uvm_fault: ifiq_enqueue_qlim

Status: upstream: reported on 2026/07/28 20:25
Reported-by: syzbot+ee424ec1e507e1e118b3@syzkaller.appspotmail.com
First crash: 75d, last: 12d

Sample crash report:
V…²Duvm_fault(0xfffff1806fbe27a8, 0x6abbac85, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      ifiq_enqueue_qlim+0x39: movq    0(%r15),%rax
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*123732  70129      0           0  0x4000000    1  syz-executor
 155823  78828      0         0x2          0    0  syz-executor
ifiq_enqueue_qlim(6abbac85,fffff1806f8efe00,2000) at ifiq_enqueue_qlim+0x39 sys/net/ifq.c:800
if_output_local(ffff800000c31000,fffff1806f8efe00,2) at if_output_local+0xae sys/net/if.c:1011
if_output_tso(ffff800000c31000,ffff80002a2e2650,fffff1806ffa5838,fffff1806cb6d6e8,8000) at if_output_tso+0x200 sys/net/if.c:-1
ip_output(fffff1806f8efe00,0,fffff1806ffa5820,800,0,fffff1806ffa58b8,62ff0e85225235d7) at ip_output+0x107f sys/netinet/ip_output.c:437
tcp_output(ffff8000015d89e0) at tcp_output+0x36e3 sys/netinet/tcp_output.c:1070
tcp_connect(ffff80000158b498,fffff1806f8ef500) at tcp_connect+0x573 sys/netinet/tcp_usrreq.c:694
sys_connect(ffff800045fe8fb8,ffff80002a2e2a60,ffff80002a2e29b0) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420
syscall(ffff80002a2e2a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2e2a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdc47b0ed220, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffff1806fbe27a8, 0x6abbac85, 0, 1) -> e
ddb{1}> show kasan
No such command
ddb{1}> trace
ifiq_enqueue_qlim(6abbac85,fffff1806f8efe00,2000) at ifiq_enqueue_qlim+0x39 sys/net/ifq.c:800
if_output_local(ffff800000c31000,fffff1806f8efe00,2) at if_output_local+0xae sys/net/if.c:1011
if_output_tso(ffff800000c31000,ffff80002a2e2650,fffff1806ffa5838,fffff1806cb6d6e8,8000) at if_output_tso+0x200 sys/net/if.c:-1
ip_output(fffff1806f8efe00,0,fffff1806ffa5820,800,0,fffff1806ffa58b8,62ff0e85225235d7) at ip_output+0x107f sys/netinet/ip_output.c:437
tcp_output(ffff8000015d89e0) at tcp_output+0x36e3 sys/netinet/tcp_output.c:1070
tcp_connect(ffff80000158b498,fffff1806f8ef500) at tcp_connect+0x573 sys/netinet/tcp_usrreq.c:694
sys_connect(ffff800045fe8fb8,ffff80002a2e2a60,ffff80002a2e29b0) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420
syscall(ffff80002a2e2a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2e2a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdc47b0ed220, count: -9
ddb{1}> show registers
rdi                       0x6abbac85
rsi               0xfffff1806f8efe00
rbp               0xffff80002a2e2490
rbx                              0x2
rdx                                0
rcx               0xffff800045fe8fb8
rax               0xffff80002999dff0
r8                            0x1000    __ALIGN_SIZE
r9                            0x8000    __ALIGN_SIZE+0x7000
r10               0x9c91eabfb27694db
r11               0xb8dfc44a70639e0c
r12                           0x2000    __ALIGN_SIZE+0x1000
r13                           0x4000    __ALIGN_SIZE+0x3000
r14               0xfffff1806f8efe00
r15                       0x6abbac85
rip               0xffffffff82284499    ifiq_enqueue_qlim+0x39
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a2e2440
ss                              0x10
ifiq_enqueue_qlim+0x39: movq    0(%r15),%rax
ddb{1}> show proc
PROC (syz-executor) tid=123732 pid=70129 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=71, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c3d1cb8,0xffff800045fe94f8
    process=0xffff800045fec018 user=0xffff80002a2dd000, vmspace=0xfffff1806fbe27a8
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
  8196  471702  64283     0  2           0          0           syz-executor
 60935  504082  59929     0  2           0          0           syz-executor
 60935  167523  59929     0  2           0  0x4000080           syz-executor
 73703  445580  57522     0  2           0          0           syz-executor
 73703  115146  57522     0  2           0  0x4000000           syz-executor
 88063  389195  39454     0  2         0x2          0           ifconfig
 39454   31567  29552     0  3    0x100002       0x88 sigsusp   sh
 70129  329616  78828     0  2           0          0           syz-executor
