KASAN: invalid memory access in witness_checkorder

Status: upstream: reported on 2026/07/13 09:01
Reported-by: syzbot+a1a3c17d15d5df2f9ce8@syzkaller.appspotmail.com
First crash: 17d, last: 3d07h

Sample crash report:
panic: Caught invalid memory access at ffffffff846ec918 size 8 op 0
Stopped at      db_enter+0x17:  popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 20046      1      0  0x10000002          0    1K init
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84638c51) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
witness_checkorder(ffff800028fe4690,9,0) at witness_checkorder+0x25a sys/kern/subr_witness.c:792
mtx_enter(ffff800028fe4680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffff800028fe4680,ffff8000297fe2a0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffff8000298034f0,14e84) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffff800045fffc88,1,ffffffff8235e640,0,ffff8000297fe520,0) at fork1+0x1225 sys/kern/kern_fork.c:511
syscall(ffff8000297fe5c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000297fe5c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b223066c480, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffffffff846ec918 size 8 op 0
ddb{1}> show kasan
KASAN: invalid read of 8 bytes at 0xffffffff846ec918 from pc 0xffffffff8139efea
KASAN: first bad byte at 0xffffffff846ec918 (+0); shadow 0xfa: global redzone (out-of-bounds)
KASAN: 0xffffffff846ec918 is 17 bytes to the right of the 39-byte global '.str.8' (/syzkaller/managers/kasan/kernel/sys/kern/subr_witness.c)
KASAN: pc: witness_checkorder+0x25a
KASAN: call trace:
#0  __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0  __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1  witness_checkorder+0x25a sys/kern/subr_witness.c:792
#2  mtx_enter+0x105 sys/kern/kern_lock.c:406
#3  kqueue_register+0x3ab sys/kern/kern_event.c:1445
#4  knote_processfork+0x5b1 sys/kern/kern_event.c:2286
#5  fork1+0x1225 sys/kern/kern_fork.c:511
#6  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
KASAN: shadow of 0xffffffff846ec800..0xffffffff846eca80 (1 cell = 8 bytes):
 0xffffffff846ec800: 00 00 00 00 00 fa fa fa fa fa fa fa 00 00 00 00
 0xffffffff846ec880: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00
>0xffffffff846ec900: 00 fa fa[fa]fa fa fa fa 00 00 00 00 00 fa fa fa
 0xffffffff846ec980: fa fa fa fa 00 00 00 00 00 fa fa fa fa fa fa fa
 0xffffffff846eca00: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 fa
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84638c51) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
witness_checkorder(ffff800028fe4690,9,0) at witness_checkorder+0x25a sys/kern/subr_witness.c:792
mtx_enter(ffff800028fe4680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffff800028fe4680,ffff8000297fe2a0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffff8000298034f0,14e84) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffff800045fffc88,1,ffffffff8235e640,0,ffff8000297fe520,0) at fork1+0x1225 sys/kern/kern_fork.c:511
syscall(ffff8000297fe5c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000297fe5c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b223066c480, count: -10
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000297fdcd0
rbx               0xffff8000297fdd40
rdx                                0
rcx               0xffff800028fe3ff0
rax                                0
r8                 0x101010101010101
r9                0x8080808080808080
r10                                0
r11               0xffffffff815c6a70    x86_bus_space_io_read_1
r12               0xffffffff84638c51    __rodata_start+0x9fc51
r13               0xffff800028fe4c08
r14               0xffff800028fe4e07
r15                              0x1
rip               0xffffffff8312f677    db_enter+0x17
cs                               0x8
rflags                         0x246
rsp               0xffff8000297fdcd0
ss                              0x10
db_enter+0x17:  popq    %rbp
ddb{1}> show proc
PROC (init) tid=20046 pid=1 tcnt=1 stat=onproc
    flags process=10000002<EXEC,WAITEVENT> proc=0
    runpri=17, usrpri=52, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffffffff85e4c060,0xffff800045fff4d0
    process=0xffff8000298034f0 user=0xffff8000297f3000, vmspace=0xffff800000d8a988
    estcpu=2, cpticks=5, pctcpu=0.0, user=0, sys=5, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 85636   83547      1     0  2           0          0           init
