syzbot


uvm_fault: witness_checkorder (6)

Status: upstream: reported on 2025/05/16 22:51
Reported-by: syzbot+94c529af6dd3e483cff6@syzkaller.appspotmail.com
First crash: 313d, last: 2d14h
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: witness_checkorder (3) -1 C 212 926d 1179d 0/3 auto-obsoleted due to no activity on 2023/11/01 12:30
openbsd uvm_fault: witness_checkorder (2) -1 1 2318d 2318d 0/3 auto-closed as invalid on 2020/02/18 09:16
openbsd uvm_fault: witness_checkorder -1 syz 2 2349d 2349d 3/3 fixed on 2019/10/22 13:03
openbsd uvm_fault: witness_checkorder (4) -1 1 854d 854d 0/3 auto-obsoleted due to no activity on 2024/02/21 18:24
openbsd uvm_fault: witness_checkorder (5) -1 7 497d 731d 0/3 auto-obsoleted due to no activity on 2025/02/12 06:16

Sample crash report:
uvm_fault(0xfffffd806c6ee9a8, 0x48, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      witness_checkorder+0xb5:        movl    0x20(%r14),%r15d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 235029   8571      0      0x1000  0x4080000    1  syz-executor
witness_checkorder(28,9,0) at witness_checkorder+0xb5 sys/kern/subr_witness.c:779
mtx_enter(18) at mtx_enter+0x95 sys/kern/kern_lock.c:406
clockintr_unbind(ffff800001633430,1) at clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
dt_ioctl_record_stop(ffff80000169b000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
dtclose(11e5f,1,2000,ffff8000ffffc008) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff8000ffffc008) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80003c4bd700) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805da30b38,1,fffffd80097fd340,ffff8000ffffc008) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd800cc50ae0,ffff8000ffffc008) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd800cc50ae0,ffff8000ffffc008) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd800cc50ae0,ffff8000ffffc008) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd800cc50ae0,ffff8000ffffc008) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff8000ffffc008) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff8000ffffc008,b,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff8000ffffc008,ffff80003c4bda70,ffff80003c4bd9c0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c4bda70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4bda70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
end trace frame: 0xffff80003c4bdaf0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffffd806c6ee9a8, 0x48, 0, 1) -> e
ddb{0}> trace
witness_checkorder(28,9,0) at witness_checkorder+0xb5 sys/kern/subr_witness.c:779
mtx_enter(18) at mtx_enter+0x95 sys/kern/kern_lock.c:406
clockintr_unbind(ffff800001633430,1) at clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
dt_ioctl_record_stop(ffff80000169b000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
dtclose(11e5f,1,2000,ffff8000ffffc008) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff8000ffffc008) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80003c4bd700) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805da30b38,1,fffffd80097fd340,ffff8000ffffc008) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd800cc50ae0,ffff8000ffffc008) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd800cc50ae0,ffff8000ffffc008) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd800cc50ae0,ffff8000ffffc008) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd800cc50ae0,ffff8000ffffc008) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff8000ffffc008) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff8000ffffc008,b,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff8000ffffc008,ffff80003c4bda70,ffff80003c4bd9c0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c4bda70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4bda70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74f7d7da1df0, count: -15
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003c4bd520
rbx                                0
rdx                                0
rcx               0xffff8000ffffc008
rax               0xffffffff8391cffe    cpu_info_full_primary+0x1ffe
r8                0xffffffffffffffff
r9                                 0
r10               0xa9345058b88d92cc
r11               0x77f46038940f989a
r12                             0xfe
r13                              0x9
r14                             0x28
r15                                0
rip               0xffffffff8312f4c5    witness_checkorder+0xb5
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80003c4bd480
ss                              0x10
witness_checkorder+0xb5:        movl    0x20(%r14),%r15d
ddb{0}> show proc
PROC (syz-executor) tid=51986 pid=50750 tcnt=0 stat=onproc
    flags process=1008<EXITING,SINGLEEXIT> proc=2000<WEXIT>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff8000ffffc008 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80003c4ada28,0xffff80003c4ad270
    process=0xffff80003b7d4e90 user=0xffff80003c4b8000, vmspace=0xfffffd806c6ee9a8
