assert "map->limit == rtmap_limit" failed in rtable.c (2)

Status: upstream: reported on 2025/02/06 18:09
Reported-by: syzbot+4b7aca0368015987c9cc@syzkaller.appspotmail.com
First crash: 633d, last: 19h47m
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "map->limit == rtmap_limit" failed in rtable.c -1 77 711d 842d 0/4 auto-obsoleted due to no activity on 2025/01/09 07:35

Sample crash report:
panic: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/multicore/kernel/sys/net/rtable.c", line 132
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 517980   1661      0           0          0    0  syz-executor
* 32242   1661      0           0  0x4000000    1K syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834e3cdf) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff83526dac,ffffffff8352646e,84,ffffffff83580e24) at __assert+0x29 sys/kern/subr_prf.c:-1
rtmap_grow(21,21) at rtmap_grow+0x24f
rtable_add(20) at rtable_add+0x2d9 rtable_alloc sys/net/rtable.c:370 [inline]
rtable_add(20) at rtable_add+0x2d9 sys/net/rtable.c:223
route_output(ffffee806cd9f300,ffff8000015b08e0) at route_output+0x532 sys/net/rtsock.c:767
route_send(ffff8000015b08e0,ffffee806cd9f300,0,0) at route_send+0xd7 sys/net/rtsock.c:322
sosend(ffff8000015b08e0,0,ffff8000393aadf8,0,0,2) at sosend+0x7f4 sys/kern/uipc_socket.c:-1
sendit(ffff80002a288558,5,ffff8000393aaef0,2,ffff8000393aafa0) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendto(ffff80002a288558,ffff8000393ab050,ffff8000393aafa0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
syscall(ffff8000393ab050) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000393ab050) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x48a2d34d740, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "map->limit == rtmap_limit" failed: file "/syzkaller/managers/multicore/kernel/sys/net/rtable.c", line 132
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834e3cdf) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff83526dac,ffffffff8352646e,84,ffffffff83580e24) at __assert+0x29 sys/kern/subr_prf.c:-1
rtmap_grow(21,21) at rtmap_grow+0x24f
rtable_add(20) at rtable_add+0x2d9 rtable_alloc sys/net/rtable.c:370 [inline]
rtable_add(20) at rtable_add+0x2d9 sys/net/rtable.c:223
route_output(ffffee806cd9f300,ffff8000015b08e0) at route_output+0x532 sys/net/rtsock.c:767
route_send(ffff8000015b08e0,ffffee806cd9f300,0,0) at route_send+0xd7 sys/net/rtsock.c:322
sosend(ffff8000015b08e0,0,ffff8000393aadf8,0,0,2) at sosend+0x7f4 sys/kern/uipc_socket.c:-1
sendit(ffff80002a288558,5,ffff8000393aaef0,2,ffff8000393aafa0) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendto(ffff80002a288558,ffff8000393ab050,ffff8000393aafa0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
syscall(ffff8000393ab050) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000393ab050) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x48a2d34d740, count: -12
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff8000393aaa00
rbx               0xffff80002999ee0f
rdx                                0
rcx               0xffff80002a288558
rax               0xffff80002999dff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xf9475870155de422
r11               0xa6d62e3293308504
r12               0xffff80002999ec10
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff82ff2eb5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff8000393aa9f0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=32242 pid=1661 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a247a08,0xffff80002a246028
    process=0xffff80003c3d3090 user=0xffff8000393a6000, vmspace=0xffffee806cc99d80
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
  1661  517980  70872     0  7           0          0           syz-executor
* 1661   32242  70872     0  7           0  0x4000000           syz-executor
  1661  398657  70872     0  3           0  0x4000080 fsleep    syz-executor
 70559  160750  46123     0  2           0          0           syz-executor
 70559  128906  46123     0  2           0  0x4000000           syz-executor
 70559  294334  46123     0  3           0  0x4000080 fsleep    syz-executor
 82955  281966   2672     0  2           0          0           syz-executor
 82955  182169   2672     0  3           0  0x4000000 biowait   syz-executor
 11608  370006  16549     0  2           0          0           syz-executor
 11608   18816  16549     0  2           0  0x4000000           syz-executor
 34458  453758      1     0  3         0x2       0x80 nanoslp   getty
  7746  248392   6669     0  3           0       0x80 nanoslp   syz-executor
  7746  125489   6669     0  3           0  0x4000080 fsleep    syz-executor
  7746  291144   6669     0  3           0  0x4000080 ttyin     syz-executor
 46123  388612  98255     0  3         0x2       0x80 nanoslp   syz-executor
  2672  164507  98255     0  3         0x2       0x80 nanoslp   syz-executor
  5301  305907  98255     0  3         0x2       0x80 piperd    syz-executor
 16549  291107  98255     0  3         0x2       0x80 nanoslp   syz-executor
