panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h

Status: upstream: reported syz repro on 2025/04/28 18:43
Reported-by: syzbot+feb558687bd3fc1443b3@syzkaller.appspotmail.com
First crash: 479d, last: 225d

Sample crash report:
panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:607: callout_cc_add: Bad list head 0xfffffe00077b32e0 first->prev != head
cpuid = 0
time = 1762249262
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056d080d0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056d08230
vpanic() at vpanic+0x257/frame 0xfffffe0056d083f0
panic() at panic+0xb5/frame 0xfffffe0056d084b0
callout_cc_add() at callout_cc_add+0x339/frame 0xfffffe0056d08510
callout_reset_sbt_on() at callout_reset_sbt_on+0x74f/frame 0xfffffe0056d08630
sleepq_set_timeout_sbt() at sleepq_set_timeout_sbt+0x20b/frame 0xfffffe0056d086f0
_cv_timedwait_sig_sbt() at _cv_timedwait_sig_sbt+0x2be/frame 0xfffffe0056d08830
kern_select() at kern_select+0x14d5/frame 0xfffffe0056d08b90
kern_pselect() at kern_pselect+0x97/frame 0xfffffe0056d08c00
sys_pselect() at sys_pselect+0x1f9/frame 0xfffffe0056d08d10
amd64_syscall() at amd64_syscall+0x4e2/frame 0xfffffe0056d08f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0056d08f30
--- syscall (522, FreeBSD ELF64, pselect), rip = 0x3a755a, rsp = 0x82109f3d8, rbp = 0x82109f420 ---
KDB: enter: panic
[ thread pid 773 tid 100099 ]
Stopped at      kdb_enter+0x6e: movq    $0,0x2589dc7(%rip)
db> 
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs                        0x20
ds                        0x3b
es                        0x3b
fs                        0x13
gs                        0x1b
ss                        0x28
rax                       0x12
rcx         0xfffffe0002bf1850
rdx         0xdffff7c000000000
rbx         0xffffffff82825b60  .str.27
rsp         0xfffffe0056d08210
rbp         0xfffffe0056d08230
rsi                          0
rdi         0xffffffff830004e8  panicstr
r8                           0
r9                  0xffffffff
r10                          0
r11                        0x6
r12         0xfffffe00540c4000
r13         0xfffffffffffffffe
r14         0xffffffff82825b60  .str.27
r15                          0
rip         0xffffffff816441ce  kdb_enter+0x6e
rflags                    0x46
kdb_enter+0x6e: movq    $0,0x2589dc7(%rip)
db> show proc
Process 773 (syz-executor) at 0xfffffe00540cd010:
 state: NORMAL
 uid: 0 gid: 0 supp gids: 0, 5
 parent: pid 772 at 0xfffffe0054004010
 ABI: FreeBSD ELF64
 flag: 0x10004000  flag2: 0
 arguments: ./syz-executor runner 0 localhost 10502
 reaper: 0xfffffe0007809010 reapsubtree: 1
 sigparent: 20
 vmspace: 0xfffffe00078116d8
   (map 0xfffffe00078116d8)
   (map.pmap 0xfffffe0007811778)
   (pmap 0xfffffe00078117e8)
 threads: 1
100099                   Run     select  0xfffffe0007787c40  syz-executor
db> ps
  pid  ppid  pgrp   uid  state   wmesg   wchan               cmd
 3625  3322  3322     0  R                                   syz-executor
 3624  3444  3444     0  R                                   syz-executor
 3622  3153  3153     0  R       (threaded)                  syz-executor
100536                   RunQ                                syz-executor
102871                   RunQ                                syz-executor
 3505  3490  3505     0  Ss      select  0xfffffe0007787940  dhclient
 3497     1  3497     0  Ss      select  0xfffffe00077879c0  dhclient
 3490  3471   423    65  S       select  0xfffffe00585bff40  dhclient
 3471   423   423     0  S       wait    0xfffffe005410d000  sh
 3444   773  3444     0  S       nanslp  0xffffffff83baf001  syz-executor
 3322   773  3322     0  S       nanslp  0xffffffff83baf000  syz-executor
 3214   773  3214     0  R                                   syz-executor
 3153   773  3153     0  S       nanslp  0xffffffff83baf000  syz-executor
  863     0     0     0  DL      aiordy  0xfffffe00540f1018  [aiod4]
  862     0     0     0  DL      aiordy  0xfffffe0054004ac0  [aiod3]
  861     0     0     0  DL      aiordy  0xfffffe00540f1570  [aiod2]
  860     0     0     0  DL      aiordy  0xfffffe005410f568  [aiod1]
  773   772   770     0  R       select  0xfffffe0007787c40  syz-executor
  772   770   770     0  R       (threaded)                  syz-execprog
100088                   S       uwait   0xfffffe0058294e00  syz-execprog
100114                   Run     CPU 1                       syz-execprog
100115                   S       uwait   0xfffffe0058292600  syz-execprog
100116                   S       uwait   0xfffffe0058292700  syz-execprog
100117                   S       kqread  0xfffffe0058592300  syz-execprog
100118                   S       uwait   0xfffffe0058292900  syz-execprog
100119                   S       uwait   0xfffffe0058517500  syz-execprog
  770   768   770     0  Ss      sigsusp 0xfffffe0054003b68  csh
  768   681   768     0  Ss      select  0xfffffe00585bfdc0  sshd
  747     1   747     0  Ss+     ttyin   0xfffffe00582b1cb0  getty
  746     1   746     0  Ss+     ttyin   0xfffffe00585eecb0  getty
  745     1   745     0  Ss+     ttyin   0xfffffe00585ef0b0  getty
  744     1   744     0  Ss+     ttyin   0xfffffe00585ef4b0  getty
  743     1   743     0  Ss+     ttyin   0xfffffe00585ef8b0  getty
  742     1   742     0  Ss+     ttyin   0xfffffe00585efcb0  getty
  741     1   741     0  Ss+     ttyin   0xfffffe00585f00b0  getty
  740     1   740     0  Ss+     ttyin   0xfffffe00585f04b0  getty
  739     1   739     0  Ss+     ttyin   0xfffffe00585f08b0  getty
  737     1    17     0  S+      piperd  0xfffffe005986d420  logger
  736   735    17     0  S+      nanslp  0xffffffff83baf001  sleep
  735     1    17     0  S+      wait    0xfffffe00540cc560  sh
  685     1   685     0  Ss      nanslp  0xffffffff83baf001  cron
  681     1   681     0  Ss      select  0xfffffe00585bfe40  sshd
  494     1   494     0  Ss      select  0xfffffe0007787dc0  syslogd
  423     1   423     0  Ss      wait    0xfffffe005400aab0  devd
  422     1   422    65  Ss      select  0xfffffe0007787f40  dhclient
  337     1   337     0  Ss      select  0xfffffe0007787e40  dhclient
  334     1   334     0  Ss      select  0xfffffe0007788240  dhclient
   16     0     0     0  DL      syncer  0xffffffff83cdcc20  [syncer]
   15     0     0     0  DL      vlruwt  0xfffffe0054002558  [vnlru]