*70129  123732  78828     0  7           0  0x4000000           syz-executor
 70129  328222  78828     0  2           0  0x4000000           syz-executor
  2606  442438  13033     0  2           0          0           syz-executor
  2606  480678  13033     0  3           0  0x4000080 fsleep    syz-executor
 88762   76518  82867     0  2           0          0           syz-executor
 88762  289419  82867     0  2           0  0x4000000           syz-executor
 29552  258440  54131     0  3         0x2       0x80 wait      syz-executor
 57522  279772  54131     0  2         0x2      0xc80           syz-executor
 82867  387167  54131     0  3         0x2       0x80 nanoslp   syz-executor
 78828  155823  54131     0  7         0x2          0           syz-executor
 59929   93611  54131     0  2         0x2      0xc80           syz-executor
 21428  489200      0     0  3     0x14000      0x280 nfsidl    nfsio
  5012  469842      0     0  3     0x14000      0x280 nfsidl    nfsio
 17897  170905      0     0  3     0x14000      0x280 nfsidl    nfsio
 69909   56873      0     0  3     0x14000      0x280 nfsidl    nfsio
 99989   62021      0     0  3     0x14000      0x280 nfsidl    nfsio
 16133  116576      0     0  3     0x14000      0x280 nfsidl    nfsio
 77793  228969      0     0  3     0x14000      0x280 nfsidl    nfsio
 70693  299721      0     0  3     0x14000      0x280 nfsidl    nfsio
 92856  260449      0     0  3     0x14000      0x280 nfsidl    nfsio
 65397  286432      0     0  3     0x14000      0x280 nfsidl    nfsio
 50245  124917      0     0  3     0x14000      0x280 nfsidl    nfsio
 52146  135032      0     0  3     0x14000      0x280 nfsidl    nfsio
 92078  177792      0     0  3     0x14000      0x280 nfsidl    nfsio
 49790  185546      0     0  3     0x14000      0x280 nfsidl    nfsio
 78015  513005      0     0  3     0x14000      0x280 nfsidl    nfsio
 54972  287047      0     0  3     0x14000      0x280 nfsidl    nfsio
 14531  145339      0     0  3     0x14000      0x280 nfsidl    nfsio
  8747  406126      0     0  3     0x14000      0x280 nfsidl    nfsio
 96813  245660      0     0  3     0x14000      0x280 nfsidl    nfsio
  4877  175272      0     0  3     0x14000      0x280 nfsidl    nfsio
 27785   24813      1     0  3           0       0x80 nanoslp   init
 75735  404941  54131     0  2  0x10000002          0           syz-executor
 64283   56481  54131     0  3         0x2       0x80 nanoslp   syz-executor
 13033   78253  54131     0  3         0x2       0x80 nanoslp   syz-executor
 54131  453457      1     0  3         0x2       0x80 kqread    syz-executor
  2134  440149  43664     0  3        0x10       0x88 kqread    sshd-session
 43664   28690      1     0  3        0x12       0x80 kqread    sshd-session
 73095  443361      1    74  3   0x1100012       0x80 bpf       pflogd
 77333  500198      1    73  3   0x1100010       0x80 kqread    syslogd
 59424  124185      0     0  3     0x14000      0x200 bored     smr
 47823  156736      0     0  2     0x14000      0x200           zerothread
 50295  481698      0     0  3     0x14000      0x200 aiodoned  aiodoned
 60991   92499      0     0  3     0x14000      0x200 syncer    update
  1578   95632      0     0  3     0x14000      0x200 cleaner   cleaner
 98775   23441      0     0  3     0x14000      0x200 reaper    reaper
 40030  277736      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 69595  338053      0     0  3     0x14000      0x200 bored     viomb
 98939  123231      0     0  3     0x14000 0x40000200 acpi0     acpi0
 24917    2837      0     0  3     0x14000 0x40000200           idle1
 10456  448734      0     0  3     0x14000      0x200 bored     softnet1
 28315  251847      0     0  3     0x14000      0x200 bored     softnet0
 34296  244304      0     0  3     0x14000      0x200 bored     systqmp
 67176  463036      0     0  3     0x14000      0x200 bored     systq
 81509  375394      0     0  3     0x14000      0x200 tmoslp    softclockmp
  9463   82492      0     0  3     0x14000 0x40000200 tmoslp    softclock
 76956   83905      0     0  3     0x14000 0x40000200           idle0
     1  410709      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 70129 (syz-executor) thread 0xffff800045fe8fb8 (123732)
