uvm_fault: ifiq_enqueue_qlim

Status: upstream: reported on 2026/07/28 20:25
Reported-by: syzbot+ee424ec1e507e1e118b3@syzkaller.appspotmail.com
First crash: 29d, last: 2d07h

Sample crash report:
uvm_fault(0xffffffff839d5cd0, 0xee01, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff82656f79 cs 8 rflags 10246 cr2 ee01 cpl 0 rsp ffff80002a70b0e0
gsbase 0xffffffff8399cff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff82656f79
Starting stack trace...
panic(ffffffff834be6b9) at panic+0x1ba sys/kern/subr_prf.c:229
kerntrap(ffff80002a70b030) at kerntrap+0x2fb
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
ifiq_enqueue_qlim(ee01,fffff5006f936700,2000) at ifiq_enqueue_qlim+0x39 sys/net/ifq.c:800
if_output_local(ffff800000c48000,fffff5006f936700,2) at if_output_local+0xae sys/net/if.c:1011
if_output_tso(ffff800000c48000,ffff80002a70b2f0,ffff80002a70b240,fffff5007204f660,8000) at if_output_tso+0x200 sys/net/if.c:-1
ip_output(fffff5006f936700,0,0,0,0,0,6e5cf19df8dee455) at ip_output+0x107e sys/netinet/ip_output.c:437
ip_send_do_dispatch(ffffffff839ddd58,0) at ip_send_do_dispatch+0x128 sys/netinet/ip_input.c:1960
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: 248
End of stack trace.

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/24 19:44 openbsd 38355159c0bf b55bd4c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ifiq_enqueue_qlim
2026/07/30 18:05 openbsd a3419d81e108 0a1bc234 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ifiq_enqueue_qlim
2026/07/28 20:24 openbsd e63b2cdac76f 5fe7c56f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ifiq_enqueue_qlim
* Struck through repros no longer work on HEAD.