_take(ffff80000148d008) at refcnt_take+0x109 sys/kern/kern_synch.c:921
if_getgroupmembers(ffff800037bf0da0) at if_getgroupmembers+0x11d sys/net/if.c:3185
sys_ioctl(ffff8000397f3a28,ffff800037bf0f80,ffff800037bf0ed0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff800037bf0f80) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037bf0f80) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x90990b43bc0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: kernel diagnostic assertion "refs > 1" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 920
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833aa43c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e8e72,ffffffff833f5f7c,398,ffffffff833b1271) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_take(ffff80000148d008) at refcnt_take+0x109 sys/kern/kern_synch.c:921
if_getgroupmembers(ffff800037bf0da0) at if_getgroupmembers+0x11d sys/net/if.c:3185
sys_ioctl(ffff8000397f3a28,ffff800037bf0f80,ffff800037bf0ed0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff800037bf0f80) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037bf0f80) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x90990b43bc0, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800037bf0c00
rbx               0xffffffff83807e07    cpu_info_full_primary+0x2e07
rdx               0xffff800001480680
rcx               0xffff8000397f3a28
rax               0xffffffff83806ff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x7887142a4c9060b9
r11               0x7a8a95cbf136b197
r12               0xffffffff83807c08    cpu_info_full_primary+0x2c08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff83306035    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff800037bf0bf0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=43504 pid=69251 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000397f22d0,0xffff8000397f2aa8
    process=0xffff80002ac5d840 user=0xffff800037bec000, vmspace=0xfffffd806ca905d8
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 35876  127417  20486      0  2           0                syz-executor
 35876  333154  20486      0  2   0x4000000                syz-executor
 25846  352935  27601      0  2           0                syz-executor
 25846  335145  27601      0  3   0x4000080  fsleep        syz-executor
 25846  452578  27601      0  2   0x4000000                syz-executor
 69251  216627  60634      0  2           0                syz-executor
*69251   43504  60634      0  7   0x4000000                syz-executor
 71123  172007   5162      0  2           0                syz-executor
 71123  244056   5162      0  3   0x4000000  lockflk       syz-executor
 71123  450973   5162      0  2   0x4000000                syz-executor
 73043  343085  29927      0  2           0                syz-executor
 73043  427900  29927      0  3   0x4000080  fsleep        syz-executor
 79559  501524      0      0  3     0x14200  acct          acct
 32277  503882      0      0  3     0x14280  nfsidl        nfsio
 25113  279115      0      0  3     0x14280  nfsidl        nfsio
 45960  378691      0      0  3     0x14280  nfsidl        nfsio
 64458   32704      0      0  3     0x14280  nfsidl        nfsio
 65778  305837      0      0  3     0x14280  nfsidl        nfsio
 25327   98842      0      0  3     0x14280  nfsidl        nfsio
 22322  507109      0      0  3     0x14280  nfsidl        nfsio
 32083  268261      0      0  3     0x14280  nfsidl        nfsio
 60509  206254      0      0  3     0x14280  nfsidl        nfsio
 27501  424010      0      0  3     0x14280  nfsidl        nfsio
 15502   90479      0      0  3     0x14280  nfsidl        nfsio
 18880   24691      0      0  3     0x14280  nfsidl        nfsio
 36677   51129      0      0  3     0x14280  nfsidl        nfsio
 90720  505778      0      0  3     0x14280  nfsidl        nfsio
 14392  259286      0      0  3     0x14280  nfsidl        nfsio
 18702  196247      0      0  3     0x14280  nfsidl        nfsio
 38019  351353      0      0  3     0x14280  nfsidl        nfsio
 84568  384959      0      0  3     0x14280  nfsidl        nfsio
 21378    5652      0      0  3     0x14280  nfsidl        nfsio
 76537  410270      0      0  3     0x14280  nfsidl        nfsio
 67402   74412  55744      0  3        0x82  wait          syz-executor
 29927  260703  55744      0  2       0xc82                syz-executor
 27601  249317  55744      0  3        0x82  nanoslp       syz-executor
 60634   69232  55744      0  2         0x3                syz-executor
 20486  496376  55744      0  2       0xc82                syz-executor
  5162   96073  55744      0  3        0x82  nanoslp       syz-executor
  6162   87038  55744      0  3        0x82  nanoslp       syz-executor
 86413   78522  55744      0  7         0x2                syz-executor
 55744  119295  40581      0  2         0x3                syz-executor
 40581  113812  32823      0  3    0x10008a  sigsusp       ksh
 32823  116886  60869      0  3        0x98  kqread        sshd-session
 60869  366491  77042      0  3        0x92  kqread        sshd-session
 60975  279858      1      0  3    0x100083  ttyopn        getty