exclusive rwlock inet46 r = 0 (0xffff80000158b4b8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  sys_connect+0x32c isdnssocket sys/kern/uipc_syscalls.c:-1 [inline]
#2  sys_connect+0x32c sys/kern/uipc_syscalls.c:411
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
shared rwlock netlock r = 0 (0xffffffff8391a3d0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  solock_shared+0x6e sys/kern/uipc_socket2.c:343
#3  sys_connect+0x32c isdnssocket sys/kern/uipc_syscalls.c:-1 [inline]
#3  sys_connect+0x32c sys/kern/uipc_syscalls.c:411
#4  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#5  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11058  12083K   12215K 166960K     12336        0
            pcb    17     12K      12K 166960K        40        0
         rtable   225     15K      16K 166960K       709        0
             pf    38     18K      25K 166960K       104        0
         ifaddr    41      7K       7K 166960K        96        0
        ifgroup    59      2K       2K 166960K       116        0
         sysctl     3      1K       9K 166960K         9        0
       counters    72     37K      37K 166960K       106        0
       ioctlops     0      0K       4K 166960K      1513        0
            iov     0      0K      16K 166960K        72        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1421     89K      89K 166960K      1778        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         3        0
         VM map     2      1K       1K 166960K         2        0
            sem     8      0K       0K 166960K        13        0
        dirhash     6      1K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K      85K 166960K       419        0
          sigio     0      0K       0K 166960K         4        0
           proc    18     33K     148K 166960K       900        0
        subproc    72      4K       4K 166960K       180        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        17        0
       in_multi    88      5K       6K 166960K       223        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     1      0K       0K 166960K        11        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    67    307K     307K 166960K        67        0
           exec     0      0K       1K 166960K       552        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   147    104K     176K 166960K      5177        0
       UVM aobj     5      2K       2K 166960K         6        0
     pinsyscall    27     54K     101K 166960K      1904        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         1        0
            NDP    21      1K       1K 166960K        66        0
           temp    37   9114K    9134K 166960K     14413        0
         kqueue     5      8K      26K 166960K        40        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       62    0       62     1     0     1     1     0     8    1
rtentry    176      233    0      134     6     0     6     6     0     8    1
unpcb      144       85    0       77     2     0     2     2     0     8    1
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736       24    0       21     1     0     1     1     0     8    0
arp        136       40    0       24     1     0     1     1     0     8    0
inpcb      328      195    0      191     2     0     2     2     0     8    1
nd6        152       57    0       36     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48       20    0       12     1     0     1     1     0     8    0
ppxss      1192       4    0        4     1     0     1     1     0     8    1
pfstscr     40        4    0        2     1     0     1     1     0     8    0
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        1    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288       9    0        9     1     0     1     1     0     8    1
pfstitem    24       44    0        0     1     0     1     1     0     8    0
pfstkey    128       46    0        2     2     0     2     2     0     8    0
pfstate    448       43    0        1     5     0     5     5     0     8    0
pfrule     1360      24    0       18     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      969    0      558    31     0    31    31     0     8    5