    estcpu=36, cpticks=10, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  4382  492527  94893      0  2           0                syz-executor
  4382  250760  94893      0  2   0x4000000                syz-executor
 10177   26615  58536      0  3        0x90  nanoslp       syz-executor
 10177  304927  58536      0  3   0x4000090  lockf         syz-executor
 10177  374135  58536      0  3   0x4000090  fsleep        syz-executor
 38728  359653  26388      0  3      0x3000  suspend       syz-executor
 38728  134678  26388      0  2   0x4081000                syz-executor
  8571  316815  24648      0  3      0x3000  suspend       syz-executor
  8571  235029  24648      0  7   0x4081000                syz-executor
  8571  145338  24648      0  3   0x4081000  inode         syz-executor
  8571  122802  24648      0  3   0x4081000  inode         syz-executor
 94893  348966  99814      0  3        0x82  nanoslp       syz-executor
 28359  317792  99814      0  3        0x82  nanoslp       syz-executor
 30298  209337      0      0  3     0x14200  acct          acct
 63259   75981      0      0  3     0x14280  nfsidl        nfsio
  7112  331094      0      0  3     0x14280  nfsidl        nfsio
 57569  108608      0      0  3     0x14280  nfsidl        nfsio
 18247  402109      0      0  3     0x14280  nfsidl        nfsio
 52979  504145      0      0  3     0x14280  nfsidl        nfsio
 91102   96795      0      0  3     0x14280  nfsidl        nfsio
 74312  293021      0      0  3     0x14280  nfsidl        nfsio
 97820  157025      0      0  3     0x14280  nfsidl        nfsio
 22912  291878      0      0  3     0x14280  nfsidl        nfsio
 68727  404608      0      0  3     0x14280  nfsidl        nfsio
  6612   11237      0      0  3     0x14280  nfsidl        nfsio
 13063  266143      0      0  3     0x14280  nfsidl        nfsio
 14142  197605      0      0  3     0x14280  nfsidl        nfsio
 70731  277907      0      0  3     0x14280  nfsidl        nfsio
 63858  374114      0      0  3     0x14280  nfsidl        nfsio
 24416  313141      0      0  3     0x14280  nfsidl        nfsio
 31985  247558      0      0  3     0x14280  nfsidl        nfsio
 83399  166255      0      0  3     0x14280  nfsidl        nfsio
 91773  325714      0      0  3     0x14280  nfsidl        nfsio
 99039  272106      0      0  3     0x14280  nfsidl        nfsio
 81297  415718  99814      0  2         0x2                syz-executor
 24648  477420  99814      0  3        0x82  nanoslp       syz-executor
 31233   93237  99814      0  3        0x82  nanoslp       syz-executor
 44819  182811  99814      0  3        0x82  nanoslp       syz-executor
 58536  354101  99814      0  3        0x82  nanoslp       syz-executor
 26388  166017  99814      0  3        0x82  nanoslp       syz-executor
 99814  382152  67489      0  3        0x82  kqread        syz-executor
 67489  433410  18301      0  3    0x10008a  sigsusp       ksh
 18301  123671  74145      0  3        0x98  kqread        sshd-session
 74145  234039  33474      0  3        0x92  kqread        sshd-session
 19465  271906      1      0  3    0x100083  ttyopn        getty
 33474  143748      1      0  3        0x88  kqread        sshd
  1837   45563  62572     74  3   0x1100092  bpf           pflogd
 62572  521279      1      0  3        0x80  sbwait        pflogd
 53038  103841  75659     73  3   0x1100090  kqread        syslogd
 75659   59894      1      0  3    0x100082  sbwait        syslogd
 11898  378179      1      0  3    0x100080  kqread        resolvd
 35587  459912  87030     77  3    0x100092  kqread        dhcpleased
 89727  144255  87030     77  3    0x100092  kqread        dhcpleased
 87030   63208      1      0  3        0x80  kqread        dhcpleased
 23035   80688      0      0  3     0x14200  bored         smr
 93505  414443      0      0  3     0x14200  pgzero        zerothread
 63443  318930      0      0  3     0x14200  aiodoned      aiodoned
 46126  473135      0      0  3     0x14200  syncer        update
 54589  124149      0      0  3     0x14200  cleaner       cleaner
 23364  510973      0      0  3     0x14200  reaper        reaper
 42437  113974      0      0  3     0x14200  pgdaemon      pagedaemon
 86551  247757      0      0  3     0x14200  bored         viomb
 89091  390263      0      0  3  0x40014200  acpi0         acpi0
 43101   11227      0      0  3  0x40014200                idle1
  5680   54712      0      0  3     0x14200  bored         softnet1
 26331  151300      0      0  3     0x14200  bored         softnet0
 21053  505083      0      0  3     0x14200  bored         systqmp
 31151    4504      0      0  3     0x14200  bored         systq
  4819  257936      0      0  3     0x14200  tmoslp        softclockmp
  5937   49850      0      0  3  0x40014200  tmoslp        softclock
  4751  359789      0      0  3  0x40014200                idle0
     1  394452      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 38728 (syz-executor) thread 0xffff80003c4ad4f8 (134678)