   14     0     0     0  DL      (threaded)                  [bufdaemon]
100079                   D       psleep  0xffffffff83cdb160  [bufdaemon]
100082                   D       -       0xffffffff83001ec0  [bufspacedaemon-0]
100094                   D       sdflush 0xfffffe0057e170e8  [/ worker]
    9     0     0     0  DL      psleep  0xffffffff83d1c040  [vmdaemon]
    8     0     0     0  DL      (threaded)                  [pagedaemon]
100077                   D       psleep  0xffffffff83d02108  [dom0]
100080                   D       launds  0xffffffff83d02114  [laundry: dom0]
100081                   D       umarcl  0xffffffff81e2ad60  [uma]
    7     0     0     0  DL      -       0xffffffff839275b0  [rand_harvestq]
    6     0     0     0  DL      pftm    0xffffffff8440ef60  [pf purge]
    5     0     0     0  DL      waiting 0xffffffff84705700  [sctp_iterator]
    4     0     0     0  DL      (threaded)                  [cam]
100045                   D       -       0xffffffff838f1340  [doneq0]
100046                   D       -       0xffffffff838f12c0  [async]
100075                   D       -       0xffffffff838f1140  [scanner]
    3     0     0     0  DL      (threaded)                  [crypto]
100042                   D       crypto_ 0xffffffff83cfd9e0  [crypto]
100043                   D       crypto_ 0xfffffe0053ea4030  [crypto returns 0]
100044                   D       crypto_ 0xfffffe0053ea4080  [crypto returns 1]
   13     0     0     0  DL      (threaded)                  [geom]
100037                   D       -       0xffffffff83b57600  [g_event]
100038                   D       -       0xffffffff83b57620  [g_up]
100039                   D       -       0xffffffff83b57640  [g_down]
    2     0     0     0  WL      (threaded)                  [clock]
100031                   I                                   [clock (0)]
100032                   I                                   [clock (1)]
   12     0     0     0  WL      (threaded)                  [intr]
100013                   I                                   [swi6: task queue]
100014                   I                                   [swi6: Giant taskq]
100016                   I                                   [swi5: fast taskq]
100033                   I                                   [swi1: netisr 0]
100034                   I                                   [swi1: hpts]
100035                   I                                   [swi1: hpts]
100047                   I                                   [irq24: virtio_pci0]
100048                   I                                   [irq25: virtio_pci0]
100049                   I                                   [irq26: virtio_pci0]
100050                   I                                   [irq27: virtio_pci0]
100051                   I                                   [irq28: virtio_pci1]
100052                   I                                   [irq29: virtio_pci1]
100053                   I                                   [irq30: virtio_pci1]
100054                   I                                   [irq31: virtio_pci1]
100055                   I                                   [irq32: virtio_pci1]
100060                   I                                   [irq10: virtio_pci2]
100062                   I                                   [irq1: atkbd0]
100063                   I                                   [irq12: psm0]
100064                   I                                   [swi0: uart uart++]
100068                   I                                   [swi1: pf send]
   11     0     0     0  RL      (threaded)                  [idle]
100003                   CanRun                              [idle: cpu0]
100004                   CanRun                              [idle: cpu1]
    1     0     1     0  SLs     wait    0xfffffe0007809010  [init]
   10     0     0     0  DL      audit_w 0xffffffff83cfe480  [audit]
    0     0     0     0  DLs     (threaded)                  [kernel]
100000                   D       parked  0xffffffff84c52ff0  [swapper]
100005                   D       -       0xfffffe00083fba00  [softirq_0]
100006                   D       -       0xfffffe00083fb800  [softirq_1]
100007                   D       -       0xfffffe00083fb600  [if_io_tqg_0]
100008                   D       -       0xfffffe00083fb400  [if_io_tqg_1]
100009                   D       -       0xfffffe00083fb200  [if_config_tqg_0]
100010                   D       -       0xfffffe00083fb000  [kqueue_ctx taskq]
100011                   D       -       0xfffffe00083fad00  [jail_remove taskq]
100012                   D       -       0xfffffe00083fab00  [bus taskq]
100015                   D       -       0xfffffe00083fa500  [thread taskq]
100017                   D       -       0xfffffe00083fa100  [aiod_kick taskq]
100018                   D       -       0xfffffe00083f9e00  [deferred_unmount ta]
100019                   D       -       0xfffffe00083f9c00  [inm_free taskq]
100020                   D       -       0xfffffe00083f9a00  [in6m_free taskq]
100021                   D       -       0xfffffe00083f9800  [linuxkpi_irq_wq]
100022                   D       -       0xfffffe00083f9600  [linuxkpi_short_wq_0]
100023                   D       -       0xfffffe00083f9600  [linuxkpi_short_wq_1]
100024                   D       -       0xfffffe00083f9600  [linuxkpi_short_wq_2]
100025                   D       -       0xfffffe00083f9600  [linuxkpi_short_wq_3]
100026                   D       -       0xfffffe00083f9100  [linuxkpi_long_wq_0]
100027                   D       -       0xfffffe00083f9100  [linuxkpi_long_wq_1]
100028                   D       -       0xfffffe00083f9100  [linuxkpi_long_wq_2]
100029                   D       -       0xfffffe00083f9100  [linuxkpi_long_wq_3]
100036                   D       -       0xfffffe00083f8400  [firmware taskq]
100040                   D       -       0xfffffe0053f59100  [crypto_0]
100041                   D       -       0xfffffe0053f59100  [crypto_1]
100056                   D       -       0xfffffe00083fc200  [vtnet0 rxq 0]
100057                   D       -       0xfffffe005817e500  [vtnet0 txq 0]
100058                   D       -       0xfffffe005817e400  [vtnet0 rxq 1]
100059                   D       -       0xfffffe005817e300  [vtnet0 txq 1]
