KASAN: invalid memory access in __mp_lock

Status: upstream: reported on 2026/07/11 14:48
Reported-by: syzbot+e25d17ace82c96de4887@syzkaller.appspotmail.com
First crash: 41d, last: 38d

Sample crash report:
panic: Caught invalid memory access at ffff80000191b3b0 size 104 op 1
Stopped at      db_enter+0x17:  popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 259599  11948      0           0          0    0  syz-executor
*461408  11948      0           0  0x4000000    1K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84635b4e) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff80000191b3b0,ffff800001e0d6a8,68) at kasan_memcpy+0x1ec
sysctl_sysvipc(ffff80003bbc4588,1,200000000040,ffff80003bbc4560) at sysctl_sysvipc+0x422 sys/kern/kern_sysctl.c:2777
kern_sysctl_dirs(33,ffff80003bbc4588,1,200000000040,ffff80003bbc4560,0,1,1ffff00007778828) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bbc4584,2,200000000040,ffff80003bbc4560,0,0,ffff80003bbc47d0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800029933a08,ffff80003bbc47d0,ffff80003bbc4740) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bbc47d0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bbc47d0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe04066beb70, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff80000191b3b0 size 104 op 1
ddb{1}> show kasan
KASAN: invalid write of 104 bytes at 0xffff80000191b3b0 from pc 0xffffffff82e1bb02
KASAN: first bad byte at 0xffff80000191b414 (+100); shadow 0x04: partial granule (out-of-bounds)
KASAN: 0xffff80000191b414 is 13332 bytes inside the 16384-byte malloc slot [0xffff800001918000..0xffff80000191c000)
KASAN: allocated at:
#0  malloc+0xda0 sys/kern/kern_malloc.c:446
#1  sysctl_sysvipc+0x237 sys/kern/kern_sysctl.c:2732
#2  kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
#3  kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#4  sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#5  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
KASAN: pc: sysctl_sysvipc+0x422
KASAN: call trace:
#0  kasan_memcpy+0x1ca kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0  kasan_memcpy+0x1ca sys/kern/subr_kasan.c:1025
#1  sysctl_sysvipc+0x422 sys/kern/kern_sysctl.c:2777
#2  kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
#3  kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#4  sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#5  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
KASAN: shadow of 0xffff80000191b300..0xffff80000191b580 (1 cell = 8 bytes):
 0xffff80000191b300: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
 0xffff80000191b380: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08
>0xffff80000191b400: 08 08[04]fb fe fe fe fe fe fe fe fe fe fe fe fe
 0xffff80000191b480: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 0xffff80000191b500: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84635b4e) at panic+0x270 sys/kern/subr_prf.c:198
kasan_memcpy(ffff80000191b3b0,ffff800001e0d6a8,68) at kasan_memcpy+0x1ec
sysctl_sysvipc(ffff80003bbc4588,1,200000000040,ffff80003bbc4560) at sysctl_sysvipc+0x422 sys/kern/kern_sysctl.c:2777
kern_sysctl_dirs(33,ffff80003bbc4588,1,200000000040,ffff80003bbc4560,0,1,1ffff00007778828) at kern_sysctl_dirs+0x407 sys/kern/kern_sysctl.c:445
kern_sysctl(ffff80003bbc4584,2,200000000040,ffff80003bbc4560,0,0,ffff80003bbc47d0) at kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
sys_sysctl(ffff800029933a08,ffff80003bbc47d0,ffff80003bbc4740) at sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
syscall(ffff80003bbc47d0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bbc47d0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe04066beb70, count: -9
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003bbc3d90
rbx               0xffff80003bbc3e00
rdx                                0
rcx               0xffff800028fe3ff0
rax                                0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xffff80003bbc3b78
r11               0xffffffff83f284c0    x86_bus_space_io_read_1
r12               0xffffffff84635b4e    .str.23+0x9d50e
r13               0xffff800028fe4c08
r14               0xffff800028fe4e07
r15                              0x1
rip               0xffffffff818a32b7    db_enter+0x17
cs                               0x8
rflags                         0x246
rsp               0xffff80003bbc3d90
ss                              0x10
db_enter+0x17:  popq    %rbp
ddb{1}> show proc
PROC (syz-executor) tid=461408 pid=11948 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800029932018,0xffff800029913778
    process=0xffff800045fef048 user=0xffff80003bbb9000, vmspace=0xffff800001c7dd78
    estcpu=36, cpticks=16, pctcpu=0.0, user=0, sys=16, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 11948  259599   3822      0  7           0                syz-executor
 11948  110774   3822      0  3   0x4000080  kqsel         syz-executor
*11948  461408   3822      0  7   0x4000000                syz-executor
 11948  443341   3822      0  3   0x4000080  fsleep        syz-executor
 86322  165362  62770      0  3        0x90  nanoslp       syz-executor