 70872  169450  98255     0  3         0x2       0x80 nanoslp   syz-executor
  6669  179371  98255     0  3         0x2       0x80 nanoslp   syz-executor
 98255  121515      1     0  3         0x2       0x80 wait      syz-executor
 34912  478172      0     0  3     0x14000      0x200 bored     smr
 40560  470763      0     0  2     0x14000      0x200           zerothread
 94344  473538      0     0  3     0x14000      0x200 aiodoned  aiodoned
 41123  206249      0     0  3     0x14000      0x200 syncer    update
 88137  479810      0     0  3     0x14000      0x200 cleaner   cleaner
 91173  236364      0     0  3     0x14000      0x200 reaper    reaper
 46099  366909      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 15851  188557      0     0  3     0x14000      0x200 bored     viomb
 38232   80599      0     0  3     0x14000 0x40000200 acpi0     acpi0
 99369   44038      0     0  3     0x14000 0x40000200           idle1
  4466  359122      0     0  3     0x14000      0x200 bored     softnet1
 36586  272038      0     0  3     0x14000      0x200 bored     softnet0
 49703   30987      0     0  3     0x14000      0x200 bored     systqmp
  2679  265792      0     0  3     0x14000      0x200 bored     systq
 13545  308690      0     0  3     0x14000      0x200 tmoslp    softclockmp
 48249  393908      0     0  3     0x14000 0x40000200 tmoslp    softclock
 33553  460046      0     0  3     0x14000 0x40000200           idle0
     1  136354      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 1661 (syz-executor) thread 0xffff80002a288558 (32242)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83ab1c80)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
#2  malloc+0xe3 sys/kern/kern_malloc.c:174
#3  rtmap_grow+0xb2 sys/net/rtable.c:127
#4  rtable_add+0x2d9 rtable_alloc sys/net/rtable.c:370 [inline]
#4  rtable_add+0x2d9 sys/net/rtable.c:223
#5  route_output+0x532 sys/net/rtsock.c:767
#6  route_send+0xd7 sys/net/rtsock.c:322
#7  sosend+0x7f4 sys/kern/uipc_socket.c:-1
#8  sendit+0x5a5 sys/kern/uipc_syscalls.c:785
#9  sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
#10 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#11 Xsyscall+0x128
exclusive rwlock sbufsnd r = 0 (0xffff8000015b0ac8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  sblock+0xb6 sys/kern/uipc_socket2.c:536
#3  sosend+0x2d9 sys/kern/uipc_socket.c:639
#4  sendit+0x5a5 sys/kern/uipc_syscalls.c:785
#5  sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
Process 70559 (syz-executor) thread 0xffff80002a246548 (128906)
exclusive rrwlock inode r = 0 (0xffffee80657891f8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vget+0x2a2 sys/kern/vfs_subr.c:692
#6  ufs_ihashget+0x18c sys/ufs/ufs/ufs_ihash.c:100
#7  ffs_vget+0x8c sys/ufs/ffs/ffs_vfsops.c:1203
#8  ufs_lookup+0x157a sys/ufs/ufs/ufs_lookup.c:573
#9  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x9f0 sys/kern/vfs_lookup.c:585
#11 namei+0x5ea sys/kern/vfs_lookup.c:250
#12 dofstatat+0xf2 sys/kern/vfs_syscalls.c:2025
#13 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#14 Xsyscall+0x128
Process 82955 (syz-executor) thread 0xffff80002a246a78 (281966)
exclusive rwlock vmmaplk r = 0 (0xffffee806cc99310)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5170
#3  uvm_map_protect+0xe1 sys/uvm/uvm_map.c:3081
#4  sys_mprotect+0x351 sys/uvm/uvm_mmap.c:590
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#6  Xsyscall+0x128
Process 82955 (syz-executor) thread 0xffff80002a2462b0 (182169)
exclusive rrwlock inode r = 0 (0xffffee8065789c60)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:156
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_makeinode+0xcd sys/ufs/ufs/ufs_vnops.c:1759
#8  ufs_mknod+0x5b sys/ufs/ufs/ufs_vnops.c:167
#9  VOP_MKNOD+0x101 sys/kern/vfs_vops.c:121
#10 domknodat+0x457 sys/kern/vfs_syscalls.c:1579
#11 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#12 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xffffee8065789570)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:576
#5  vfs_lookup+0x10e sys/kern/vfs_lookup.c:431
#6  namei+0x5ea sys/kern/vfs_lookup.c:250
#7  domknodat+0xb4 sys/kern/vfs_syscalls.c:1531
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#9  Xsyscall+0x128
Process 11608 (syz-executor) thread 0xffff800033397778 (18816)
exclusive rwlock sbufsnd r = 0 (0xffff8000015b1688)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x42c sys/kern/kern_rwlock.c:320
#2  sblock+0xb6 sys/kern/uipc_socket2.c:536
#3  sosend+0x2d9 sys/kern/uipc_socket.c:639
#4  sendit+0x5a5 sys/kern/uipc_syscalls.c:785
#5  sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11044  12015K   12153K 166960K     12172        0
            pcb    18     12K      12K 166960K        22        0
         rtable   251      9K       9K 166960K       372        0
             pf    34     17K      18K 166960K        47        0
         ifaddr    43      7K       7K 166960K        46        0
        ifgroup    55      2K       2K 166960K        57        0
         sysctl     3      1K       9K 166960K         7        0
