uvm_fault: malloc

Status: upstream: reported on 2026/09/09 10:19
Reported-by: syzbot+cd5a8bd69b35748e112c@syzkaller.appspotmail.com
First crash: 26d, last: 1d14h

Sample crash report:
uvm_fault(0xffffffff839f8cd0, 0xffffb0d3e296f12d, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      malloc+0x855:   movq    0x8(%rbx),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*143614  35219      0      0x2002          0    1K ifconfig
 144326  99910      0           0          0    0  syz-executor
malloc(6,29,1) at malloc+0x855 sys/kern/kern_malloc.c:294
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c unvname_new sys/kern/kern_unveil.c:78 [inline]
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c sys/kern/kern_unveil.c:118
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f unveil_add_name sys/kern/kern_unveil.c:135 [inline]
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f sys/kern/kern_unveil.c:495
sys_unveil(ffff80003c3e0fb8,ffff80003c439420,ffff80003c439370) at sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
syscall(ffff80003c439420) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c439420) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73d853f73e50, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xffffffff839f8cd0, 0xffffb0d3e296f12d, 0, 1) -> e
ddb{1}> show kasan
No such command
ddb{1}> trace
malloc(6,29,1) at malloc+0x855 sys/kern/kern_malloc.c:294
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c unvname_new sys/kern/kern_unveil.c:78 [inline]
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c sys/kern/kern_unveil.c:118
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f unveil_add_name sys/kern/kern_unveil.c:135 [inline]
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f sys/kern/kern_unveil.c:495
sys_unveil(ffff80003c3e0fb8,ffff80003c439420,ffff80003c439370) at sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
syscall(ffff80003c439420) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c439420) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73d853f73e50, count: -6
ddb{1}> show registers
rdi               0x945ab0d3e296275d
rsi               0x6ba500000000d678
rbp               0xffff80003c4390f0
rbx               0xffffb0d3e296f125
rdx                                0
rcx               0xffff80003c3e0fb8
rax               0xffff80002999dff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xdc5f5fd31985b292
r11                0xa2227d36999e443
r12               0x6ba500000000d678
r13               0xffffffff83a4d170    kmemstats+0xa40
r14                        0xa30c333    __kernel_phys_end+0x670c333
r15               0x945ab0d3e296275d
rip               0xffffffff817a24c5    malloc+0x855
cs                               0x8
rflags                       0x10282    __ALIGN_SIZE+0xf282
rsp               0xffff80003c439030
ss                              0x10
malloc+0x855:   movq    0x8(%rbx),%r14
ddb{1}> show proc
PROC (ifconfig) tid=143614 pid=35219 tcnt=1 stat=onproc
    flags process=2002<EXEC,SINGLEUNWIND> proc=0
    runpri=69, usrpri=69, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80003c3e0fb8 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c3e02c0,0xffffffff83afa000
    process=0xffff800045fec018 user=0xffff80003c434000, vmspace=0xfffffb806cebb3e8
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
*35219  143614  76704     0  7      0x2002          0           ifconfig
 56406   84423  11107     0  2           0          0           syz-executor
 56406  236041  11107     0  2           0  0x4000000           syz-executor
 56406  136226  11107     0  2           0  0x4000000           syz-executor
 76704  215830  24811     0  3    0x100002       0x88 sigsusp   sh
 33705  351944  91026     0  2           0          0           syz-executor
 33705  185214  91026     0  3           0  0x4000080 fsleep    syz-executor
 33705  332788  91026     0  2           0  0x4000000           syz-executor
 46892   53948  31336     0  3           0       0x80 nanoslp   syz-executor
 46892  350251  31336     0  3           0  0x4000080 lockf     syz-executor
 46892  279784  31336     0  3           0  0x4000080 fsleep    syz-executor
 46892  148218  31336     0  3           0  0x4000080 fsleep    syz-executor
 85541  476867  53579     0  2           0          0           syz-executor
 85541  411798  53579     0  3           0  0x4000080 fsleep    syz-executor
 99910  144326  30207     0  7           0          0           syz-executor
 99910  394955  30207     0  2           0  0x4000080           syz-executor
 44888  260479  24092     0  2           0          0           syz-executor
 44888   44349  24092     0  3           0  0x4000080 fifor     syz-executor
 44888  150680  24092     0  3           0  0x4000080 fifor     syz-executor
 44888  380423  24092     0  2           0  0x4000000           syz-executor
 53583  185624  57252     0  2           0          0           syz-executor
 53583  473592  57252     0  3           0  0x4000080 ttyout    syz-executor
 53583  306002  57252     0  3           0  0x4000080 fsleep    syz-executor
 24811  415583  49122     0  3         0x2       0x80 wait      syz-executor
 31336  386755  49122     0  3         0x2       0x80 nanoslp   syz-executor
 24092  513865  49122     0  3         0x2       0x80 nanoslp   syz-executor