 86322   12978  62770      0  3   0x4000090  sbwait        syz-executor
 97807  137923  72549      0  3        0x80  nanoslp       syz-executor
 97807   64307  72549      0  3   0x4000080  fifow         syz-executor
 97807  460153  72549      0  3   0x4000080  fsleep        syz-executor
 34178  445362  43654      0  3        0x80  nanoslp       syz-executor
 34178  204377  43654      0  3   0x4000080  pipewr        syz-executor
 34178  371927  43654      0  3   0x4000080  fsleep        syz-executor
 91639  483299  15340      0  3        0x80  nanoslp       syz-executor
 91639  310317  15340      0  3   0x4000080  bell          syz-executor
 91639  154156  15340      0  3   0x4000080  fsleep        syz-executor
 17372   19811      1      0  3        0x80  nanoslp       init
 18122  345650      0      0  3     0x14280  nfsidl        nfsio
 51097  427989      0      0  3     0x14280  nfsidl        nfsio
 94940  334285      0      0  3     0x14280  nfsidl        nfsio
  2096  484165      0      0  3     0x14280  nfsidl        nfsio
 17092   45515      0      0  3     0x14280  nfsidl        nfsio
 95610   48648      0      0  3     0x14280  nfsidl        nfsio
 15937  180910      0      0  3     0x14280  nfsidl        nfsio
 23159  294376      0      0  3     0x14280  nfsidl        nfsio
 37095  203248      0      0  3     0x14280  nfsidl        nfsio
 15569  195220      0      0  3     0x14280  nfsidl        nfsio
 49654  381082      0      0  3     0x14280  nfsidl        nfsio
 50071  340619      0      0  3     0x14280  nfsidl        nfsio
 27312  398027      0      0  3     0x14280  nfsidl        nfsio
 67680  194762      0      0  3     0x14280  nfsidl        nfsio
 56334  109260      0      0  3     0x14280  nfsidl        nfsio
 82066  372415      0      0  3     0x14280  nfsidl        nfsio
 30300   60647      0      0  3     0x14280  nfsidl        nfsio
 25901  444439      0      0  3     0x14280  nfsidl        nfsio
 44625   23562      0      0  3     0x14280  nfsidl        nfsio
 88075  168845      0      0  3     0x14280  nfsidl        nfsio
 22795  261994  51053      0  3    0x100082  sbwait        ndp
 51053  313809   2279      0  3    0x10008a  sigsusp       sh
 78331  503212  85997      0  3        0x82  nanoslp       syz-executor
 62770   27583  85997      0  3        0x82  nanoslp       syz-executor
  2279  240367  85997      0  3        0x82  wait          syz-executor
 72549    3034  85997      0  3        0x82  nanoslp       syz-executor
 31629  352143  85997      0  3        0x82  wait          syz-executor
 15340  151962  85997      0  3        0x82  nanoslp       syz-executor
  3822  417855  85997      0  3        0x82  nanoslp       syz-executor
 43654  291399  85997      0  3        0x82  nanoslp       syz-executor
 85997   23284      1      0  3        0x82  kqread        syz-executor
  2422  295584      0      0  3     0x14200  bored         smr
  5170  381057      0      0  3     0x14200  pgzero        zerothread
  5235  306664      0      0  3     0x14200  aiodoned      aiodoned
 78383  430769      0      0  3     0x14200  syncer        update
 97606  461127      0      0  3     0x14200  cleaner       cleaner
 84905   76524      0      0  3     0x14200  reaper        reaper
 59195  177603      0      0  3     0x14200  pgdaemon      pagedaemon
 93101  264470      0      0  3     0x14200  bored         viomb
 76674  486452      0      0  3  0x40014200  acpi0         acpi0
 23752  127311      0      0  3  0x40014200                idle1
 15117  196565      0      0  3     0x14200  bored         softnet1
 25812  162043      0      0  3     0x14200  bored         softnet0
 23814  231416      0      0  3     0x14200  bored         systqmp
 47320  204425      0      0  3     0x14200  bored         systq
 79958  223003      0      0  3     0x14200  tmoslp        softclockmp
 47688   92069      0      0  3  0x40014200  tmoslp        softclock
 90770  515557      0      0  3  0x40014200                idle0
     1  174573      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 11948 (syz-executor) thread 0xffff800029933a08 (461408)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff854812c0)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  sysctl_vslock+0x72 sys/kern/kern_sysctl.c:197
#2  kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443
#3  kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#4  sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#5  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
exclusive rwlock sysctllk r = 0 (0xffffffff8516b098)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x53e sys/kern/kern_rwlock.c:320
#2  sysctl_vslock+0x37 sys/kern/kern_sysctl.c:192
#3  kern_sysctl_dirs+0x2d2 sys/kern/kern_sysctl.c:443
#4  kern_sysctl+0x1ce sys/kern/kern_sysctl.c:529
#5  sys_sysctl+0x54f sys/kern/kern_sysctl.c:309
#6  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11052  12172K   12470K 166960K     12641        0
            pcb    17     24K      24K 166960K        79        0
         rtable   240     13K      13K 166960K       354        0
             pf    34     22K      24K 166960K        76        0