art_table   40      970    0      558     5     0     5     5     0     8    0
art_node    32      233    0      143     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl      72       11    0        5     1     0     1     1     0     8    0
shmpl      120        2    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0       13     3     0     3     3     0     8    1
dino2pl    256     1848    0      352    94     0    94    94     0     8    0
ffsino     296     1848    0      352   116     0   116   116     0     8    0
nchpl      144     2209    0      459    65     0    65    65     0     8    0
vnodes     216     2249    0        0   125     0   125   125     0     8    0
namei      1024    9661    0     9661     4     1     3     3     0     8    3
percpumem   16       69    0       17     1     0     1     1     0     8    0
vcpupl     3968       7    0        7     1     0     1     1     0     8    1
vmpool     848        1    0        1     1     0     1     1     0     8    1
kstatmem   264       61    0       30     3     0     3     3     0     8    0
scxspl     216     7512    0     7512     5     2     3     3     1     8    3
plimitpl   152       51    0       38     1     0     1     1     0     8    0
sigapl     424      743    0      682     7     0     7     7     0     8    0
knotepl    120       60    0        0     2     0     2     2     0     8    0
kqueuepl   224       47    0       42     1     0     1     1     0     8    0
pipepl     344      171    0      144     3     0     3     3     0     8    0
fdescpl    528      707    0      683     3     0     3     3     0     8    0
filepl     160     3080    0     2897    14     0    14    14     0     8    2
lockfpl    104       57    0       57     1     0     1     1     0     8    1
lockfspl    48       24    0       24     1     0     1     1     0     8    1
sessionpl  144       40    0       34     1     0     1     1     0     8    0
pgrppl      48       60    0       46     1     0     1     1     0     8    0
ucredpl    104      430    0      421     1     0     1     1     0     8    0
zombiepl   144      683    0      682     1     0     1     1     0     8    0
processpl  1240     743    0      682     5     0     5     5     0     8    0
procpl     664      961    0      894     7     0     7     7     0     8    0
sockpl     752      348    0      336     4     0     4     4     0     8    2
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     131    0        0    17     0    17    17     0     8    0
mcl2k      2048      18    0        0     3     0     3     3     0     8    0
mextrefs    64       17    0        0     1     0     1     1     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      179    0        0    12     0    12    12     0     8    0
bufpl      272     2575    0      106   165     0   165   165     0     8    0
anonpl      32     3760    0        0    31     0    31    31     0   247    0
amapchunkpl 152   14185    0    13847    22     0    22    22     0   158    5
amappl16   200     1760    0     1750     5     3     2     5     0     8    0
amappl15   192        9    0        9     1     1     0     1     0     8    0
amappl14   184      574    0      573     1     0     1     1     0     8    0
amappl13   176      147    0      143     1     0     1     1     0     8    0
amappl12   168     1008    0      987     2     0     2     2     0     8    0
amappl11   160        9    0        9     1     1     0     1     0     8    0
amappl10   152       63    0       59     1     0     1     1     0     8    0
amappl9    144      281    0      280     2     1     1     1     0     8    0
amappl8    136      150    0      148     1     0     1     1     0     8    0
amappl7    128      174    0      168     1     0     1     1     0     8    0
amappl6    120      271    0      269     1     0     1     1     0     8    0
amappl5    112      112    0      107     1     0     1     1     0     8    0
amappl4    104      330    0      321     1     0     1     1     0     8    0
amappl3     96     2585    0     2528     3     0     3     3     0     8    0
amappl2     88      786    0      746     2     0     2     2     0     8    0