       counters    70     37K      37K 166960K        72        0
       ioctlops     0      0K       4K 166960K      1487        0
            iov     0      0K      12K 166960K         1        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1292     81K      81K 166960K      1381        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     4      0K       0K 166960K         5        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    14     53K      93K 166960K       162        0
           proc    19     33K     164K 166960K       567        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         1        0
       in_multi    99      6K       6K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    49    228K     228K 166960K        49        0
           exec     0      0K       1K 166960K       394        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   122     83K     175K 166960K      3464        0
       UVM aobj     3      2K       2K 166960K         3        0
     pinsyscall    17     34K     105K 166960K      1302        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    12      0K       2K 166960K        29        0
           temp    34   9122K    9186K 166960K      4565        0
         kqueue     1      2K      24K 166960K        29        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       38    0       35     1     0     1     1     0     8    0
rtentry    176      113    0        1     6     0     6     6     0     8    0
unpcb      144       55    0       55     1     0     1     1     0     8    1
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736       14    0       13     1     0     1     1     0     8    0
arp        136       18    0        0     1     0     1     1     0     8    0
inpcb      328      115    0      111     4     3     1     4     0     8    0
nd6        152       26    0        0     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       1    0        1     1     1     0     1     0     8    0
pffrag     232        6    0        0     1     0     1     1     0   482    0
pffrnode    88        6    0        0     1     0     1     1     0     8    0
pffrent     40        6    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfqueue    320        1    0        1     1     0     1     1     0     8    1
pfstitem    24       32    0        0     1     0     1     1     0     8    0
pfstkey    128       32    0        0     2     0     2     2     0     8    0
pfstate    448       32    0        0     4     0     4     4     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      469    0        0    30     0    30    30     0     8    0
art_table   40      470    0        0     5     0     5     5     0     8    0
art_node    32      113    0       11     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        1     1     1     0     1     0     8    0
semapl      72        3    0        1     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1629    0      147    93     0    93    93     0     8    0
ffsino     296     1629    0      147   115     0   115   115     0     8    0
nchpl      144     1863    0      154    64     0    64    64     0     8    0
vnodes     216     1729    0        0    97     0    97    97     0     8    0
namei      1024    6364    0     6362    12     4     8     8     0     8    7
percpumem   16       52    0        1     1     0     1     1     0     8    0
kstatmem   264       29    0        2     2     0     2     2     0     8    0
scxspl     216     8381    0     8380     3     2     1     2     1     8    0
plimitpl   152       34    0       22     1     0     1     1     0     8    0
sigapl     424      467    0      434     7     1     6     7     0     8    1
knotepl    120      271    0        0     9     0     9     9     0     8    0
kqueuepl   224       28    0       27     1     0     1     1     0     8    0
pipepl     344      126    0       99     3     0     3     3     0     8    0
fdescpl    528      451    0      434     3     0     3     3     0     8    0
filepl     160     1695    0     1536    11     0    11    11     0     8    2
lockfpl    104       16    0       16     1     0     1     1     0     8    1
lockfspl    48        8    0        8     1     0     1     1     0     8    1
sessionpl  144       25    0       23     1     0     1     1     0     8    0
pgrppl      48       33    0       23     1     0     1     1     0     8    0
ucredpl    104      118    0      115     1     0     1     1     0     8    0
zombiepl   144      449    0      447     2     1     1     1     0     8    0
processpl  1240     467    0      434     5     0     5     5     0     8    0
procpl     664      523    0      482     6     0     6     6     0     8    0
sockpl     752      208    0      201     7     3     4     7     0     8    2
mcl64k     65536     10    0        0     2     0     2     2     0     8    0