exclusive rrwlock inode r = 0 (0xfffffd806c887560)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x18f sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x2bd sys/kern/sys_generic.c:384
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
Process 8571 (syz-executor) thread 0xffff80003c4ac800 (235029)
exclusive rrwlock inode r = 0 (0xfffffd806c887d78)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x18f sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x2bd sys/kern/sys_generic.c:384
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#9  Xsyscall+0x128
Process 8571 (syz-executor) thread 0xffff80003c4ad790 (145338)
exclusive rrwlock inode r = 0 (0xfffffd806c887a00)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x11c sys/kern/vfs_lookup.c:-1
#6  namei+0x7ca sys/kern/vfs_lookup.c:250
#7  vn_open+0x1f1 sys/kern/vfs_vnops.c:107
#8  doopenat+0x35b sys/kern/vfs_syscalls.c:1155
#9  sys_open+0x59 sys/kern/vfs_syscalls.c:1063
#10 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#11 Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11079  12187K   12499K 166960K     12727        0
            pcb    17     14K      15K 166960K       151        0
         rtable   243     10K      10K 166960K       492        0
             pf    33     17K      21K 166960K        96        0
         ifaddr    38      6K       8K 166960K        76        0
        ifgroup    48      2K       2K 166960K       106        0
         sysctl     4      1K       9K 166960K        10        0
       counters    68     36K      38K 166960K       130        0
       ioctlops     0      0K       4K 166960K      1601        0
            iov     0      0K      16K 166960K        22        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1332     84K      84K 166960K      1781        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       1K 166960K        23        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K     240K 166960K       612        0
          sigio     0      0K       0K 166960K         8        0
           proc    72    115K     163K 166960K       643        0
        subproc    72      4K       4K 166960K        90        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        51        0
       in_multi    87      6K       7K 166960K       136        0
    ether_multi     1      0K       0K 166960K         4        0
            mrt     1      0K       0K 166960K        20        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       485        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   250    168K     185K 166960K      7141        0
       UVM aobj    13      6K       6K 166960K        15        0
     pinsyscall    42     84K     100K 166960K      1795        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        36        0
            NDP    11      0K       2K 166960K        51        0
           temp    57   9078K    9146K 166960K     30547        0
         kqueue    13     20K      28K 166960K       119        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       61    0       58     1     0     1     1     0     8    0
rtentry    176      146    0       46     6     0     6     6     0     8    0
unpcb      144      212    0      193     1     0     1     1     0     8    0
syncache   336        5    0        5     2     1     1     1     0     8    1
tcpcb      736      233    0      229    11     6     5     7     0     8    4
arp        136       24    0        9     1     0     1     1     0     8    0
inpcb      328      943    0      934    20    11     9    12     0     8    8
nd6        152       33    0       10     2     1     1     2     0     8    0
pkpcb       40        2    0        2     1     0     1     1     0     8    1
kcovpl      48       10    0        2     1     0     1     1     0     8    0
ppxss      1192      25    0       25     1     0     1     1     0     8    1
pppxif     1576       4    0        4     2     2     0     1     0     8    0
pffrag     232        3    0        1     1     0     1     1     0   482    0
pffrnode    88        3    0        1     1     0     1     1     0     8    0
pffrent     40        5    0        3     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       4    0        1     1     0     1     1     0     8    0
pfanchor   1288       1    0        0     1     0     1     1     0     8    0
pfstitem    24       52    0       10     1     0     1     1     0     8    0
pfstkey    128       52    0       10     2     0     2     2     0     8    0
pfstate    448       52    0       10     5     0     5     5     0     8    0
pfrule     1360      24    0       18     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      565    0      153    30     1    29    30     0     8    3
art_table   40      568    0      153     5     0     5     5     0     8    0
art_node    32      146    0       56     1     0     1     1     0     8    0
sysvmsgpl   40        9    0        7     1     0     1     1     0     8    0
semupl     112        2    0        2     2     1     1     1     0     8    1