100061                   D       vtbslp  0xfffffe0057e48200  [virtio_balloon]
100065                   D       -       0xffffffff8282a240  [deadlkres]
100069                   D       -       0xfffffe005851d000  [acpi_task_0]
100070                   D       -       0xfffffe005851d000  [acpi_task_1]
100071                   D       -       0xfffffe005851d000  [acpi_task_2]
100073                   D       -       0xfffffe00083fc100  [mca taskq]
100074                   D       -       0xfffffe0053f58a00  [CAM taskq]
100076                   D       -       0xfffffe0053f59500  [ipsec_offload]
db> show all locks
Process 773 (syz-executor) thread 0xfffffe00540c4000 (100099)
exclusive sleep mutex sellck (sellck) r = 0 (0xfffffe0007787c20) locked @ /syzkaller/managers/main/kernel/sys/kern/sys_generic.c:2061
db> show malloc
              Type        InUse        MemUse     Requests
           pf_hash            6        12804K            6
            linker          384         5199K          498
          tcp_hpts            8         4865K            8
            devbuf         4187         4324K         4212
         sysctloid        35049         2065K        35124
             vtbuf           24         1968K           46
            newblk         1907         1501K         4714
              kobj          331         1324K          495
          vfscache            3         1025K            3
          inodedep          956          871K         2845
               pcb           24          669K           64
         ufs_quota            1          512K            1
          vfs_hash            1          512K            1
           callout            2          512K            2
              intr            4          472K            4
              vmem            5          272K            8
           subproc          133          250K         3704
         vnet_data            2          224K            2
          acpitask            1          224K            1
            dirrem          888          222K         2751
            KTRACE          100          200K          100
            acpica         1674          184K        54444
           pagedep           53          141K         2779
           tidhash            3          141K            3
        tfo_ccache            1          128K            1
          IP reass            1          128K            1
          filedesc           16          121K         5623
          freefile          887          111K         2736
               sem            4          106K            4
            DEVFS1          106          106K          138
        gtaskqueue           18           98K           18
               LRO           34           97K           44
               bus         1000           82K         5086
          mtx_pool            3           74K            3
          syncache            1           68K            1
     NFSD srvcache            3           68K            3
            module          523           66K          523
       ddb_capture            1           64K            1
              umtx          336           42K          336
           kdtrace          203           41K         6499
               BPF           22           36K           35
         hostcache            1           32K            1
               shm            1           32K            1
            DEVFS3          125           32K          140
               msg            4           30K            4
            kbdmux            6           28K            6
          routetbl          339           23K         1052
              temp           31           21K         2258
        DEVFS_RULE           56           20K           56
            ifaddr           67           19K          115
         ufs_mount            4           17K            5
              proc            3           17K            3
               tty           16           16K           16
           ithread           90           15K           90
            bus-sc           34           15K         1657
      eventhandler          163           14K          163
           lltable           43           14K           83
             ifnet            7           13K           12
       ether_multi          152           13K          307
              kenv           95           12K           95
              GEOM           49           11K          431
         CAM queue            5           11K         1528
              rman           82           10K          437
              cred           24            9K          289
               rpc            8            9K            8
            plimit           23            9K          502
         in6_multi           65            9K          115
         bmsafemap            3            9K         2812
           devstat            4            9K            4
              UART           12            9K           12
              ksem            1            8K            1
             shmfd            1            8K            1
       pfs_vncache            1            8K            1
             mkdir           60            8K         5532
     audit_evclass          240            8K          306
         taskqueue           69            8K           69
            diradd           52            7K         2806
            kqueue           59            7K         3632
            sglist            6            7K            6
         newdirblk           48            6K         2766
           CAM DEV            3            6K          510
         pfs_nodes           22            6K           22
          pf_ifnet           14            6K           44
       ufs_dirhash           24            5K           24
               UMA          268            5K          268
                vt           11            5K           11
           memdesc            1            4K            1
               MCA           32            4K           32
             evdev            4            4K            4
           acpisem           28            4K           28
           pwddesc           55            4K         6332
         proc-args           83            4K         4912
             selfd           48            3K       119839
