syzbot


KASAN: invalid memory access in doktrace

Status: upstream: reported on 2026/07/15 12:45
Reported-by: syzbot+ebaa42539df7a97a59b4@syzkaller.appspotmail.com
First crash: 20h43m, last: 20h43m

Sample crash report:
panic: Caught invalid memory access at ffff800045ff1890 size 8 op 0
Stopped at      db_enter+0x17:  popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 250677  16801      0           0          0    0  syz-executor
*467366  19180      0           0  0x4000000    1K syz-executor
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632b4f) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff ktrsetchildren sys/kern/kern_ktrace.c:602 [inline]
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff sys/kern/kern_ktrace.c:518
sys_ktrace(ffff800045ffca78,ffff80003bb862d0,ffff80003bb86240) at sys_ktrace+0x1f6 sys/kern/kern_ktrace.c:559
syscall(ffff80003bb862d0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb862d0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf88312a7260, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: Caught invalid memory access at ffff800045ff1890 size 8 op 0
ddb{1}> show kasan
KASAN: invalid read of 8 bytes at 0xffff800045ff1890 from pc 0xffffffff819ba03f
KASAN: first bad byte at 0xffff800045ff1890 (+0); shadow 0xfd: pool use-after-free (or unallocated item)
KASAN: 0xffff800045ff1890 is 96 bytes inside the 1232-byte item [0xffff800045ff1830..0xffff800045ff1d00) in pool 'processpl'
KASAN: allocated at:
#0  pool_get+0x770 sys/kern/subr_pool.c:733
#1  process_new+0x47 sys/kern/kern_fork.c:221
#2  fork1+0x533 sys/kern/kern_fork.c:408
#3  kthread_create+0xa8 sys/kern/kern_kthread.c:61
#4  sys_acct+0x35e acct_start sys/kern/kern_acct.c:300 [inline]
#4  sys_acct+0x35e sys/kern/kern_acct.c:151
#5  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
KASAN: freed at:
#0  pool_put+0x79 sys/kern/subr_pool.c:918
#1  process_zap+0x457 sys/kern/kern_exit.c:898
#2  reaper+0x3e6 sys/kern/kern_exit.c:525
#3  proc_trampoline+0x10
KASAN: pc: doktrace+0x9ff
KASAN: call trace:
#0  __asan_load8_noabort+0xbd kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
#0  __asan_load8_noabort+0xbd sys/kern/subr_kasan.c:1099
#1  doktrace+0x9ff ktrsetchildren sys/kern/kern_ktrace.c:602 [inline]
#1  doktrace+0x9ff sys/kern/kern_ktrace.c:518
#2  sys_ktrace+0x1f6 sys/kern/kern_ktrace.c:559
#3  syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#4  Xsyscall+0x128
KASAN: shadow of 0xffff800045ff1780..0xffff800045ff1a00 (1 cell = 8 bytes):
 0xffff800045ff1780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 0xffff800045ff1800: fd fd fd fd fd fd 08 08 fd fd fd fd fd fd fd fd
>0xffff800045ff1880: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
 0xffff800045ff1900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 0xffff800045ff1980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632b4f) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff ktrsetchildren sys/kern/kern_ktrace.c:602 [inline]
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff sys/kern/kern_ktrace.c:518
sys_ktrace(ffff800045ffca78,ffff80003bb862d0,ffff80003bb86240) at sys_ktrace+0x1f6 sys/kern/kern_ktrace.c:559
syscall(ffff80003bb862d0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb862d0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf88312a7260, count: -7
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003bb85cd0
rbx               0xffff80003bb85d40
rdx                                0
rcx               0xffff800028fe3ff0
rax               0xffff80000015cb00
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xffff80003bb85ab8
r11               0xffffffff8416f5d0    x86_bus_space_io_read_1
r12               0xffffffff84632b4f    .str.28+0x9b28f
r13               0xffff800028fe4c08
r14               0xffff800028fe4e07
r15                              0x1
rip               0xffffffff82a38477    db_enter+0x17
cs                               0x8
rflags                         0x246
rsp               0xffff80003bb85cd0
ss                              0x10
db_enter+0x17:  popq    %rbp
ddb{1}> show proc
PROC (syz-executor) tid=467366 pid=19180 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=17, usrpri=86, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800045ff5248,0xffff800045ff47f8
    process=0xffff800045ff09c0 user=0xffff80003bb7b000, vmspace=0xffff800001c45018
    estcpu=36, cpticks=22, pctcpu=0.0, user=1, sys=21, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 16801  250677  20077      0  7           0                syz-executor
 51124  109213  81759      0  2           0                syz-executor
 51124  441355  81759      0  3   0x4000080  fsleep        syz-executor
 43604  372995  23696      0  2           0                syz-executor
 43604  507363  23696      0  3   0x4000080  kqread        syz-executor
 43604   64197  23696      0  3   0x4000080  fsleep        syz-executor
 43604   36802  23696      0  3   0x4000080  fsleep        syz-executor
 63243  334104  10003      0  2           0                syz-executor
 63243  233890  10003      0  3   0x4000080  fsleep        syz-executor
 92615   58623  24817      0  2           0                syz-executor
 92615   47178  24817      0  3   0x4000080  fsleep        syz-executor
 18125  436332  83422      0  2           0                syz-executor