 76529  409243  32190     0  2           0          0           syz-executor
 76529  100774  32190     0  2           0  0x4000000           syz-executor
  4207  158919  79769     0  2           0          0           syz-executor
  4207  522546  79769     0  3           0  0x4000080 fsleep    syz-executor
 60119  503453  53367     0  2           0          0           syz-executor
 60119  173612  53367     0  3           0  0x4000080 fsleep    syz-executor
 31340  339232  44524     0  2        0x10          0           syz-executor
 31340  433047  44524     0  3        0x10  0x4000080 fsleep    syz-executor
 37013  498768  77877     0  2           0          0           syz-executor
 37013  238186  77877     0  3           0  0x4000080 fsleep    syz-executor
 48574  392143  49924     0  2           0          0           syz-executor
 48574  456280  49924     0  3           0  0x4000080 kqread    syz-executor
 48574  237981  49924     0  2           0  0x4000000           syz-executor
 90943  299674  57701     0  2           0          0           syz-executor
 90943  446477  57701     0  3           0  0x4000080 fsleep    syz-executor
 11877  118141      0     0  3     0x14000      0x280 nfsidl    nfsio
 13024  169527      0     0  3     0x14000      0x280 nfsidl    nfsio
 40544  222000      0     0  3     0x14000      0x280 nfsidl    nfsio
  9988  482525      0     0  3     0x14000      0x280 nfsidl    nfsio
  7261  444828      0     0  3     0x14000      0x280 nfsidl    nfsio
 94733  315207      0     0  3     0x14000      0x280 nfsidl    nfsio
 21307  373652      0     0  3     0x14000      0x280 nfsidl    nfsio
 97933  472278      0     0  3     0x14000      0x280 nfsidl    nfsio
 99523  215100      0     0  3     0x14000      0x280 nfsidl    nfsio
 71131  401739      0     0  3     0x14000      0x280 nfsidl    nfsio
  3640  203072      0     0  3     0x14000      0x280 nfsidl    nfsio
 83656  462822      0     0  3     0x14000      0x280 nfsidl    nfsio
 42575  473999      0     0  3     0x14000      0x280 nfsidl    nfsio
 15236  480291      0     0  3     0x14000      0x280 nfsidl    nfsio
 98424  362825      0     0  3     0x14000      0x280 nfsidl    nfsio
 58959  316518      0     0  3     0x14000      0x280 nfsidl    nfsio
 59889  259715      0     0  3     0x14000      0x280 nfsidl    nfsio
 79888  521223      0     0  3     0x14000      0x280 nfsidl    nfsio
 19947    1359      0     0  3     0x14000      0x280 nfsidl    nfsio
 72149  362348      0     0  3     0x14000      0x280 nfsidl    nfsio
 49924  158681   1385     0  3         0x2       0x80 nanoslp   syz-executor
 53367  383435   1385     0  3         0x2       0x80 nanoslp   syz-executor
 79769  129462   1385     0  3         0x2       0x80 nanoslp   syz-executor
 57701  341696   1385     0  3         0x2       0x80 nanoslp   syz-executor
 44524   14043   1385     0  3         0x2       0x80 nanoslp   syz-executor
 32190  445758   1385     0  3         0x2       0x80 nanoslp   syz-executor
 57054  293180   1385     0  3         0x2       0x80 nanoslp   syz-executor
 77877  445269   1385     0  2         0x2          0           syz-executor
  1385   27517  62827     0  3         0x2       0x80 kqread    syz-executor
 62827  375807      1     0  2    0x100002       0x88           ksh
  1716  208977  35557    74  3   0x1100012       0x80 bpf       pflogd
 35557  212548      1     0  3           0       0x80 sbwait    pflogd
 69185  459086      1    77  2    0x100012       0x80           dhcpleased
 54736  522540      0     0  2     0x14000 0x40000200           smr
 53123  348650      0     0  2     0x14000      0x200           zerothread
 74469   55782      0     0  3     0x14000      0x200 aiodoned  aiodoned
 84519  250768      0     0  3     0x14000      0x200 syncer    update
 19830  415691      0     0  3     0x14000      0x200 cleaner   cleaner
 78592  195281      0     0  3     0x14000      0x200 reaper    reaper
 94002  239113      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 38537  406485      0     0  3     0x14000      0x200 bored     viomb
 56721  279222      0     0  3     0x14000 0x40000200 acpi0     acpi0
 73394  331917      0     0  3     0x14000 0x40000200           idle1
 65918  485243      0     0  3     0x14000      0x200 bored     softnet1
 99029  451787      0     0  3     0x14000      0x200 bored     softnet0
  6806  472507      0     0  3     0x14000      0x200 bored     systqmp
