panic: free: size too large NUM > NUM (ADDR) type rtable

Status: upstream: reported on 2026/07/15 15:02
Reported-by: syzbot+064084701f73ec75ad93@syzkaller.appspotmail.com
First crash: 81d, last: 1d03h

Sample crash report:
panic: free: size too large 153 > 16 (0xffff800000c40ce0) type rtable
Starting stack trace...
panic(ffffffff835040b8) at panic+0x1d0 sys/kern/subr_prf.c:229
free(ffff800000c40ce0,5,99) at free+0x690 sys/kern/kern_malloc.c:387
rtfree(fffffb006cdb7e78) at rtfree+0x367 sys/net/route.c:646
rt_ifa_dellocal(ffff80000002c400) at rt_ifa_dellocal+0x211 sys/net/route.c:1452
in_purgeaddr(ffff80000002c400) at in_purgeaddr+0x1c5 sys/netinet/in.c:754
in_ifdetach(ffff80000160d800) at in_ifdetach+0x7e sys/netinet/in.c:1015
if_detach(ffff80000160d800) at if_detach+0x2fe sys/net/if.c:1311
tun_clone_destroy(ffff80000160d800) at tun_clone_destroy+0x2ce sys/net/if_tun.c:343
if_clone_destroy(ffff80002a362650) at if_clone_destroy+0x205 sys/net/if.c:1479
tun_dev_close(5d06,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80002a362710) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffb006e143108,7,fffffb00097fd478,ffff80002a221770) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffb006cdcd5e0,ffff80002a221770) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffb006cdcd5e0,ffff80002a221770) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffffb006cdcd5e0,ffff80002a221770) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffb006cdcd5e0,ffff80002a221770) at closef+0x192 sys/kern/kern_descrip.c:1265
fdfree(ffff80002a221770) at fdfree+0x116 sys/kern/kern_descrip.c:1196
exit1(ffff80002a221770,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002a221770,ffff80002a362a80,ffff80002a3629d0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002a362a80) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a362a80) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78980b701820, count: 237
End of stack trace.

Crashes (56):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 10:08 openbsd 1e9f05948cfd 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/10/04 08:38 openbsd 1e9f05948cfd 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/10/02 11:03 openbsd 3ce1f3f79392 b2bd33ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/10/01 13:31 openbsd 6318c367a341 52471257 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/30 20:31 openbsd 4deb6a849f76 38f7f0d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/29 08:25 openbsd 0049b4ffbd56 7bf4ea23 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/28 01:00 openbsd 95b535d85a6b a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/27 10:31 openbsd 859e3e974994 a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/26 17:53 openbsd 3d80b15b1ec6 a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/23 06:55 openbsd 6c60011d0c8d abce1216 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/21 04:58 openbsd d42776463e37 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/19 14:26 openbsd a0c91716cd0c 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/18 14:48 openbsd c10aa57bf0a6 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/16 01:25 openbsd bc65308b1c9e 12a0a44a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/15 10:51 openbsd 811da3150254 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/15 02:48 openbsd 811da3150254 81a27d1a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/14 07:18 openbsd 4aaeb84e3a06 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/14 06:18 openbsd 4aaeb84e3a06 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/14 05:53 openbsd 4aaeb84e3a06 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/13 10:09 openbsd efac3ca090c3 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/12 20:54 openbsd ed62f65fdb3a 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/10 11:39 openbsd 7de61c62cdcf 4e8b1cc6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/08 01:17 openbsd 37bc4758b7e7 680aa3e1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/06 21:48 openbsd 2a9cffaa8bc0 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/05 21:44 openbsd 7f2ed87ffadf 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/05 09:48 openbsd a37481e85163 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/04 06:52 openbsd 702f41303f5f 801f0966 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/04 04:56 openbsd 702f41303f5f 801f0966 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/03 07:36 openbsd 3eb032007ac4 6a988719 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/02 23:54 openbsd 3eb032007ac4 6a988719 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/09/02 17:56 openbsd 91392fcbf029 74e93e68 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/31 05:27 openbsd 1bd36cd9ba5c 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/30 19:30 openbsd a0938fbae2a0 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/29 11:12 openbsd e885dbe04d18 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/29 06:37 openbsd e885dbe04d18 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/29 05:02 openbsd e885dbe04d18 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/28 22:26 openbsd 8fb22f705ce6 41d151d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/24 14:47 openbsd 38355159c0bf b55bd4c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/22 17:39 openbsd 94b8f25de2d2 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/22 15:54 openbsd 94b8f25de2d2 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/22 02:28 openbsd d8ab52b87c98 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/19 04:28 openbsd aeb4a173c2e6 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/19 00:22 openbsd aeb4a173c2e6 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/17 04:35 openbsd 3b8d610e537f 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/12 19:59 openbsd 2610791609b5 ee03bfea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/11 23:18 openbsd a47f863e5cb3 f8d35649 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/08 04:50 openbsd d607cd596f17 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/03 13:03 openbsd 8bdaccf9d694 6b7c9f71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/02 14:17 openbsd f8480ad0276a e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/08/01 07:37 openbsd ec875f0e6c74 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/07/25 22:13 openbsd d6cf5170b77f 492bab15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: free: size too large NUM > NUM (ADDR) type rtable
2026/07/22 06:01 openbsd e524649e2c66 b561ce9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/07/20 22:31 openbsd d55fd7dd01df de6a700d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/07/18 05:25 openbsd 97f4e10dc0be 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
2026/07/15 19:52 openbsd af68cf7bb0f1 a4ed0f4f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid panic: free: size too large NUM > NUM (ADDR) type rtable
2026/07/15 15:01 openbsd af68cf7bb0f1 a4ed0f4f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: free: size too large NUM > NUM (ADDR) type rtable
* Struck through repros no longer work on HEAD.