          terminal           11            3K           11
           session           22            3K           56
          indirdep           10            3K           10
           acpidev           20            3K           20
             hhook            8            3K           10
             clone            9            3K            9
           uidinfo            3            3K            9
             lockf           21            3K           37
           netlink            2            3K          173
        local_apic            1            2K            1
           io_apic            1            2K            1
         ipsec-saq            2            2K            2
            ip6ndp           12            2K           23
            Unitno           28            2K           80
          sctp_ifa           13            2K           24
           CAM XPT           22            2K          543
          in_multi            6            2K           14
               tun            4            2K            9
         toponodes            6            2K            6
       ipsecpolicy            2            2K            2
            select           11            2K           40
               msi            9            2K            9
           softdep            1            1K            1
            sahead            1            1K            1
          secasvar            1            1K            1
             nhops            6            1K            8
       vnodemarker            2            1K           10
      NFSD session            1            1K            1
        CAM periph            4            1K          271
          freework            4            1K         2741
             ipsec            3            1K            3
          sctp_ifn            6            1K           24
          freeblks            3            1K         2740
               mld            6            1K           11
            CC Mem            6            1K           13
              igmp            6            1K           11
              pfil            6            1K            6
            isadev            6            1K            6
             mount           16            1K           89
          pci_link           10            1K           10
            crypto            4            1K            4
 encap_export_host           12            1K           12
               osd           11            1K           30
            DEVFSP           10            1K           52
              cdev            2            1K            2
       lkpikmalloc            8            1K            9
       inpcbpolicy           14            1K          231
      counter_rate           13            1K           13
    chacha20random            1            1K            1
            biobuf            1            1K            1
            vnodes            1            1K            1
          procdesc            2            1K           10
      NFSD lckfile            1            1K            1
     NFSD V4client            1            1K            1
             DEVFS            9            1K           10
           CAM SIM            2            1K            2
            feeder            7            1K            7
           tcpfunc            3            1K            3
        loginclass            3            1K            7
            prison            6            1K            6
         cryptodev            2            1K           49
          nexusdev            8            1K            8
            apmdev            1            1K            1
          atkbddev            2            1K            2
               aio            4            1K            4
          pmchooks            1            1K            1
          filecaps            5            1K           78
          CAM path            4            1K         1034
     CAM dev queue            2            1K            2
 CAM I/O Scheduler            1            1K            1
            soname            4            1K         3411
          sctp_vrf            1            1K            1
              vnet            1            1K            1
               pmc            1            1K            1
           entropy            2            1K           63
          acpiintr            1            1K            1
              cpus            2            1K            2
    vnet_data_free            1            1K            1
           Per-cpu            1            1K            1
          p1003.1b            1            1K            1
            ipcomp            0            0K            0
               esp            0            0K            0
                ah            0            0K            0
      tcp_pcm_rack            0            0K            0
       tcp_do_rack            0            0K            0
      tcp_fsb_rack            0            0K            0
        sctp_mcore            0            0K            0
        sctp_socko            0            0K            0
         sctp_iter            0            0K           26
         sctp_mvrf            0            0K            0
         sctp_timw            0            0K            0
         sctp_cpal            0            0K            0
         sctp_cmsg            0            0K            0
         sctp_stre            0            0K            0
         sctp_athi            0            0K            0
         sctp_athm            0            0K            0
         sctp_atky            0            0K            0
         sctp_atcl            0            0K            0
         sctp_a_it            0            0K           26
         sctp_aadr            0            0K            0
         sctp_stro            0            0K            0
         sctp_stri            0            0K            0
          sctp_map            0            0K            0
            mqdata            0            0K            0
          pf_table            0            0K            0
                pf            0            0K            0
           pf_rule            0            0K            0