 23335  287612      0     0  3     0x14000      0x200 bored     systq
 39993  412947      0     0  3     0x14000      0x200 tmoslp    softclockmp
 48202   19965      0     0  3     0x14000 0x40000200 tmoslp    softclock
 15851  193136      0     0  3     0x14000 0x40000200           idle0
*    1   20046      0     0  7  0x10000002          0           init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 1 (init) thread 0xffff800045fffc88 (20046)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8545f080)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
#2  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11081  12411K   12412K 166960K     12276        0
            pcb    17     24K      24K 166960K        25        0
         rtable   239     12K      13K 166960K       353        0
             pf    34     22K      22K 166960K        45        0
         ifaddr    43     12K      12K 166960K        45        0
        ifgroup    55      2K       2K 166960K        55        0
         sysctl     3      1K      13K 166960K         9        0
       counters    70     42K      42K 166960K        70        0
       ioctlops     0      0K       4K 166960K      1489        0
            iov     0      0K      16K 166960K         3        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1363     88K      88K 166960K      1476        0
      UFS quota     1     36K      36K 166960K         1        0
      UFS mount     5     44K      44K 166960K         5        0
            shm     2      2K       2K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     5      0K       0K 166960K         5        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     292K 166960K     11964        0
      file desc    17     65K      93K 166960K       184        0
          sigio     0      0K       0K 166960K         8        0
           proc    23     62K     193K 166960K       563        0
        subproc    72      9K       9K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     20K      20K 166960K         1        0
       in_multi    99      7K       7K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         4        0
    ISOFS mount     1     36K      36K 166960K         1        0
  MSDOSFS mount     1     20K      20K 166960K         1        0
           ttys    49    344K     344K 166960K        49        0
           exec     0      0K       2K 166960K       383        0
   fusefs mount     1     36K      36K 166960K         1        0
            tdb     3      1K       1K 166960K         3        0
        VM swap    14    124K     124K 166960K        15        0
       UVM amap   158    169K     273K 166960K      3458        0
       UVM aobj     4      4K       4K 166960K         4        0
     pinsyscall  1050   1712K    1735K 166960K      1341        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    12      0K       2K 166960K        28        0
           temp    34   9162K    9182K 166960K      4067        0
         kqueue     6     18K      52K 166960K        37        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       35    0       35     1     0     1     1     0     8    1
rtentry    176      112    0        1     6     0     6     6     0     8    0
unpcb      144       90    0       78     2     0     2     2     0     8    1
syncache   336        4    0        4     2     1     1     1     0     8    1
tcpcb      736       14    0       12     1     0     1     1     0     8    0
arp        136       18    0        0     1     0     1     1     0     8    0
inpcb      328       96    0       94     2     0     2     2     0     8    1
nd6        152       25    0        0     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       25    0        0     1     0     1     1     0     8    0
pfstkey    128       25    0        0     1     0     1     1     0     8    0
pfstate    448       25    0        0     3     0     3     3     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      454    0        0    29     0    29    29     0     8    0
art_table   40      455    0        0     5     0     5     5     0     8    0
art_node    32      112    0       11     1     0     1     1     0     8    0
semapl      72        3    0        0     1     0     1     1     0     8    0
shmpl      112        1    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1655    0      182    93     0    93    93     0     8    0