 18125  171357  83422      0  2   0x4000000                syz-executor
 19180  170435  35247      0  2           0                syz-executor
*19180  467366  35247      0  7   0x4000000                syz-executor
 19180  352268  35247      0  3   0x4000080  fsleep        syz-executor
 97963   95515  36401      0  2     0x82000                syz-executor
 97963  456333  36401      0  3   0x4002000  suspend       syz-executor
 24817  384273  49210      0  3        0x82  nanoslp       syz-executor
 36401  508411  49210      0  3        0x82  nanoslp       syz-executor
 81759  341247  49210      0  3        0x82  nanoslp       syz-executor
 10003  299985  49210      0  3        0x82  nanoslp       syz-executor
 35247  284380  49210      0  3        0x82  nanoslp       syz-executor
 83422  185596  49210      0  3        0x82  nanoslp       syz-executor
 20077  342533  49210      0  3        0x82  nanoslp       syz-executor
 23696  344988  49210      0  3        0x82  nanoslp       syz-executor
 49210  206838  33930      0  3        0x82  kqread        syz-executor
 33930  306008  90938      0  3    0x10008a  sigsusp       ksh
 90938  322547  85234      0  3        0x98  kqread        sshd-session
 85234  194933  25327      0  3        0x92  kqread        sshd-session
  9047  482397      1      0  3    0x100083  ttyin         getty
 25327   43187      1      0  3        0x88  kqread        sshd
 16980  205411  34135     74  3   0x1100092  bpf           pflogd
 34135  212732      1      0  3        0x80  sbwait        pflogd
 62390  195220  39493     73  3   0x1100090  kqread        syslogd
 39493  451317      1      0  3    0x100082  sbwait        syslogd
 33018  513846      1      0  3    0x100080  kqread        resolvd
 82115  271981  50104     77  3    0x100092  kqread        dhcpleased
 22064   57387  50104     77  3    0x100092  kqread        dhcpleased
 50104  253364      1      0  3        0x80  kqread        dhcpleased
 44104  240036      0      0  3     0x14200  bored         smr
 66407  241123      0      0  2     0x14200                zerothread
 82500  262331      0      0  3     0x14200  aiodoned      aiodoned
 13097  417030      0      0  3     0x14200  syncer        update
  9293  381704      0      0  3     0x14200  cleaner       cleaner
 84932  127642      0      0  3     0x14200  reaper        reaper
 61323  163687      0      0  3     0x14200  pgdaemon      pagedaemon
 53154  206343      0      0  3     0x14200  bored         viomb
 69525  119751      0      0  3  0x40014200  acpi0         acpi0
 26424  193184      0      0  3  0x40014200                idle1
 62912  191502      0      0  3     0x14200  bored         softnet1
 40970  369972      0      0  3     0x14200  bored         softnet0
 29400  480221      0      0  3     0x14200  bored         systqmp
 19531  454362      0      0  3     0x14200  bored         systq
 74066  203402      0      0  3     0x14200  tmoslp        softclockmp
 11226  185810      0      0  3  0x40014200  tmoslp        softclock
 67183  273061      0      0  3  0x40014200                idle0
     1  457268      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 19180 (syz-executor) thread 0xffff800045ffca78 (467366)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8542a300)
#0  witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x632 sys/kern/subr_witness.c:1160
#1  __mp_acquire_count+0x48 sys/kern/kern_lock.c:-1
#2  sleep_finish+0x423 sys/kern/kern_synch.c:369
#3  biowait+0xe6 sys/kern/vfs_bio.c:1110
#4  bwrite+0x4e1 sys/kern/vfs_bio.c:625
#5  ffs_update+0x619 sys/ufs/ffs/ffs_inode.c:111
#6  ffs_truncate+0x12f0 sys/ufs/ffs/ffs_inode.c:-1
#7  ufs_inactive+0x2cb sys/ufs/ufs/ufs_inode.c:84
#8  VOP_INACTIVE+0x1bb sys/kern/vfs_vops.c:498
#9  vrele+0x16a sys/kern/vfs_subr.c:845
#10 ktrsettrace+0x16c sys/kern/kern_ktrace.c:122
#11 ktrops+0x338 sys/kern/kern_ktrace.c:574
#12 doktrace+0x9e8 ktrsetchildren sys/kern/kern_ktrace.c:596 [inline]
#12 doktrace+0x9e8 sys/kern/kern_ktrace.c:518
#13 sys_ktrace+0x1f6 sys/kern/kern_ktrace.c:559
#14 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
#15 Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11064  12324K   12324K 166960K     12190        0
            pcb    17     28K      33K 166960K       105        0
         rtable   239     12K      13K 166960K       353        0
             pf    34     22K      24K 166960K        47        0
         ifaddr    43     12K      12K 166960K        45        0
        ifgroup    55      2K       2K 166960K        55        0
         sysctl     1      1K      13K 166960K         5        0
       counters    70     42K      42K 166960K        70        0
       ioctlops     0      0K       4K 166960K      1526        0
            iov     0      0K      20K 166960K        10        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1361     87K      87K 166960K      1483        0
      UFS quota     1     36K      36K 166960K         1        0
      UFS mount     5     44K      44K 166960K         5        0
            shm     2      2K      10K 166960K         9        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        13        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     292K 166960K     11964        0
      file desc    18     65K      93K 166960K       217        0
           proc    74    145K     177K 166960K       573        0