           pf_altq            0            0K            0
           pf_osfp            0            0K            0
     pf_krule_item            0            0K            0
           pf_temp            0            0K            0
           filemon            0            0K            0
        madt_table            0            0K            2
          smartpqi            0            0K            0
               ixl            0            0K            0
        ice-resmgr            0            0K            0
         ice-osdep            0            0K            0
               ice            0            0K            0
              iavf            0            0K            0
             axgbe            0            0K            0
       fpukern_ctx            0            0K            0
          xen_intr            0            0K            0
           xen_hvm            0            0K            0
         legacydrv            0            0K            0
      NMI handlers            0            0K            0
            bounce            0            0K            0
            busdma            0            0K            0
            qpidrv            0            0K            0
      dmar_idpgtbl            0            0K            0
          dmar_dom            0            0K            0
          dmar_ctx            0            0K            0
      amdiommu_dom            0            0K            0
      amdiommu_ctx            0            0K            0
              isci            0            0K            0
      iommu_dmamap            0            0K            0
     hyperv_socket            0            0K            0
           bxe_ilt            0            0K            0
        aesni_data            0            0K            0
            xenbus            0            0K            0
     vm_fictitious            0            0K            0
           UMAHash            0            0K            0
         vm_pgdata            0            0K            0
           jblocks            0            0K            0
          savedino            0            0K         1826
          sentinel            0            0K            0
            jfsync            0            0K            0
            jtrunc            0            0K            0
             sbdep            0            0K            3
           jsegdep            0            0K            0
              jseg            0            0K            0
         jfreefrag            0            0K            0
          jfreeblk            0            0K            0
           jnewblk            0            0K            0
            jmvref            0            0K            0
           jremref            0            0K            0
           jaddref            0            0K            0
           freedep            0            0K            0
          freefrag            0            0K           45
        allocindir            0            0K            0
       allocdirect            0            0K            0
          ufs_trim            0            0K            0
           mactemp            0            0K            0
     audit_trigger            0            0K            0
 audit_pipe_presel            0            0K            0
     audit_pipeent            0            0K            0
        audit_pipe            0            0K            0
      audit_evname            0            0K            0
         audit_bsm            0            0K            0
      audit_gidset            0            0K            0
        audit_text            0            0K            0
        audit_path            0            0K            0
        audit_data            0            0K            0
        audit_cred            0            0K            0
          ktls_ocf            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
      MLX5E_TLS_RX            0            0K            0
        MLX5EEPROM            0            0K            0
         MLX5E_TLS            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
            MLX5EN            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
          MLX5DUMP            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
       simple_attr            0            0K            0
          seq_file            0            0K            0
           lkpiskb            0            0K            0
             radix            0            0K            0
               idr            0            0K            0
          lkpindev            0            0K            0
           lkpimhi            0            0K            0
            lkpifw            0            0K            0
         lkpi80211            0            0K            0
               NLM            0            0K            0
    ipsec-spdcache            0            0K            0
         ipsec-reg            0            0K            0
        ipsec-misc            0            0K           10
      ipsecrequest            0            0K            0
            ip6opt            0            0K            3
       ip6_msource            0            0K            0
      ip6_moptions            0            0K            0
       in6_mfilter            0            0K            0
             frag6            0            0K            0
            tcplog            0            0K            0
        tcp_hwpace            0            0K            0
        ip_msource            0            0K            0
       ip_moptions            0            0K            0
        in_mfilter            0            0K            0
              ipid            0            0K            0
         80211scan            0            0K            0
      80211ratectl            0            0K            0
        80211power            0            0K            0
       80211nodeie            0            0K            0
         80211node            0            0K            0
      80211mesh_gt            0            0K            0
      80211mesh_rt            0            0K            0
         80211perr            0            0K            0
         80211prep            0            0K            0
         80211preq            0            0K            0