ffsino     296     1655    0      182   114     0   114   114     0     8    0
nchpl      144     1924    0      219    64     0    64    64     0     8    0
vnodes     216     1838    0        0   103     0   103   103     0     8    0
namei      1024    5940    0     5940     1     0     1     1     0     8    1
percpumem   16       51    0        0     1     0     1     1     0     8    0
kstatmem   264       27    0        0     2     0     2     2     0     8    0
scxspl     216     6999    0     6999     4     3     1     3     1     8    1
plimitpl   152       34    0       19     1     0     1     1     0     8    0
sigapl     424      522    0      456     8     0     8     8     0     8    0
knotepl    120       69    0        0     3     0     3     3     0     8    0
kqueuepl   224       45    0       37     1     0     1     1     0     8    0
pipepl     344      135    0      108     3     0     3     3     0     8    0
fdescpl    528      486    0      462     3     0     3     3     0     8    0
filepl     160     1953    0     1769    12     0    12    12     0     8    2
lockfpl    104       36    0       35     1     0     1     1     0     8    0
lockfspl    48       17    0       16     1     0     1     1     0     8    0
sessionpl  144       27    0       19     1     0     1     1     0     8    0
pgrppl      48       35    0       19     1     0     1     1     0     8    0
ucredpl    104      155    0      141     1     0     1     1     0     8    0
zombiepl   144      463    0      456     1     0     1     1     0     8    0
processpl  1232     522    0      456     6     0     6     6     0     8    0
procpl     664      620    0      546     7     0     7     7     0     8    0
sockpl     752      222    0      208     5     0     5     5     0     8    1
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k      2048      17    0        0     3     0     3     3     0     8    0
mextrefs    64       17    0        0     1     0     1     1     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      164    0        0    11     0    11    11     0     8    0
bufpl      272     2382    0      106   152     0   152   152     0     8    0
anonpl      32     4430    0        0    36     0    36    36     0   222    0
amapchunkpl 152    9898    0     9501    23     0    23    23     0   158    3
amappl16   200     1982    0     1960     5     2     3     5     0     8    1
amappl15   192       12    0       12     2     1     1     1     0     8    1
amappl14   184      432    0      431     1     0     1     1     0     8    0
amappl13   176      126    0      123     1     0     1     1     0     8    0
amappl12   168      739    0      717     2     0     2     2     0     8    0
amappl11   160        6    0        5     2     1     1     1     0     8    0
amappl10   152       68    0       62     1     0     1     1     0     8    0
amappl9    144      276    0      276     1     1     0     1     0     8    0
amappl8    136       97    0       96     1     0     1     1     0     8    0
amappl7    128      149    0      145     1     0     1     1     0     8    0
amappl6    120      159    0      158     1     0     1     1     0     8    0
amappl5    112       98    0       94     1     0     1     1     0     8    0
amappl4    104      288    0      282     1     0     1     1     0     8    0
amappl3     96     1751    0     1659     3     0     3     3     0     8    0
amappl2     88      544    0      528     2     0     2     2     0     8    0
amappl1     80    10599    0    10411    15     0    15    15     0     8    5
amappl      88     2730    0     2599     4     0     4     4     0    92    0
uvmvnodes   80       99    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        3    0        0     1     0     1     1     0     8    0
uaddrrnd    24      486    0      462     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      486    0      462     1     0     1     1     0     8    0
vmmpekpl   168     6157    0     6121     2     0     2     2     0     8    0
vmmpepl    168    40213    0    39123    86     0    86    86     0   357   17
vmsppl     488      485    0      461     5     0     5     5     0     8    1
rwobjpl     80    15182    0    14656    24     0    24    24     0     8    2
pdppl      4096     981    0      922    97    24    73    87     0     8   14