        subproc    72      9K       9K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     20K      20K 166960K         1        0
       in_multi    99      7K       7K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         3        0
    ISOFS mount     1     36K      36K 166960K         1        0
  MSDOSFS mount     1     20K      20K 166960K         1        0
           ttys    49    344K     344K 166960K        49        0
           exec     0      0K       2K 166960K       387        0
   fusefs mount     1     36K      36K 166960K         1        0
            tdb     3      1K       1K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   239    245K     262K 166960K      3828        0
       UVM aobj    12      4K       4K 166960K        12        0
     pinsyscall  1067   1752K    1752K 166960K      1376        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    12      0K       2K 166960K        28        0
           temp    76   9172K    9185K 166960K      4711        0
         kqueue    14     44K      48K 166960K        42        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       34    0       31     1     0     1     1     0     8    0
rtentry    176      112    0        1     6     0     6     6     0     8    0
unpcb      144      106    0       86     2     0     2     2     0     8    1
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      736       54    0       48     4     0     4     4     0     8    3
arp        136       19    0        0     1     0     1     1     0     8    0
inpcb      328      197    0      187     7     0     7     7     0     8    6
nd6        152       24    0        0     1     0     1     1     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        1    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1428     5     0     5     5     0     8    5
pfosfpen   112     1428    0     1428    21     0    21    21     0     8   21
pfstitem    24       26    0        0     1     0     1     1     0     8    0
pfstkey    128       26    0        0     1     0     1     1     0     8    0
pfstate    448       26    0        0     3     0     3     3     0     8    0
pfrule     1360      22    0       17     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      452    0        0    29     0    29    29     0     8    0
art_table   40      453    0        0     5     0     5     5     0     8    0
art_node    32      112    0       11     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        1     1     0     1     1     0     8    1
semapl      72       11    0        1     1     0     1     1     0     8    0
shmpl      112        9    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1708    0      234    93     0    93    93     0     8    0
ffsino     296     1708    0      234   114     0   114   114     0     8    0
nchpl      144     2012    0      306    64     0    64    64     0     8    0
vnodes     216     1897    0        0   106     0   106   106     0     8    0
namei      1024    6715    0     6715     2     0     2     2     0     8    2
percpumem   16       51    0        0     1     0     1     1     0     8    0
kstatmem   264       27    0        0     2     0     2     2     0     8    0
scxspl     216     7239    0     7239     2     1     1     2     1     8    1
plimitpl   152       33    0       16     1     0     1     1     0     8    0
sigapl     424      536    0      488     7     0     7     7     0     8    1
knotepl    120       62    0        0     2     0     2     2     0     8    0
kqueuepl   224       54    0       44     1     0     1     1     0     8    0
pipepl     344      140    0      112     3     0     3     3     0     8    0
fdescpl    528      519    0      487     3     0     3     3     0     8    0
filepl     160     2352    0     2062    13     0    13    13     0     8    0
lockfpl    104       38    0       34     1     0     1     1     0     8    0
lockfspl    48       19    0       15     1     0     1     1     0     8    0
sessionpl  144       27    0       18     1     0     1     1     0     8    0
pgrppl      48       35    0       18     1     0     1     1     0     8    0
ucredpl    104      166    0      153     1     0     1     1     0     8    0
zombiepl   144      488    0      488     1     0     1     1     0     8    1
processpl  1232     536    0      488     5     0     5     5     0     8    0
procpl     664      675    0      617     6     0     6     6     0     8    0
sockpl     752      340    0      307    12     0    12    12     0     8    8
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k      2048      18    0        0     3     0     3     3     0     8    0
mextrefs    64       17    0        0     1     0     1     1     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      241    0        0    15     0    15    15     0     8    0
bufpl      272     2513    0      138   159     0   159   159     0     8    0
anonpl      32     5309    0        0    43     0    43    43     0   222    0
amapchunkpl 152   10965    0    10468    23     0    23    23     0   158    2
amappl16   200     2070    0     2039     5     3     2     5     0     8    0
amappl15   192      102    0      102     1     1     0     1     0     8    0
amappl14   184      434    0      432     1     0     1     1     0     8    0