semapl     112       18    0        8     1     0     1     1     0     8    0
shmpl      112       10    0        2     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     2432    0      965    93     0    93    93     0     8    0
ffsino     296     2432    0      965   114     0   114   114     0     8    0
nchpl      144     3221    0     1514    64     0    64    64     0     8    0
rtmask      32        6    0        6     2     1     1     1     0     8    1
vnodes     216     2741    0        0   153     0   153   153     0     8    0
namei      1024   10761    0    10759     2     1     1     2     0     8    0
percpumem   16       80    0       31     1     0     1     1     0     8    0
vcpupl     3968       2    0        0     1     0     1     1     0     8    0
vmpool     848        2    0        0     1     0     1     1     0     8    0
pfiaddrpl  120        1    0        0     1     0     1     1     0     8    0
kstatmem   264       62    0       38     3     1     2     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        2    0        2     1     1     0     1     0     8    0
scxspl     216    19279    0    19279    12    11     1     8     1     8    1
plimitpl   152      161    0      142     1     0     1     1     0     8    0
sigapl     424      919    0      851     8     0     8     8     0     8    0
knotepl    120      311    0        0    10     0    10    10     0     8    0
kqueuepl   224      224    0      215     5     2     3     5     0     8    2
pipepl     344      191    0      164     3     0     3     3     0     8    0
fdescpl    528      882    0      851     3     0     3     3     0     8    0
filepl     160     5227    0     4999    19     4    15    16     0     8    5
lockfpl    104      295    0      289     1     0     1     1     0     8    0
lockfspl    48       92    0       88     1     0     1     1     0     8    0
sessionpl  144       26    0       17     1     0     1     1     0     8    0
pgrppl      48       45    0       28     1     0     1     1     0     8    0
ucredpl    104      789    0      775     1     0     1     1     0     8    0
zombiepl   144      856    0      851     1     0     1     1     0     8    0
processpl  1232     919    0      851     6     0     6     6     0     8    0
procpl     664     1670    0     1595     8     0     8     8     0     8    0
sosppl     176        3    0        3     1     1     0     1     0     8    0
sockpl     752     1270    0     1239    27    16    11    17     0     8    7
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k      2048      20    0        0     3     0     3     3     0     8    0
mtagpl      96       11    0        0     1     0     1     1     0     8    0
mbufpl     256      178    0        0    12     0    12    12     0     8    0
bufpl      280     7667    0     1537   438     0   438   438     0     8    0
anonpl      32    12154    0        0    98     0    98    98     0   246    0
amapchunkpl 152   22448    0    21862    31     3    28    28     0   158    2
amappl16   200     3542    0     3265    33     8    25    25     0     8    1
amappl15   192        6    0        6     1     1     0     1     0     8    0
amappl14   184      456    0      455     1     0     1     1     0     8    0
amappl13   176      127    0      115     1     0     1     1     0     8    0
amappl12   168     1163    0     1133     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       68    0       54     1     0     1     1     0     8    0
amappl9    144      269    0      269     1     1     0     1     0     8    0
amappl8    136      115    0      112     1     0     1     1     0     8    0
amappl7    128      152    0      139     1     0     1     1     0     8    0
amappl6    120      179    0      178     1     0     1     1     0     8    0
amappl5    112      102    0       91     1     0     1     1     0     8    0
amappl4    104      301    0      280     1     0     1     1     0     8    0
amappl3     96     4431    0     4316     4     0     4     4     0     8    0
amappl2     88      567    0      505     2     0     2     2     0     8    0
amappl1     80    12093    0    11492    17     1    16    16     0     8    2
amappl      88     6305    0     6129     5     0     5     5     0    92    0
uvmvnodes   80      119    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma2048    2048       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       14    0        2     1     0     1     1     0     8    0
uaddrrnd    24      882    0      851     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      882    0      851     1     0     1     1     0     8    0
vmmpekpl   168     9148    0     9102     3     0     3     3     0     8    0
vmmpepl    168    64668    0    62481   110     4   106   106     0   357    0
vmsppl     488      881    0      851     6     1     5     5     0     8    0
rwobjpl     80    21021    0    19700    32     0    32    32     0     8    0