          80211dfs            0            0K            0
       80211crypto            0            0K            0
          80211vap            0            0K            0
             iflib            0            0K            0
              vlan            0            0K            0
               gif            0            0K            0
           ifdescr            0            0K            0
              zlib            0            0K           20
           fadvise            0            0K            0
           VN POLL            0            0K            0
            statfs            0            0K          197
     namei_tracker            0            0K            0
           inotify            0            0K            0
       export_host            0            0K            0
        cl_savebuf            0            0K           38
               lio            0            0K         2706
               acl            0            0K            0
          mbuf_tag            0            0K            0
              ktls            0            0K            0
              accf            0            0K            0
               pts            0            0K            0
           timerfd            0            0K            0
               iov            0            0K        16120
          ioctlops            0            0K          110
           eventfd            0            0K            0
           Witness            0            0K            0
             stack            0            0K            0
              sbuf            0            0K          190
          firmware            0            0K            0
        compressor            0            0K            0
              SWAP            0            0K            0
         sysctltmp            0            0K          728
            sysctl            0            0K            3
              ekcd            0            0K            0
            dumper            0            0K            0
          sendfile            0            0K            0
              rctl            0            0K            0
             cache            0            0K            0
             kexec            0            0K            0
          kcovinfo            0            0K           30
          jaildesc            0            0K            0
      prison_racct            0            0K            0
       Fail Points            0            0K            0
             sigio            0            0K            1
filedesc_to_leader            0            0K            0
               pwd            0            0K            0
       tty console            0            0K            0
         boottrace            0            0K            0
        isofs_node            0            0K            0
       isofs_mount            0            0K            0
     tr_raid5_data            0            0K            0
    tr_raid1e_data            0            0K            0
     tr_raid1_data            0            0K            0
     tr_raid0_data            0            0K            0
    tr_concat_data            0            0K            0
       md_sii_data            0            0K            0
   md_promise_data            0            0K            0
    md_nvidia_data            0            0K            0
   md_jmicron_data            0            0K            0
     md_intel_data            0            0K            0
       md_ddf_data            0            0K            0
         raid_data            0            0K           72
     geom_flashmap            0            0K            0
         tmpfs dir            0            0K            0
        tmpfs name            0            0K            0
       tmpfs mount            0            0K            0
     tmpfs extattr            0            0K            0
           NFS FHA            0            0K            0
         newnfsmnt            0            0K            0
  newnfsclient_req            0            0K            0
   NFSCL layrecall            0            0K            0
     NFSCL session            0            0K            0
     NFSCL sockreq            0            0K            0
     NFSCL devinfo            0            0K            0
     NFSCL flayout            0            0K            0
      NFSCL layout            0            0K            0
     NFSD rollback            0            0K            0
      NFSCL diroff            0            0K            0
        NEWNFSnode            0            0K            0
         NFSCL lck            0            0K            0
      NFSCL lckown            0            0K            0
      NFSCL client            0            0K            0
       NFSCL deleg            0            0K            0
        NFSCL open            0            0K            0
       NFSCL owner            0            0K            0
            NFS fh            0            0K            0
           NFS req            0            0K            0
     NFSD usrgroup            0            0K            0
       NFSD string            0            0K            0
       NFSD V4lock            0            0K            0
      NFSD V4state            0            0K            0
       msdosfs_fat            0            0K            0
     msdosfs_mount            0            0K            0
      msdosfs_node            0            0K            0
            DEVFS4            0            0K            0
            DEVFS2            0            0K            0
            gntdev            0            0K            0
       privcmd_dev            0            0K            0
        evtchn_dev            0            0K            0
          xenstore            0            0K            0
               xnb            0            0K            0
          xen_acpi            0            0K            0
              xbbd            0            0K            0
               xbd            0            0K            0
           Balloon            0            0K            0
          sysmouse            0            0K            0
            vtfont            0            0K            0