amappl13   176      138    0      126     1     0     1     1     0     8    0
amappl12   168      803    0      772     2     0     2     2     0     8    0
amappl11   160        9    0        9     2     1     1     1     0     8    1
amappl10   152       66    0       52     1     0     1     1     0     8    0
amappl9    144      273    0      273     1     1     0     1     0     8    0
amappl8    136       96    0       94     1     0     1     1     0     8    0
amappl7    128      152    0      139     1     0     1     1     0     8    0
amappl6    120      154    0      153     1     0     1     1     0     8    0
amappl5    112      109    0       97     1     0     1     1     0     8    0
amappl4    104      298    0      277     1     0     1     1     0     8    0
amappl3     96     1982    0     1863     4     0     4     4     0     8    0
amappl2     88      545    0      481     2     0     2     2     0     8    0
amappl1     80    10774    0    10172    16     1    15    15     0     8    2
amappl      88     3088    0     2922     4     0     4     4     0    92    0
uvmvnodes   80      101    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       11    0        0     1     0     1     1     0     8    0
uaddrrnd    24      519    0      487     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      519    0      487     1     0     1     1     0     8    0
vmmpekpl   168     6303    0     6272     2     0     2     2     0     8    0
vmmpepl    168    42635    0    40678    87     0    87    87     0   357    0
vmsppl     488      518    0      487     5     0     5     5     0     8    1
rwobjpl     80    15709    0    14658    24     0    24    24     0     8    1
pdppl      4096    1047    0      974   101    28    73    87     0     8    0
pvpl        32    11203    0        0    92     1    91    91     0   265    0
pmappl     256      518    0      487     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     120      440    0       31    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x19:        leave
x86_ipi_db(ffffffff8521aff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85429b00) at __mp_lock+0x283 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85429b00) at __mp_lock+0x283 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load4_noabort(ffffffff8542a2f8) at __asan_load4_noabort+0x9 sys/kern/subr_kasan.c:1098
__mp_lock(ffffffff85429b00) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85429b00) at __mp_lock+0x27a sys/kern/kern_lock.c:173
syscall(ffff80003bb6df70) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff80003bb6df70) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ed200b70f40, count: 4
ddb{0}> trace
x86_ipi_db(ffffffff8521aff0) at x86_ipi_db+0x19 sys/arch/amd64/amd64/db_interface.c:412
x86_ipi_handler() at x86_ipi_handler+0x112 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff85429b00) at __mp_lock+0x283 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85429b00) at __mp_lock+0x283 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x215 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x7b sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__asan_load4_noabort(ffffffff8542a2f8) at __asan_load4_noabort+0x9 sys/kern/subr_kasan.c:1098
__mp_lock(ffffffff85429b00) at __mp_lock+0x27a __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff85429b00) at __mp_lock+0x27a sys/kern/kern_lock.c:173
syscall(ffff80003bb6df70) at syscall+0x1048 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff80003bb6df70) at syscall+0x1048 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7ed200b70f40, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x17:  popq    %rbp
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632b4f) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff ktrsetchildren sys/kern/kern_ktrace.c:602 [inline]
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff sys/kern/kern_ktrace.c:518
sys_ktrace(ffff800045ffca78,ffff80003bb862d0,ffff80003bb86240) at sys_ktrace+0x1f6 sys/kern/kern_ktrace.c:559
syscall(ffff80003bb862d0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb862d0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf88312a7260, count: 8
ddb{1}> trace
db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457
panic(ffffffff84632b4f) at panic+0x270 sys/kern/subr_prf.c:198
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde kasan_shadow_check sys/kern/subr_kasan.c:-1 [inline]
__asan_load8_noabort(ffff800045ff1890) at __asan_load8_noabort+0xde sys/kern/subr_kasan.c:1099
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff ktrsetchildren sys/kern/kern_ktrace.c:602 [inline]
doktrace(ffff800001c7a968,4,814,0,ffff800045ffca78) at doktrace+0x9ff sys/kern/kern_ktrace.c:518
sys_ktrace(ffff800045ffca78,ffff80003bb862d0,ffff80003bb86240) at sys_ktrace+0x1f6 sys/kern/kern_ktrace.c:559
syscall(ffff80003bb862d0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003bb862d0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf88312a7260, count: -7

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/15 12:44 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 105dba7a2dcb a4ed0f4f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan KASAN: invalid memory access in doktrace
* Struck through repros no longer work on HEAD.