 91026  223175  49122     0  3         0x2       0x80 nanoslp   syz-executor
 11107  279698  49122     0  3         0x2       0x80 nanoslp   syz-executor
 57252  150434  49122     0  3         0x2       0x80 nanoslp   syz-executor
 30207  280554  49122     0  3         0x2       0x80 nanoslp   syz-executor
 53579  326012  49122     0  3         0x2       0x80 nanoslp   syz-executor
 49122  495161  40759     0  3         0x2       0x80 kqread    syz-executor
 40759  239401  34034     0  3    0x100002       0x88 sigsusp   ksh
 34034  297479  16213     0  3        0x10       0x88 kqread    sshd-session
 16213  495707  86633     0  3        0x12       0x80 kqread    sshd-session
 40389  223478      1     0  3    0x100003       0x80 ttyin     getty
 86633  196703      1     0  3           0       0x88 kqread    sshd
 31737  443968  31893    74  3   0x1100012       0x80 bpf       pflogd
 31893  418643      1     0  3           0       0x80 sbwait    pflogd
  8356  203886  56912    73  3   0x1100010       0x80 kqread    syslogd
 56912  442687      1     0  3    0x100002       0x80 sbwait    syslogd
 89782  217040      1     0  3    0x100000       0x80 kqread    resolvd
 74592  415739  28314    77  3    0x100012       0x80 kqread    dhcpleased
  2877   73083  28314    77  3    0x100012       0x80 kqread    dhcpleased
 28314  362780      1     0  3           0       0x80 kqread    dhcpleased
 61972  220599      0     0  3     0x14000      0x200 bored     smr
 85403  517731      0     0  2     0x14000      0x200           zerothread
 28040  495577      0     0  3     0x14000      0x200 aiodoned  aiodoned
 69607   25150      0     0  3     0x14000      0x200 syncer    update
 40302  262549      0     0  3     0x14000      0x200 cleaner   cleaner
 27628  515711      0     0  3     0x14000      0x200 reaper    reaper
 36864  154395      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 25316   96639      0     0  3     0x14000      0x200 bored     viomb
 90220  426034      0     0  3     0x14000 0x40000200 acpi0     acpi0
 43293  341126      0     0  3     0x14000 0x40000200           idle1
  4098    4312      0     0  3     0x14000      0x200 bored     softnet1
 25104  162539      0     0  3     0x14000      0x200 bored     softnet0
 81590  501581      0     0  3     0x14000      0x200 bored     systqmp
 70565  471713      0     0  3     0x14000      0x200 bored     systq
 59591  240747      0     0  3     0x14000      0x200 tmoslp    softclockmp
 26270  340405      0     0  3     0x14000 0x40000200 tmoslp    softclock
 61957  472330      0     0  3     0x14000 0x40000200           idle0
     1  496452      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff839337a8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  malloc+0x2ef sys/kern/kern_malloc.c:200
#3  unveil_add_name_unlocked+0x8c unvname_new sys/kern/kern_unveil.c:78 [inline]
#3  unveil_add_name_unlocked+0x8c sys/kern/kern_unveil.c:118
#4  unveil_add+0x43f unveil_add_name sys/kern/kern_unveil.c:135 [inline]
#4  unveil_add+0x43f sys/kern/kern_unveil.c:495
#5  sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
#6  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
Process 35219 (ifconfig) thread 0xffff80003c3e0fb8 (143614)
exclusive rwlock unveil r = 0 (0xffff80000164c030)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  unveil_add+0x427 unveil_add_name sys/kern/kern_unveil.c:135 [inline]
#2  unveil_add+0x427 sys/kern/kern_unveil.c:495
#3  sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
#4  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#5  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b1d300)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:791
#2  Xsyscall+0x128
exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff839337a8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  malloc+0x2ef sys/kern/kern_malloc.c:200
#3  unveil_add_name_unlocked+0x8c unvname_new sys/kern/kern_unveil.c:78 [inline]
#3  unveil_add_name_unlocked+0x8c sys/kern/kern_unveil.c:118
#4  unveil_add+0x43f unveil_add_name sys/kern/kern_unveil.c:135 [inline]
#4  unveil_add+0x43f sys/kern/kern_unveil.c:495
#5  sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
#6  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11058  12095K   12168K 166960K     12202        0
            pcb    17     12K      12K 166960K        28        0
         rtable   225      6K       7K 166960K       399        0
             pf    35     17K      21K 166960K        59        0
         ifaddr    41      7K       7K 166960K        56        0
        ifgroup    55      2K       2K 166960K        70        0
         sysctl     3      1K       9K 166960K         8        0
       counters    70     37K      37K 166960K        80        0
       ioctlops     0      0K       4K 166960K      1494        0
            iov     0      0K       2K 166960K         5        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1294     81K      81K 166960K      1415        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K       5K 166960K         4        0
         VM map     2      1K       1K 166960K         2        0
            sem     2      0K       0K 166960K         2        0