            pvscsi            0            0K            0
            USBdev            0            0K            0
               USB            0            0K            0
            ufshci            0            0K            0
            twsbuf            0            0K            0
       tcp_log_dev            0            0K            0
      midi buffers            0            0K            0
             mixer            0            0K            0
              ac97            0            0K            0
             hdacc            0            0K            0
              hdac            0            0K            0
              hdaa            0            0K            0
       SIIS driver            0            0K            0
               PUC            0            0K            0
          ppbusdev            0            0K            0
            sr_iov            0            0K            0
               OCS            0            0K            0
               OCS            0            0K            0
              nvme            0            0K            0
               nvd            0            0K            0
            netmap            0            0K            0
            mwldev            0            0K            0
        MVS driver            0            0K            0
         mpi3mrbuf            0            0K            0
          mrsasbuf            0            0K            0
          mpt_user            0            0K            0
          mps_user            0            0K            0
            MPSSAS            0            0K            0
               mps            0            0K            0
          mpr_user            0            0K            0
            MPRSAS            0            0K            0
               mpr            0            0K            0
            mfibuf            0            0K            0
        md_sectors            0            0K            0
           md_disk            0            0K            0
           malodev            0            0K            0
               LED            0            0K            0
          ix_sriov            0            0K            0
                ix            0            0K            0
            ipsbuf            0            0K            0
         ciss_data            0            0K            0
         BACKLIGHT            0            0K            0
           ath_hal            0            0K            0
            athdev            0            0K            0
           ata_pci            0            0K            0
           ata_dma            0            0K            0
       ata_generic            0            0K            0
       AHCI driver            0            0K            0
               agp            0            0K            0
           acpipwr            0            0K            0
         acpi_perf            0            0K            0
         acpicmbat            0            0K            0
        aacraidcam            0            0K            0
       aacraid_buf            0            0K            0
            aaccam            0            0K            0
            aacbuf            0            0K            0
              zstd            0            0K            0
            XZ_DEC            0            0K            0
            nvlist            0            0K            0
          SCSI ENC            0            0K            0
           SCSI sa            0            0K            0
         scsi_pass            0            0K            0
           scsi_da            0            0K           70
            ata_da            0            0K            0
           scsi_ch            0            0K            0
           scsi_cd            0            0K            0
           nvme_da            0            0K            0
           CAM CCB            0            0K          523
     CAM ccb queue            0            0K            0
db> show uma
              Zone   Size    Used    Free    Requests  Sleeps  Bucket  Total Mem    XFree
   mbuf_jumbo_page   4096    8320    1840       51844       0     254   41615360        0
           tcp_log    416   10195     227       18965       0     254    4335552        0
              mbuf    256    8629    1799       74583       0     254    2669568        0
          BUF TRIE    152     311   11493        1067       0      62    1794208        0
       malloc-4096   4096     388       6        4680       0       2    1613824        0
        malloc-384    384    4159      41        4177       0      30    1612800        0
      mbuf_cluster   2048     762       0         762       0     254    1560576        0
        malloc-128    128   11800     197       12258       0     126    1535616        0
       UMA Slabs 0    112   11824      14       11824       0     126    1325856        0
         vmem btag     56   18556     131       18556       0     254    1046472        0
      malloc-65536  65536      13       1          16       0       1     917504        0
        RADIX NODE    152    4824     839      106006       0      63     860776        0
        malloc-384    384     956     964        2846       0      30     737280        0
         FFS inode   1168     561      34        3297       0       8     694960        0
            socket   1024      27     481        1491       0     254     520192        0
          lkpicurr    168       2    3094           2       0      62     520128        0
              pbuf   2624       0     198           0       0       2     519552        0
        malloc-256    256    1934      61        7618       0      62     510720        0
        malloc-256    256     901     959        5501       0      62     476160        0
        malloc-256    256      26    1774        2024       0      62     460800        0
            THREAD   1860     147      21        2872       0       8     312480        0
         VM OBJECT    248    1096     152       45074       0      62     309504        0
             VNODE    440     598      95        3341       0      30     304920        0
        256 Bucket   2048     124      20        1255       0       8     294912        0