pvpl        32    11936    0        0    97     0    97    97     0   265    0
pmappl     256      485    0      461     3     0     3     3     0     8    0
extentpl    40       47    0       29     1     0     1     1     0     8    0
phpool     120      422    0       28    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x19:        leave
x86_ipi_db(ffffffff852c8ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff8545e880) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff8545e880) at __mp_lock+0x272 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load4_noabort(ffffffff8545e880) at __asan_load4_noabort
exit1(ffff8000299127d8,0,e,1) at exit1+0xa5d sys/kern/kern_exit.c:262
sigexit(ffff8000299127d8,e) at sigexit+0x191
postsig(ffff8000299127d8,e,ffff800029957eb0) at postsig+0x847 sys/kern/kern_sig.c:1763
userret(ffff8000299127d8) at userret+0x2fd sys/kern/kern_sig.c:2207
syscall(ffff8000299580a0) at syscall+0x2e0 mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
syscall(ffff8000299580a0) at syscall+0x2e0 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77295d1cf900, count: 1
ddb{0}> trace
x86_ipi_db(ffffffff852c8ff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff8545e880) at __mp_lock+0x272 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff8545e880) at __mp_lock+0x272 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load4_noabort(ffffffff8545e880) at __asan_load4_noabort
exit1(ffff8000299127d8,0,e,1) at exit1+0xa5d sys/kern/kern_exit.c:262
sigexit(ffff8000299127d8,e) at sigexit+0x191
postsig(ffff8000299127d8,e,ffff800029957eb0) at postsig+0x847 sys/kern/kern_sig.c:1763
userret(ffff8000299127d8) at userret+0x2fd sys/kern/kern_sig.c:2207
syscall(ffff8000299580a0) at syscall+0x2e0 mi_syscall_return sys/sys/syscall_mi.h:203 [inline]
syscall(ffff8000299580a0) at syscall+0x2e0 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x77295d1cf900, count: -14
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x17:  popq    %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84638c51) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
witness_checkorder(ffff800028fe4690,9,0) at witness_checkorder+0x25a sys/kern/subr_witness.c:792
mtx_enter(ffff800028fe4680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffff800028fe4680,ffff8000297fe2a0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffff8000298034f0,14e84) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffff800045fffc88,1,ffffffff8235e640,0,ffff8000297fe520,0) at fork1+0x1225 sys/kern/kern_fork.c:511
syscall(ffff8000297fe5c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000297fe5c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b223066c480, count: 5
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84638c51) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffffffff846ec918) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
witness_checkorder(ffff800028fe4690,9,0) at witness_checkorder+0x25a sys/kern/subr_witness.c:792
mtx_enter(ffff800028fe4680) at mtx_enter+0x105 sys/kern/kern_lock.c:406
kqueue_register(ffff800028fe4680,ffff8000297fe2a0,0,0) at kqueue_register+0x3ab sys/kern/kern_event.c:1445
knote_processfork(ffff8000298034f0,14e84) at knote_processfork+0x5b1 sys/kern/kern_event.c:2286
fork1(ffff800045fffc88,1,ffffffff8235e640,0,ffff8000297fe520,0) at fork1+0x1225 sys/kern/kern_fork.c:511
syscall(ffff8000297fe5c0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000297fe5c0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b223066c480, count: -10
ddb{1}> 

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/27 15:02 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 99e40689641a 1f273138 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in witness_checkorder
2026/07/25 04:57 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 7c61c2d2eaf2 492bab15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in witness_checkorder
2026/07/22 21:41 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 7c61c2d2eaf2 4a865b71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in witness_checkorder
2026/07/17 14:50 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 2a13fb6a1f83 7f27c57a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in witness_checkorder
2026/07/13 09:00 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan dbfd7807b1e0 a870962e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in witness_checkorder
* Struck through repros no longer work on HEAD.