 77042   67026      1      0  3        0x88  kqread        sshd
 67196  278279  31704     74  3   0x1100092  bpf           pflogd
 31704  292151      1      0  3        0x80  sbwait        pflogd
 63114  523124  71602     73  3   0x1100090  kqread        syslogd
 71602   84807      1      0  3    0x100082  sbwait        syslogd
 47578  123918      1      0  3    0x100080  kqread        resolvd
 25901  272782  81195     77  3    0x100092  kqread        dhcpleased
 83769  368418  81195     77  3    0x100092  kqread        dhcpleased
 81195  441409      1      0  3        0x80  kqread        dhcpleased
 52761  349895      0      0  3     0x14200  bored         smr
 63777  360970      0      0  2     0x14200                zerothread
 43055   28943      0      0  3     0x14200  aiodoned      aiodoned
 22062   40242      0      0  3     0x14200  syncer        update
 97918  116204      0      0  3     0x14200  cleaner       cleaner
 18637  468571      0      0  3     0x14200  reaper        reaper
 79115   47444      0      0  3     0x14200  pgdaemon      pagedaemon
 18613  225608      0      0  3     0x14200  bored         viomb
 50527  444696      0      0  3  0x40014200  acpi0         acpi0
 20286   62430      0      0  3  0x40014200                idle1
 70459  373705      0      0  3     0x14200  bored         softnet1
 97401  427582      0      0  3     0x14200  bored         softnet0
 29545  499147      0      0  3     0x14200  bored         systqmp
 95526  159720      0      0  3     0x14200  bored         systq
 27721  403654      0      0  3     0x14200  tmoslp        softclockmp
 80525  500793      0      0  3  0x40014200  tmoslp        softclock
 44445  194566      0      0  3  0x40014200                idle0
     1  339741      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 35876 (syz-executor) thread 0xffff8000397f8d18 (333154)
Process 25846 (syz-executor) thread 0xffff8000397f87e8 (452578)
Process 69251 (syz-executor) thread 0xffff8000397f3a28 (43504)
Process 71123 (syz-executor) thread 0xffff8000397f2038 (244056)
Process 71123 (syz-executor) thread 0xffff8000397f3790 (450973)
Process 86413 (syz-executor) thread 0xffff8000ffffc538 (78522)
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10214  11095K   11395K 166960K     12303        0
            pcb    18     13K      14K 166960K       160        0
         rtable   235     10K      11K 166960K       465        0
             pf    37     18K      83K 166960K       119        0
         ifaddr    39      6K       7K 166960K        81        0
        ifgroup    58      2K       3K 166960K       126        0
         sysctl     4      1K       9K 166960K        17        0
       counters    70     37K      38K 166960K       154        0
       ioctlops     0      0K       4K 166960K      1652        0
            iov     0      0K      12K 166960K        76        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1394     88K      89K 166960K      1961        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      2K       9K 166960K        13        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        33        0
        dirhash    12      2K       2K 166960K        21        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      89K 166960K       795        0
          sigio     0      0K       0K 166960K        13        0
           proc    76    131K     164K 166960K       628        0
        subproc    72      4K       4K 166960K        81        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       158        0
       in_multi    81      5K       7K 166960K       145        0
    ether_multi     1      0K       0K 166960K        10        0
            mrt     1      0K       0K 166960K         5        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   103    466K     466K 166960K       103        0
           exec     0      0K       1K 166960K       549        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   245    167K     181K 166960K      9093        0
       UVM aobj    14      2K       4K 166960K        18        0
     pinsyscall    42     84K      98K 166960K      1948        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        58        0
            NDP    12      0K       1K 166960K        56        0
           temp    70   8678K    8751K 166960K     47604        0
         kqueue    13     20K      28K 166960K       131        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       80    0       77     1     0     1     1     0     8    0
rtentry    176      138    0       41     6     1     5     6     0     8    0
unpcb      144      493    0      475     6     3     3     3     0     8    2
syncache   336        3    0        3     1     1     0     1     0     8    0
tcpcb      736      270    0      266    10     8     2     7     0     8    1
arp        136       22    0        7     1     0     1     1     0     8    0
ipq         40        1    0        1     1     1     0     1     0     8    0
ipqe        40        3    0        3     1     1     0     1     0     8    0