        dirhash    12      2K       2K 166960K        18        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    19     69K      93K 166960K       214        0
          sigio     0      0K       0K 166960K         1        0
           proc    76    131K     180K 166960K       616        0
        subproc    72      4K       4K 166960K        90        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         2        0
       in_multi    89      6K       6K 166960K       114        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     0      0K       0K 166960K         5        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    55    254K     254K 166960K        55        0
           exec     0      0K       1K 166960K       409        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   240    168K     176K 166960K      3730        0
       UVM aobj     7      2K       2K 166960K         7        0
     pinsyscall    44     88K     102K 166960K      1417        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         1        0
            NDP    12      0K       2K 166960K        34        0
           temp    34   9118K    9138K 166960K      3905        0
         kqueue    13     20K      24K 166960K        35        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       37    0       34     1     0     1     1     0     8    0
rtentry    176      128    0       25     6     0     6     6     0     8    0
unpcb      144       56    0       37     1     0     1     1     0     8    0
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      736       20    0       15     1     0     1     1     0     8    0
arp        136       22    0        4     1     0     1     1     0     8    0
inpcb      328      111    0      100     1     0     1     1     0     8    0
nd6        152       27    0        6     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     0     1     1     0     8    1
kcovpl      48       10    0        2     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     0     1     1     0     8    1
ppxss      1192       2    0        2     1     0     1     1     0     8    1
pppxif     1576       1    0        1     1     0     1     1     0     8    1
pfstscr     40        1    0        0     1     0     1     1     0     8    0
pffrent     40        1    0        1     1     0     1     1     0     8    1
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       33    0        0     1     0     1     1     0     8    0
pfstkey    128       33    0        0     2     0     2     2     0     8    0
pfstate    448       32    0        0     4     0     4     4     0     8    0
pfrule     1360      23    0       18     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      537    0      124    32     0    32    32     0     8    2
art_table   40      538    0      124     6     0     6     6     0     8    0
art_node    32      128    0       34     1     0     1     1     0     8    0
shmpl      120        4    0        0     1     0     1     1     0     8    0
dirhash    1024      21    0        4     3     0     3     3     0     8    0
dino2pl    256     1658    0      184    93     0    93    93     0     8    0
ffsino     296     1658    0      184   114     0   114   114     0     8    0
nchpl      144     1905    0      197    64     0    64    64     0     8    0
vnodes     216     1786    0        0   100     0   100   100     0     8    0
namei      1024    6871    0     6869     4     1     3     3     0     8    2
percpumem   16       56    0        5     1     0     1     1     0     8    0
kstatmem   264       35    0        8     2     0     2     2     0     8    0
scxspl     216     6532    0     6532     4     3     1     3     1     8    1
plimitpl   152       38    0       21     1     0     1     1     0     8    0
sigapl     424      527    0      478     7     0     7     7     0     8    1
knotepl    120       60    0        0     2     0     2     2     0     8    0
kqueuepl   224       34    0       25     1     0     1     1     0     8    0
pipepl     344      139    0      111     3     0     3     3     0     8    0
fdescpl    528      511    0      478     3     0     3     3     0     8    0
filepl     160     1980    0     1759    10     0    10    10     0     8    0
lockfpl    104       96    0       92     1     0     1     1     0     8    0
lockfspl    48       16    0       13     1     0     1     1     0     8    0
sessionpl  144       26    0       17     1     0     1     1     0     8    0
pgrppl      48       38    0       21     1     0     1     1     0     8    0
ucredpl    104      142    0      129     1     0     1     1     0     8    0
zombiepl   144      478    0      478     1     0     1     1     0     8    1
processpl  1240     527    0      478     5     0     5     5     0     8    1
procpl     664      618    0      555     6     0     6     6     0     8    0
sosppl     176        1    0        1     1     0     1     1     0     8    1
sockpl     752      206    0      173     4     0     4     4     0     8    0
mcl64k     65536      4    0        0     1     0     1     1     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     118    0        0    15     0    15    15     0     8    0
mcl2k      2048      15    0        0     2     0     2     2     0     8    0