mcl16k     16384      6    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k128   9344       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     123    0        0    16     0    16    16     0     8    0
mcl2k      2048      20    0        0     3     0     3     3     0     8    0
mextrefs    64       18    0        0     1     0     1     1     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      183    0        0    12     0    12    12     0     8    0
bufpl      272     4431    0       91   290     0   290   290     0     8    0
anonpl      32     8054    0        0    65     0    65    65     0   247    0
amapchunkpl 152    9779    0     9351    35     3    32    32     0   158    9
amappl16   200     1263    0     1249     5     3     2     4     0     8    0
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184      417    0      417     1     0     1     1     0     8    1
amappl13   176      119    0      118     1     0     1     1     0     8    0
amappl12   168      697    0      681     2     0     2     2     0     8    0
amappl11   160        4    0        4     1     1     0     1     0     8    0
amappl10   152       66    0       66     1     0     1     1     0     8    1
amappl9    144      310    0      310     1     1     0     1     0     8    0
amappl8    136       92    0       92     1     0     1     1     0     8    1
amappl7    128      141    0      139     1     0     1     1     0     8    0
amappl6    120      116    0      116     1     0     1     1     0     8    1
amappl5    112      145    0      145     1     0     1     1     0     8    1
amappl4    104      287    0      285     1     0     1     1     0     8    0
amappl3     96     1719    0     1652     4     1     3     4     0     8    0
amappl2     88      453    0      446     2     0     2     2     0     8    0
amappl1     80    10178    0    10070    15     1    14    15     0     8    6
amappl      88     2712    0     2607     4     0     4     4     0    92    0
uvmvnodes   80      103    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      451    0      434     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      451    0      434     1     0     1     1     0     8    0
vmmpekpl   168     5497    0     5457     2     0     2     2     0     8    0
vmmpepl    168    38080    0    37349    88     3    85    87     0   357   40
vmsppl     488      450    0      434     6     1     5     5     0     8    1
rwobjpl     80    13877    0    13488    23     0    23    23     0     8    2
pdppl      4096     909    0      868    95    24    71    85     0     8   30
pvpl        32    12971    0        0   106     1   105   105     0   265    0
pmappl     256      450    0      434     4     1     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      574    0       33    16     0    16    16     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83995ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83ab1480) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83ab1480) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80002a28f130,ffff8000002a2900) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
end of kernel
end trace frame: 0x7f28b6553970, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff83995ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83ab1480) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83ab1480) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80002a28f130,ffff8000002a2900) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
end of kernel
end trace frame: 0x7f28b6553970, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834e3cdf) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff83526dac,ffffffff8352646e,84,ffffffff83580e24) at __assert+0x29 sys/kern/subr_prf.c:-1
rtmap_grow(21,21) at rtmap_grow+0x24f
rtable_add(20) at rtable_add+0x2d9 rtable_alloc sys/net/rtable.c:370 [inline]
rtable_add(20) at rtable_add+0x2d9 sys/net/rtable.c:223
route_output(ffffee806cd9f300,ffff8000015b08e0) at route_output+0x532 sys/net/rtsock.c:767
route_send(ffff8000015b08e0,ffffee806cd9f300,0,0) at route_send+0xd7 sys/net/rtsock.c:322
sosend(ffff8000015b08e0,0,ffff8000393aadf8,0,0,2) at sosend+0x7f4 sys/kern/uipc_socket.c:-1
sendit(ffff80002a288558,5,ffff8000393aaef0,2,ffff8000393aafa0) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendto(ffff80002a288558,ffff8000393ab050,ffff8000393aafa0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
syscall(ffff8000393ab050) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000393ab050) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x48a2d34d740, count: 3
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff834e3cdf) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff83526dac,ffffffff8352646e,84,ffffffff83580e24) at __assert+0x29 sys/kern/subr_prf.c:-1
rtmap_grow(21,21) at rtmap_grow+0x24f
rtable_add(20) at rtable_add+0x2d9 rtable_alloc sys/net/rtable.c:370 [inline]
rtable_add(20) at rtable_add+0x2d9 sys/net/rtable.c:223
route_output(ffffee806cd9f300,ffff8000015b08e0) at route_output+0x532 sys/net/rtsock.c:767
route_send(ffff8000015b08e0,ffffee806cd9f300,0,0) at route_send+0xd7 sys/net/rtsock.c:322