         malloc-64     64    4373     226        8197       0     254     294336        0
      malloc-16384  16384      10       5        2803       0       1     245760        0
        malloc-128    128     934     957        6093       0     126     242048        0
         malloc-16     16   14691     309       17669       0     254     240000        0
       malloc-2048   2048     102      10         102       0       8     229376        0
            DEVCTL   1024      73     147         210       0       0     225280        0
      malloc-32768  32768       4       2         124       0       1     196608        0
       mbuf_packet    256       2     760        5706       0     254     195072        0
         malloc-32     32    5459     463        6296       0     254     189504        0
         UMA Zones    768     240       4         240       0      16     187392        0
        malloc-128    128    1139     256       25287       0     126     178560        0
            lkpimm     56       1    3095           1       0     254     173376        0
             unpcb    320      11     505        1221       0     254     165120        0
     FPU_save_area    832     149      49       12108       0      16     164736        0
       FFS2 dinode    256     561      69        3297       0      62     161280        0
       malloc-1024   1024     123      21         162       0      16     147456        0
       S VFS Cache    104    1027     377        3783       0     126     146016        0
         MAP ENTRY     96    1188     324      100359       0     126     145152        0
       malloc-4096   4096      30       4         163       0       2     139264        0
      malloc-65536  65536       0       2          88       0       1     131072        0
      malloc-65536  65

Crashes (1995):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/04 09:41 freebsd-src 8234c1899b30 686bf657 console log report syz / log ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 09:09 freebsd-src 8234c1899b30 686bf657 console log report syz / log ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/05/10 11:35 freebsd-src 6b78da357ddc 77908e5f console log report syz / log ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/05/10 08:22 freebsd-src 6b78da357ddc 77908e5f console log report syz / log ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/05/10 07:10 freebsd-src 6b78da357ddc 77908e5f console log report syz / log ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/04/28 23:08 freebsd-src 4e2616b74cb7 aeb6ec69 console log report syz / log ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 19:12 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 17:42 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 16:42 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 13:35 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 12:19 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 08:06 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 06:41 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/07 05:22 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 22:46 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 20:36 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 18:28 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 16:35 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 14:51 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 13:33 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 11:30 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 10:27 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 09:16 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 08:12 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 08:00 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/06 03:08 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2026/01/05 23:14 freebsd-src a3394b6a23fb 15f6fd08 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/07 04:44 freebsd-src d7a138207fa4 4e1406b4 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/07 03:05 freebsd-src d7a138207fa4 4e1406b4 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/06 23:43 freebsd-src d7a138207fa4 4e1406b4 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/06 20:43 freebsd-src d7a138207fa4 4e1406b4 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/06 07:43 freebsd-src 1ca7542a1b31 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/06 05:09 freebsd-src 1ca7542a1b31 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 22:49 freebsd-src 1ca7542a1b31 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 18:06 freebsd-src b8697ac70ebf a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 16:08 freebsd-src b8697ac70ebf a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 12:13 freebsd-src b8697ac70ebf a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 10:52 freebsd-src b8697ac70ebf a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 09:07 freebsd-src b8697ac70ebf a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 07:18 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 04:14 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 02:23 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/05 01:20 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 23:17 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 21:44 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 20:56 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 18:52 freebsd-src f999ffdce381 a6c9c731 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 16:05 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 14:56 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 13:39 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 11:57 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 11:11 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 09:06 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 08:02 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 06:46 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/11/04 03:07 freebsd-src 8234c1899b30 686bf657 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
2025/04/28 18:42 freebsd-src 4e2616b74cb7 aeb6ec69 console log report ci-freebsd-main panic: /syzkaller/managers/main/kernel/sys/kern/kern_timeout.c:LINE: callout_cc_add: Bad list head ADDR first->prev != h
* Struck through repros no longer work on HEAD.