pdppl      4096    1775    0     1704   112    39    73    83     0     8    2
pvpl        32    18118    0        0   146     0   146   146     0   265    0
pmappl     256      883    0      851     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      303    0       52     8     0     8     8     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
witness_checkorder(28,9,0) at witness_checkorder+0xb5 sys/kern/subr_witness.c:779
mtx_enter(18) at mtx_enter+0x95 sys/kern/kern_lock.c:406
clockintr_unbind(ffff800001633430,1) at clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
dt_ioctl_record_stop(ffff80000169b000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
dtclose(11e5f,1,2000,ffff8000ffffc008) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff8000ffffc008) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80003c4bd700) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805da30b38,1,fffffd80097fd340,ffff8000ffffc008) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd800cc50ae0,ffff8000ffffc008) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd800cc50ae0,ffff8000ffffc008) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd800cc50ae0,ffff8000ffffc008) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd800cc50ae0,ffff8000ffffc008) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff8000ffffc008) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff8000ffffc008,b,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff8000ffffc008,ffff80003c4bda70,ffff80003c4bd9c0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c4bda70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4bda70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74f7d7da1df0, count: -15
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299bdff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a79b80) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a79b80) at __mp_lock+0x192 sys/kern/kern_lock.c:173
__mp_acquire_count(ffffffff83a79b80,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:369
biowait(fffffd8067db0388) at biowait+0xc6 sys/kern/vfs_bio.c:1242
bwrite(fffffd8067db0388) at bwrite+0x2e7 sys/kern/vfs_bio.c:754
ffs_write(ffff80002a36ebd0) at ffs_write+0x810 sys/ufs/ffs/ffs_vnops.c:377
VOP_WRITE(fffffd8060600458,ffff80002a36ed88,7,fffffd80097fd340) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806d57c8d8,ffff80002a36ed88,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:408
dofilewritev(ffff80003c4ac800,4,ffff80002a36ed88,0,ffff80002a36ee40) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff80003c4ac800,ffff80002a36eef0,ffff80002a36ee40) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80002a36eef0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a36eef0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
end trace frame: 0xffff80002a36ef70, count: 0
ddb{1}> trace
x86_ipi_db(ffff8000299bdff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a79b80) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a79b80) at __mp_lock+0x192 sys/kern/kern_lock.c:173
__mp_acquire_count(ffffffff83a79b80,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:369
biowait(fffffd8067db0388) at biowait+0xc6 sys/kern/vfs_bio.c:1242
bwrite(fffffd8067db0388) at bwrite+0x2e7 sys/kern/vfs_bio.c:754
ffs_write(ffff80002a36ebd0) at ffs_write+0x810 sys/ufs/ffs/ffs_vnops.c:377
VOP_WRITE(fffffd8060600458,ffff80002a36ed88,7,fffffd80097fd340) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806d57c8d8,ffff80002a36ed88,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:408
dofilewritev(ffff80003c4ac800,4,ffff80002a36ed88,0,ffff80002a36ee40) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff80003c4ac800,ffff80002a36eef0,ffff80002a36ee40) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80002a36eef0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a36eef0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa9ad5c7f410, count: -15

Crashes (87):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/24 07:08 openbsd 2084961b940b baf8bf12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/23 18:06 openbsd ccfcb3e6ef18 5e3db351 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/21 00:55 openbsd 65032adb4937 85bf2a64 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/20 17:53 openbsd 65032adb4937 85bf2a64 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/18 19:53 openbsd 561bf2d2294a 0199f9a1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/18 01:58 openbsd 7b59c65f5490 c8810548 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/17 09:36 openbsd 5eccae830399 0737c18f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/03/11 10:51 openbsd 177cf78f1bc3 b4075e21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/02/07 03:37 openbsd 468b83701423 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/02/07 01:05 openbsd 468b83701423 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/02/06 19:06 openbsd 468b83701423 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/02/03 15:57 openbsd 72466e384590 