mextrefs    64        9    0        0     1     0     1     1     0     8    0
mtagpl      96        4    0        0     1     0     1     1     0     8    0
mbufpl     256      165    0        0    11     0    11    11     0     8    0
bufpl      272     2369    0      106   151     0   151   151     0     8    0
anonpl      32     4973    0        0    41     0    41    41     0   247    0
amapchunkpl 152   10524    0    10016    26     0    26    26     0   158    6
amappl16   200     1977    0     1955     5     1     4     5     0     8    2
amappl15   192        8    0        8     1     1     0     1     0     8    0
amappl14   184      456    0      454     1     0     1     1     0     8    0
amappl13   176      125    0      112     1     0     1     1     0     8    0
amappl12   168      768    0      737     2     0     2     2     0     8    0
amappl11   160        7    0        7     1     1     0     1     0     8    0
amappl10   152       61    0       47     1     0     1     1     0     8    0
amappl9    144      278    0      278     1     1     0     1     0     8    0
amappl8    136      143    0      140     1     0     1     1     0     8    0
amappl7    128      150    0      137     1     0     1     1     0     8    0
amappl6    120      175    0      172     1     0     1     1     0     8    0
amappl5    112      112    0      102     1     0     1     1     0     8    0
amappl4    104      296    0      276     1     0     1     1     0     8    0
amappl3     96     1799    0     1697     3     0     3     3     0     8    0
amappl2     88      623    0      548     2     0     2     2     0     8    0
amappl1     80    10912    0    10300    14     0    14    14     0     8    1
amappl      88     2969    0     2802     4     0     4     4     0    92    0
uvmvnodes   80      102    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        6    0        0     1     0     1     1     0     8    0
uaddrrnd    24      511    0      478     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      511    0      478     1     0     1     1     0     8    0
vmmpekpl   168     6208    0     6163     3     0     3     3     0     8    0
vmmpepl    168    42483    0    40536    86     0    86    86     0   357    0
vmsppl     488      510    0      478     5     0     5     5     0     8    0
rwobjpl     80    15612    0    14565    24     1    23    23     0     8    1
pdppl      4096    1029    0      956    95    22    73    85     0     8    0
pvpl        32    10947    0        0    90     1    89    89     0   265    0
pmappl     256      510    0      478     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      425    0       26    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff839afff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:159
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x7393db017700, count: 8
ddb{0}> trace
x86_ipi_db(ffffffff839afff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:159
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x7393db017700, count: -7
ddb{0}> machine ddbcpu 1
Stopped at      malloc+0x855:   movq    0x8(%rbx),%r14
malloc(6,29,1) at malloc+0x855 sys/kern/kern_malloc.c:294
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c unvname_new sys/kern/kern_unveil.c:78 [inline]
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c sys/kern/kern_unveil.c:118
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f unveil_add_name sys/kern/kern_unveil.c:135 [inline]
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f sys/kern/kern_unveil.c:495
sys_unveil(ffff80003c3e0fb8,ffff80003c439420,ffff80003c439370) at sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
syscall(ffff80003c439420) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c439420) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73d853f73e50, count: 9
ddb{1}> trace
malloc(6,29,1) at malloc+0x855 sys/kern/kern_malloc.c:294
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c unvname_new sys/kern/kern_unveil.c:78 [inline]
unveil_add_name_unlocked(ffff80000164c000,ffff80002a214805,11) at unveil_add_name_unlocked+0x8c sys/kern/kern_unveil.c:118
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f unveil_add_name sys/kern/kern_unveil.c:135 [inline]
unveil_add(ffff80003c3e0fb8,ffff80003c439238,ffff80003c4392f3) at unveil_add+0x43f sys/kern/kern_unveil.c:495
sys_unveil(ffff80003c3e0fb8,ffff80003c439420,ffff80003c439370) at sys_unveil+0x61c sys/kern/vfs_syscalls.c:1034
syscall(ffff80003c439420) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c439420) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x73d853f73e50, count: -6

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 16:35 openbsd dfaf7899c030 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: malloc
2026/10/04 06:34 openbsd 1e9f05948cfd 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: malloc
2026/09/27 22:24 openbsd 95b535d85a6b a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: malloc
2026/09/20 13:27 openbsd 26c67e98846d 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: malloc
2026/09/09 10:18 openbsd 9a9bc0a9ffee 8387c273 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: malloc
* Struck through repros no longer work on HEAD.