inpcb      328      801    0      792    18    16     2    12     0     8    1
nd6        152       31    0       10     1     0     1     1     0     8    0
pkpcb       40       33    0       33     1     1     0     1     0     8    0
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1192      36    0       36     1     0     1     1     0     8    1
pppxif     1504       2    0        2     1     1     0     1     0     8    0
pfstscr     40        2    0        0     1     0     1     1     0     8    0
pffrag     232       10    0        3     1     0     1     1     0   482    0
pffrnode    88       10    0        3     1     0     1     1     0     8    0
pffrent     40      106    0       99     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        1     1     0     1     1     0     8    1
pfanchor   1288       1    0        1     1     0     1     1     0     8    1
pftag       88        1    0        1     1     0     1     1     0     8    1
pfstitem    24       56    0       16     1     0     1     1     0     8    0
pfstkey    128       56    0       17     2     0     2     2     0     8    0
pfstate    448       55    0       16     5     0     5     5     0     8    0
pfrule     1344      22    0       17     2     1     1     2     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      533    0      141    31     3    28    29     0     8    1
art_table   40      536    0      141     5     0     5     5     0     8    0
art_node    32      137    0       49     1     0     1     1     0     8    0
sysvmsgpl   40        8    0        5     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       28    0       18     1     0     1     1     0     8    0
shmpl      112       14    0        3     1     0     1     1     0     8    0
dirhash    1024      23    0        6     3     0     3     3     0     8    0
dino2pl    256     2796    0     1295    95     0    95    95     0     8    0
ffsino     296     2796    0     1295   117     0   117   117     0     8    0
nchpl      144     3914    0     2215    64     0    64    64     0     8    0
rtmask      32        7    0        7     2     2     0     1     0     8    0
vnodes     216     3229    0        0   180     0   180   180     0     8    0
namei      1024   12864    0    12864     3     2     1     2     0     8    1
percpumem   16       92    0       42     1     0     1     1     0     8    0
vmpool     840        1    0        1     1     1     0     1     0     8    0
kstatmem   264       78    0       50     3     0     3     3     0     8    1
scsiplug    72        4    0        4     2     1     1     1     0     8    1
scxspl     216    20880    0    20880    10     2     8     8     1     8    8
plimitpl   152      227    0      210     1     0     1     1     0     8    0
sigapl     424     1124    0     1056     9     1     8     8     0     8    0
knotepl    120      558    0        0    17     0    17    17     0     8    0
kqueuepl   224      315    0      305     7     2     5     5     0     8    4
pipepl     344      218    0      191     3     0     3     3     0     8    0
fdescpl    528     1086    0     1055     3     0     3     3     0     8    0
filepl     160     6082    0     5864    21     7    14    18     0     8    2
lockfpl    104      205    0      201     1     0     1     1     0     8    0
lockfspl    48       88    0       84     1     0     1     1     0     8    0
sessionpl  144       23    0       14     1     0     1     1     0     8    0
pgrppl      48       46    0       29     1     0     1     1     0     8    0
ucredpl    104      747    0      734     1     0     1     1     0     8    0
zombiepl   144     1392    0     1390     1     0     1     1     0     8    0
processpl  1232    1124    0     1056     7     1     6     6     0     8    0
procpl     664     2341    0     2266     8     0     8     8     0     8    0
sosppl     176        2    0        2     1     0     1     1     0     8    1
sockpl     752     1423    0     1393    30    22     8    21     0     8    4
mcl64k     65536      4    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     130    0        0    17     0    17    17     0     8    0
mcl2k      2048      30    0        0     4     0     4     4     0     8    0
mtagpl      96       94    0        0     3     0     3     3     0     8    0
mbufpl     256     1270    0        0    79     0    79    79     0     8    0
bufpl      280     8211    0     2075   439     0   439   439     0     8    0
anonpl      32    10539    0        0    85     0    85    85     0   246    0
amapchunkpl 152   29599    0    29098    37     8    29    30     0   158    7
amappl16   200     3956    0     3917    41    26    15    22     0     8    7
amappl15   192       10    0       10     1     1     0     1     0     8    0
amappl14   184       58    0       58     2     2     0     1     0     8    0
amappl13   176      438    0      437     1     0     1     1     0     8    0
amappl12   168     1477    0     1435     2     0     2     2     0     8    0
amappl11   160        7    0        7     1     1     0     1     0     8    0