         ifaddr    43     12K      13K 166960K        57        0
        ifgroup    55      2K       2K 166960K        86        0
         sysctl     2      1K      13K 166960K        12        0
       counters    70     42K      43K 166960K        90        0
       ioctlops     0      0K       4K 166960K      1590        0
            iov     0      0K      16K 166960K        16        0
          mount     1      1K       1K 166960K         1        0
            log     2      0K       0K 166960K         6        0
         vnodes  1366     88K      88K 166960K      1909        0
      UFS quota     1     36K      36K 166960K         1        0
      UFS mount     5     44K      44K 166960K         5        0
            shm     3      6K      10K 166960K        40        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        30        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     292K 166960K     11964        0
      file desc    18     69K      97K 166960K       535        0
          sigio     0      0K       0K 166960K         5        0
           proc    13     30K     177K 166960K       641        0
        subproc    72      9K       9K 166960K        73        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     20K      20K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         8        0
       in_multi    99      7K       7K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K        17        0
    ISOFS mount     1     36K      36K 166960K         1        0
  MSDOSFS mount     1     20K      20K 166960K         1        0
           ttys    79    546K     546K 166960K        79        0
           exec     0      0K       2K 166960K       469        0
   fusefs mount     1     36K      36K 166960K         1        0
            tdb     3      1K       1K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   156    126K     280K 166960K      6792        0
       UVM aobj   131      7K       7K 166960K       132        0
     pinsyscall  1045   1861K    1861K 166960K      1703        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K         2        0
            NDP    12      0K       2K 166960K        38        0
           temp    48   9189K    9189K 166960K      7004        0
         kqueue     2      8K      60K 166960K       128        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       67    0       66     2     0     2     2     0     8    1
rtentry    176      112    0        1     6     0     6     6     0     8    0
unpcb      144      370    0      362     2     0     2     2     0     8    1
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736       47    0       45     1     0     1     1     0     8    0
arp        136       19    0        0     1     0     1     1     0     8    0
inpcb      328      268    0      265     2     0     2     2     0     8    1
nd6        152       24    0        0     1     0     1     1     0     8    0
pkpcb       40        4    0        4     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       6    0        6     1     0     1     1     0     8    1
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        2    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfqueue    320        1    0        1     1     0     1     1     0     8    1
pfstitem    24       45    0        1     1     0     1     1     0     8    0
pfstkey    128       45    0        1     2     0     2     2     0     8    0
pfstate    448       45    0        1     5     0     5     5     0     8    0
pfrule     1360      23    0       18     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      453    0        0    29     0    29    29     0     8    0
art_table   40      454    0        0     5     0     5     5     0     8    0
art_node    32      112    0       11     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        2     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl      72       27    0       17     1     0     1     1     0     8    0
shmpl      112      129    0        1     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     2353    0      879    93     0    93    93     0     8    0
ffsino     296     2353    0      879   114     0   114   114     0     8    0
nchpl      144     3157    0     1456    64     0    64    64     0     8    0
vnodes     216     2756    0        0   154     0   154   154     0     8    0
namei      1024   10601    0    10601     1     0     1     1     0     8    1
percpumem   16       61    0       10     1     0     1     1     0     8    0
kstatmem   264       47    0       20     3     0     3     3     0     8    1
scxspl     216    10002    0    10002    11     3     8     8     1     8    8
plimitpl   152       91    0       82     1     0     1     1     0     8    0
sigapl     424      876    0      819     8     0     8     8     0     8    0
knotepl    120      136    0        0     5     0     5     5     0     8    0
kqueuepl   224      298    0      294     6     1     5     5     0     8    4
pipepl     344      275    0      247     4     0     4     4     0     8    1
fdescpl    528      840    0      819     3     0     3     3     0     8    0