018ebef2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/02/01 03:37 openbsd 43ad07ab5076 6b8752f2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/31 13:15 openbsd 3729e22e7105 afc0c4d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/27 14:12 openbsd 4b649cda673b 71ad32b1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/26 21:17 openbsd 4c8dfe351ad4 a4c52dd6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/25 13:44 openbsd f99cc216b56b 40acda8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/25 05:20 openbsd 12762e433761 40acda8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/20 01:05 openbsd deb62df5ff8f 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/15 14:54 openbsd c600931321c7 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/15 05:30 openbsd ac9e191703f1 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/14 16:15 openbsd bf518416d64f 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/13 11:59 openbsd 67ddd48175b9 56f88057 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/07 18:58 openbsd b6bc6e61f2e3 15f6fd08 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/06 14:39 openbsd 4459f914e6b0 15f6fd08 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2026/01/04 01:34 openbsd 80bc9799356e e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/12/23 16:27 openbsd c8ac761eb131 5dc09de1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/12/23 08:32 openbsd c8ac761eb131 607f1549 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/12/17 01:52 openbsd 3a6d4b98bde9 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/12/12 08:15 openbsd 6168265ddf60 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/12/01 11:42 openbsd 6bf0f93af4a8 01c07bfe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/12/01 08:03 openbsd 6bf0f93af4a8 01c07bfe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/30 11:14 openbsd 0086034dedf2 01c07bfe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/30 05:58 openbsd 0086034dedf2 01c07bfe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/27 17:15 openbsd 7de01a79e4ba e8331348 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/22 00:44 openbsd 16f4e75c8e57 4fb8ef37 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/18 17:08 openbsd ae8b598acb72 ef766cd7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/18 12:34 openbsd ae8b598acb72 ef766cd7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/18 04:38 openbsd 8720e5dd1696 ef766cd7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/16 23:07 openbsd 59cee6408d9e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/16 00:07 openbsd 42d4ce758e42 f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/14 22:51 openbsd 56163c0cd41e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/12 12:50 openbsd 30ee307006ea 07e030de .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/11/04 05:50 openbsd 512bb19460b6 686bf657 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/10/27 08:45 openbsd 31b2223d374b c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/10/26 16:56 openbsd a7edf25a2cbd c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/10/26 11:42 openbsd 1ff8d81aaa1e c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/10/25 02:09 openbsd 710ece6a621e c0460fcd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/24 08:24 openbsd 484d3a4d3e0d 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/24 06:17 openbsd 484d3a4d3e0d 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/15 07:52 openbsd feb5a82c5bff 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/14 20:36 openbsd 427cdd1fb5e1 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/13 14:38 openbsd 5bd8d26974b4 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/09 18:52 openbsd e91e1a12e0dd 956bd956 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/09 18:52 openbsd e91e1a12e0dd 956bd956 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/02 04:13 openbsd 15da244b1a00 bc80e4f0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/01 19:39 openbsd c56681b2e09c 091a06cd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/07/01 04:18 openbsd 76905433011a 6e83b42d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/24 19:05 openbsd b3c44d07fb7e 26d77996 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/24 19:05 openbsd b3c44d07fb7e 26d77996 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/24 19:05 openbsd b3c44d07fb7e 26d77996 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/21 02:07 openbsd f62159b6a996 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/09 08:17 openbsd 1d858eebbab4 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/09 02:28 openbsd 1d858eebbab4 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/06/05 20:40 openbsd c875838447ad 6b6b5f21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/05/18 21:36 openbsd 6decc3d5f4d6 f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
2025/05/16 22:51 openbsd f47d9bee1200 f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: witness_checkorder
* Struck through repros no longer work on HEAD.