amappl10   152       50    0       36     1     0     1     1     0     8    0
amappl9    144      279    0      279     1     1     0     1     0     8    0
amappl8    136       26    0       24     1     0     1     1     0     8    0
amappl7    128       83    0       82     1     0     1     1     0     8    0
amappl6    120      302    0      287     1     0     1     1     0     8    0
amappl5    112       89    0       77     1     0     1     1     0     8    0
amappl4    104      453    0      423     1     0     1     1     0     8    0
amappl3     96     5202    0     5106     4     1     3     3     0     8    0
amappl2     88     1191    0     1115     2     0     2     2     0     8    0
amappl1     80    11808    0    11215    14     1    13    14     0     8    0
amappl      88     8245    0     8077     6     1     5     5     0    92    0
uvmvnodes   80      117    0        0     3     0     3     3     0     8    0
dma65536   65536      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     1     1     1     0     8    1
dma64       64        7    0        7     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       17    0        4     1     0     1     1     0     8    0
uaddrrnd    24     1086    0     1055     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1086    0     1055     1     0     1     1     0     8    0
vmmpekpl   168    10338    0    10292     3     0     3     3     0     8    0
vmmpepl    168    75931    0    73989   119    15   104   104     0   357   11
vmsppl     488     1085    0     1055     5     0     5     5     0     8    0
rwobjpl     80    22732    0    21658    34     4    30    30     0     8    2
pdppl      4096    2182    0     2112   106    34    72    84     0     8    2
pvpl        32    18695    0        0   152     1   151   151     0   265    0
pmappl     256     1086    0     1056     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      366    0       50    10     0    10    10     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833aa43c) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff833e8e72,ffffffff833f5f7c,398,ffffffff833b1271) at __assert+0x29 sys/kern/subr_prf.c:-1
refcnt_take(ffff80000148d008) at refcnt_take+0x109 sys/kern/kern_synch.c:921
if_getgroupmembers(ffff800037bf0da0) at if_getgroupmembers+0x11d sys/net/if.c:3185
sys_ioctl(ffff8000397f3a28,ffff800037bf0f80,ffff800037bf0ed0) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff800037bf0f80) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037bf0f80) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x90990b43bc0, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839a9320) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff839a9320) at __mp_lock+0x192 sys/kern/kern_lock.c:165
__mp_acquire_count(ffffffff839a9320,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:369
biowait(fffffd800b081230) at biowait+0xc6 sys/kern/vfs_bio.c:1242
bwrite(fffffd800b081230) at bwrite+0x2e7 sys/kern/vfs_bio.c:754
ffs_update(fffffd806b71b4e0,1) at ffs_update+0x2fe sys/ufs/ffs/ffs_inode.c:111
ffs_truncate(fffffd806b71b4e0,0,4,fffffd80097fd618) at ffs_truncate+0xc9b sys/ufs/ffs/ffs_inode.c:-1
ufs_rmdir(ffff80002a2e8700) at ufs_rmdir+0x2f1 sys/ufs/ufs/ufs_vnops.c:1265
VOP_RMDIR(fffffd806e2cc6f8,fffffd80653b4998,ffff80002a2e87d8) at VOP_RMDIR+0x192 sys/kern/vfs_vops.c:413
dounlinkat(ffff8000ffffc538,ffffff9c,77c38368f5f0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1901
syscall(ffff80002a2e8950) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2e8950) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
end trace frame: 0xffff80002a2e89d0, count: 0
ddb{1}> trace
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839a9320) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff839a9320) at __mp_lock+0x192 sys/kern/kern_lock.c:165
__mp_acquire_count(ffffffff839a9320,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:369
biowait(fffffd800b081230) at biowait+0xc6 sys/kern/vfs_bio.c:1242
bwrite(fffffd800b081230) at bwrite+0x2e7 sys/kern/vfs_bio.c:754
ffs_update(fffffd806b71b4e0,1) at ffs_update+0x2fe sys/ufs/ffs/ffs_inode.c:111
ffs_truncate(fffffd806b71b4e0,0,4,fffffd80097fd618) at ffs_truncate+0xc9b sys/ufs/ffs/ffs_inode.c:-1
ufs_rmdir(ffff80002a2e8700) at ufs_rmdir+0x2f1 sys/ufs/ufs/ufs_vnops.c:1265
VOP_RMDIR(fffffd806e2cc6f8,fffffd80653b4998,ffff80002a2e87d8) at VOP_RMDIR+0x192 sys/kern/vfs_vops.c:413
dounlinkat(ffff8000ffffc538,ffffff9c,77c38368f5f0,8) at dounlinkat+0x2e0 sys/kern/vfs_syscalls.c:1901
syscall(ffff80002a2e8950) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2e8950) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77c38368f5e0, count: -15

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/30 12:16 openbsd 0086034dedf2 01c07bfe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs > NUM" failed in kern_synch.c
2025/10/23 11:36 openbsd 22e0e8faf4c6 c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "refs > NUM" failed in kern_synch.c
2025/09/09 19:40 openbsd 3efab2192dd6 fdeaa69b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "refs > NUM" failed in kern_synch.c
* Struck through repros no longer work on HEAD.