amappl1     80    12559    0    12244    15     0    15    15     0     8    1
amappl      88     4213    0     4095     5     0     5     5     0    92    1
uvmvnodes   80      100    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        5    0        1     1     0     1     1     0     8    0
uaddrrnd    24      707    0      683     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      707    0      683     1     0     1     1     0     8    0
vmmpekpl   168     7629    0     7573     3     0     3     3     0     8    0
vmmpepl    168    54243    0    53054    87     0    87    87     0   357   18
vmsppl     488      706    0      683     5     0     5     5     0     8    1
rwobjpl     80    18373    0    17799    24     0    24    24     0     8    0
pdppl      4096    1423    0     1368   103    46    57    81     0     8    2
pvpl        32    10626    0        0    86     0    86    86     0   265    0
pmappl     256      707    0      684     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      451    0       51    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83987ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a4db00) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a4db00) at __mp_lock+0x192 sys/kern/kern_lock.c:173
syscall(ffff80002a3244c0) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff80002a3244c0) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7bd9c847b440, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff83987ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a4db00) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a4db00) at __mp_lock+0x192 sys/kern/kern_lock.c:173
syscall(ffff80002a3244c0) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff80002a3244c0) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7bd9c847b440, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      ifiq_enqueue_qlim+0x39: movq    0(%r15),%rax
ifiq_enqueue_qlim(6abbac85,fffff1806f8efe00,2000) at ifiq_enqueue_qlim+0x39 sys/net/ifq.c:800
if_output_local(ffff800000c31000,fffff1806f8efe00,2) at if_output_local+0xae sys/net/if.c:1011
if_output_tso(ffff800000c31000,ffff80002a2e2650,fffff1806ffa5838,fffff1806cb6d6e8,8000) at if_output_tso+0x200 sys/net/if.c:-1
ip_output(fffff1806f8efe00,0,fffff1806ffa5820,800,0,fffff1806ffa58b8,62ff0e85225235d7) at ip_output+0x107f sys/netinet/ip_output.c:437
tcp_output(ffff8000015d89e0) at tcp_output+0x36e3 sys/netinet/tcp_output.c:1070
tcp_connect(ffff80000158b498,fffff1806f8ef500) at tcp_connect+0x573 sys/netinet/tcp_usrreq.c:694
sys_connect(ffff800045fe8fb8,ffff80002a2e2a60,ffff80002a2e29b0) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420
syscall(ffff80002a2e2a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2e2a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdc47b0ed220, count: 6
ddb{1}> trace
ifiq_enqueue_qlim(6abbac85,fffff1806f8efe00,2000) at ifiq_enqueue_qlim+0x39 sys/net/ifq.c:800
if_output_local(ffff800000c31000,fffff1806f8efe00,2) at if_output_local+0xae sys/net/if.c:1011
if_output_tso(ffff800000c31000,ffff80002a2e2650,fffff1806ffa5838,fffff1806cb6d6e8,8000) at if_output_tso+0x200 sys/net/if.c:-1
ip_output(fffff1806f8efe00,0,fffff1806ffa5820,800,0,fffff1806ffa58b8,62ff0e85225235d7) at ip_output+0x107f sys/netinet/ip_output.c:437
tcp_output(ffff8000015d89e0) at tcp_output+0x36e3 sys/netinet/tcp_output.c:1070
tcp_connect(ffff80000158b498,fffff1806f8ef500) at tcp_connect+0x573 sys/netinet/tcp_usrreq.c:694
sys_connect(ffff800045fe8fb8,ffff80002a2e2a60,ffff80002a2e29b0) at sys_connect+0x3f2 sys/kern/uipc_syscalls.c:420
syscall(ffff80002a2e2a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2e2a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xdc47b0ed220, count: -9

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/29 12:18 openbsd 0049b4ffbd56 7bf4ea23 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ifiq_enqueue_qlim
2026/08/24 19:44 openbsd 38355159c0bf b55bd4c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ifiq_enqueue_qlim
2026/07/30 18:05 openbsd a3419d81e108 0a1bc234 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ifiq_enqueue_qlim
2026/07/28 20:24 openbsd e63b2cdac76f 5fe7c56f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ifiq_enqueue_qlim
* Struck through repros no longer work on HEAD.