sosend(ffff8000015b08e0,0,ffff8000393aadf8,0,0,2) at sosend+0x7f4 sys/kern/uipc_socket.c:-1
sendit(ffff80002a288558,5,ffff8000393aaef0,2,ffff8000393aafa0) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendto(ffff80002a288558,ffff8000393ab050,ffff8000393aafa0) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:563
syscall(ffff8000393ab050) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000393ab050) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x48a2d34d740, count: -12
ddb{1}> 

Crashes (544):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/01 07:35 openbsd 487cc9e9a631 25a0ae84 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/28 13:03 openbsd 5ca80efe399f 858db2ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/20 18:14 openbsd d3f7195f4849 21286ae2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/20 07:55 openbsd d3f7195f4849 21286ae2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/19 11:49 openbsd 10825b7eb358 440f8011 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/11 22:56 openbsd f3dc682c6638 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/08 23:21 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/08 04:54 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/05 12:39 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/03 15:43 openbsd 27f877102cce 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/10/02 07:45 openbsd 573c1bf7fd16 6d32eb1f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/22 23:25 openbsd d7f8428ad9ed 3e2106e5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/22 21:43 openbsd d7f8428ad9ed 3e2106e5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/19 17:57 openbsd f239e4190c56 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/19 15:30 openbsd f239e4190c56 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/18 23:21 openbsd c10aa57bf0a6 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/13 08:22 openbsd efac3ca090c3 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/05 16:15 openbsd 7f2ed87ffadf 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/27 23:31 openbsd bdb10d7135aa e2fa417d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/26 19:29 openbsd 9c51b1274871 a2b77b9e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/25 10:13 openbsd c0485cf4f019 614e416a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/23 05:23 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/23 01:44 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/20 20:07 openbsd 66ffe5599e58 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/16 09:44 openbsd 63d30f6f93ff 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/09 18:02 openbsd fab829404855 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/08 20:44 openbsd 3dc8f332bbde 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/05 07:25 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/07/30 07:35 openbsd cc5b7dd097c6 2377cd3d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/07/24 15:26 openbsd 969775618695 dd737a83 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/07/16 23:51 openbsd 5f0b8e1b9eb7 6ca2b51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/07/02 08:47 openbsd 30d0e3967450 27192279 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/30 00:07 openbsd 13c7226bf352 fff8d0a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/29 02:01 openbsd a0c937b71e27 fb92f11c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/27 08:19 openbsd 309f6120392c fb92f11c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/19 12:18 openbsd e607e174aea6 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/18 23:46 openbsd aad3118e28ac 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/18 02:10 openbsd 135881df8fe2 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/14 17:35 openbsd 459bfe6c89ff 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/09 09:14 openbsd 6f935c329363 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/08 18:32 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/08 12:34 openbsd 1175e773e1a3 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/07 20:37 openbsd 55e221da9e96 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/06 12:36 openbsd f12de7fa2924 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/06/05 18:44 openbsd ce89dc54e9c4 48b6c3fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main assert "map->limit == rtmap_limit" failed in rtable.c
2025/02/06 18:08 openbsd 4a7e1005694f 1e1faf27 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "map->limit == rtmap_limit" failed in rtable.c
2026/09/08 02:38 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 06706d23b01e 680aa3e1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan assert "map->limit == rtmap_limit" failed in rtable.c
2026/08/31 21:57 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan aafb676041ac 00e9c810 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan assert "map->limit == rtmap_limit" failed in rtable.c
* Struck through repros no longer work on HEAD.