filepl     160     5224    0     5051    15     1    14    15     0     8    3
lockfpl    104      279    0      279     2     1     1     2     0     8    1
lockfspl    48      132    0      132     1     0     1     1     0     8    1
sessionpl  144      207    0      205     1     0     1     1     0     8    0
pgrppl      48      218    0      208     1     0     1     1     0     8    0
ucredpl    104     1162    0     1157     1     0     1     1     0     8    0
zombiepl   144      821    0      819     1     0     1     1     0     8    0
processpl  1232     876    0      819     6     0     6     6     0     8    0
procpl     664     1570    0     1503     7     0     7     7     0     8    0
sockpl     752      714    0      702     5     0     5     5     0     8    3
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     121    0        0    16     0    16    16     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      22    0        0     3     0     3     3     0     8    0
mextrefs    64       18    0        0     1     0     1     1     0     8    0
mtagpl      96        4    0        0     1     0     1     1     0     8    0
mbufpl     256      183    0        0    12     0    12    12     0     8    0
bufpl      272     2952    0      110   190     0   190   190     0     8    0
anonpl      32     5849    0        0    48     0    48    48     0   222    0
amapchunkpl 152   20788    0    20375    24     0    24    24     0   158    7
amappl16   200     2294    0     2268     6     3     3     5     0     8    0
amappl15   192       39    0       39     2     2     0     1     0     8    0
amappl14   184      439    0      438     1     0     1     1     0     8    0
amappl13   176      126    0      125     1     0     1     1     0     8    0
amappl12   168     1088    0     1069     2     0     2     2     0     8    0
amappl11   160       16    0       16     3     2     1     1     0     8    1
amappl10   152       80    0       80     1     0     1     1     0     8    1
amappl9    144      271    0      271     1     1     0     1     0     8    0
amappl8    136       99    0       98     1     0     1     1     0     8    0
amappl7    128      159    0      156     1     0     1     1     0     8    0
amappl6    120      155    0      154     1     0     1     1     0     8    0
amappl5    112      117    0      117     1     0     1     1     0     8    1
amappl4    104      317    0      314     1     0     1     1     0     8    0
amappl3     96     4218    0     4126     4     0     4     4     0     8    0
amappl2     88      560    0      549     2     0     2     2     0     8    0
amappl1     80    12100    0    11978    15     0    15    15     0     8    4
amappl      88     5971    0     5834     5     0     5     5     0    92    0
uvmvnodes   80      115    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      131    0        1     3     0     3     3     0     8    0
uaddrrnd    24      840    0      819     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      840    0      819     1     0     1     1     0     8    0
vmmpekpl   168     9131    0     9097     3     0     3     3     0     8    1
vmmpepl    168    61036    0    60117    88     0    88    88     0   357   43
vmsppl     488      839    0      819     5     0     5     5     0     8    0
rwobjpl     80    19463    0    18865    25     0    25    25     0     8    1
pdppl      4096    1689    0     1638    99    46    53    89     0     8    2
pvpl        32    14060    0        0   115     1   114   114     0   265    0
pmappl     256      839    0      819     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      464    0       50    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x19:        leave
x86_ipi_db(ffffffff85143ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff854812b8) at __asan_load4_noabort+0x16 kasan_shadow_check sys/kern/subr_kasan.c:972 [inline]
__asan_load4_noabort(ffffffff854812b8) at __asan_load4_noabort+0x16 sys/kern/subr_kasan.c:1098
__mp_lock(ffffffff85480ac0) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85480ac0) at __mp_lock+0x27a sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x72e44c69ea00, count: 7
ddb{0}> trace
x86_ipi_db(ffffffff85143ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__asan_load4_noabort(ffffffff854812b8) at __asan_load4_noabort+0x16 kasan_shadow_check sys/kern/subr_kasan.c:972 [inline]
__asan_load4_noabort(ffffffff854812b8) at __asan_load4_noabort+0x16 sys/kern/subr_kasan.c:1098
__mp_lock(ffffffff85480ac0) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85480ac0) at __mp_lock+0x27a sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at X

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/14 02:51 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan dbfd7807b1e0 2130f682 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in __mp_lock
2026/07/11 14:48 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 275dedaf93b0 d78ea535 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in __mp_lock
* Struck through repros no longer work on HEAD.