witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 106d, last: 4h45m
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 syz, C 2 1598d 1598d 3/4 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1578d 1590d 3/4 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 syz, C 19 1610d 1662d 3/4 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff839b4438 pf_lock (pf_lock)
 2nd 0xffffffff83997510 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x13ff sys/net/pf_ioctl.c:3241
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3059 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3097
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x1853 sys/dev/pv/if_vio.c:935
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x52c sys/dev/pci/virtio_pci.c:675
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x8e5 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x381 sys/arch/amd64/pci/acpipci.c:257
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:265
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff83997510,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff839974f8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffff6006cce57e0,ffff800037fde378,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(fffff6006cce57e0,1000,ffff800037fde448,ffff800037fde42c,0,1,b11882a69f787563,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff800037fde660,ffff800037fde698,ffff800037fde4e0,ffff800037fde4c8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff800037fde660,ffff800037fde698,ffff800037fde5e0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffff6006c9853f0,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff800037fde810,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff800037fde810) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(14900,c4504441,ffff800001615000,1,ffff80003c3b8020) at pfioctl+0x13ff sys/net/pf_ioctl.c:3241
VOP_IOCTL(fffff6000dcab288,c4504441,ffff800001615000,1,fffff600097fd7b8,ffff80003c3b8020) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff6006cc52cc8,c4504441,ffff800001615000,ffff80003c3b8020) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c3b8020,ffff800037fdf3c0,ffff800037fdf310) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff800037fdf3c0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037fdf3c0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x50062f681d0, count: -18
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff800037fde130
rbx                                0
rdx                                0
rcx               0xffff80003c3b8020
rax               0xffff80002999dff0
r8                0xffff800037fde010
r9                0x8080808080808080
r10               0x803c017d50dda4a3
r11                0x8d358e78e3bcfe6
r12               0xfffff600040c22c0
r13               0xfffff600048b0cf0
r14                              0x3
r15               0xffffffff8352e37b    substchar+0xe488
rip               0xffffffff8148ba85    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff800037fde120
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=471100 pid=13573 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c3b94e0,0xffff80003c3b87f8
    process=0xffff80002a37e698 user=0xffff800037fda000, vmspace=0xfffff6006c9853f0
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 29925  326266  66075     0  2           0        0x1           syz-executor
 29925  376034  66075     0  3           0  0x4000080 fsleep    syz-executor
 11368  452702  62052     0  7           0        0x1           syz-executor
 11368  247589  62052     0  3           0  0x4000080 fsleep    syz-executor
 11368  448427  62052     0  3           0  0x4000080 fsleep    syz-executor
 13573  309224  49556     0  2           0          0           syz-executor
*13573  471100  49556     0  7           0  0x4000000           syz-executor
 13573  205913  49556     0  3           0  0x4000080 fsleep    syz-executor
 30105   59998  98892     0  2           0        0x1           syz-executor
 30105  345705  98892     0  3           0  0x4000080 sbwait    syz-executor
 26690  196412  74766     0  2           0          0           syz-executor
 26690   35187  74766     0  3           0  0x4000080 fsleep    syz-executor
 26690   35301  74766     0  3           0  0x4000080 fsleep    syz-executor
 76746  207686  31426     0  3           0       0x80 nanoslp   syz-executor
 76746  454716  31426     0  3           0  0x4000080 ttyin     syz-executor
 61710  233050  90199     0  2         0x1        0x1           syz-executor
 61710  348843  90199     0  3         0x1  0x4000080 fsleep    syz-executor
  2856  383518      0     0  3     0x14000      0x200 acct      acct
 66450   30517  37531     0  3         0x1       0x80 nanoslp   syz-executor
 66450  517778  37531     0  3         0x1  0x4000080 ttyin     syz-executor
 66450  439350  37531     0  3         0x1  0x4000080 fsleep    syz-executor
 66075  280018  24665     0  3         0x2       0x80 nanoslp   syz-executor
 49556  438894  24665     0  3         0x2       0x80 nanoslp   syz-executor
 98892  376229  24665     0  3         0x2       0x80 nanoslp   syz-executor
 31426   88201  24665     0  3         0x2       0x80 nanoslp   syz-executor
 74766  501759  24665     0  3         0x2       0x80 nanoslp   syz-executor
 62052   91136  24665     0  3         0x2       0x80 nanoslp   syz-executor
 37531  384816  24665     0  2         0x2          0           syz-executor
 90199  147079  24665     0  3         0x2       0x80 nanoslp   syz-executor
 24665  431832  49663     0  3         0x2       0x80 kqread    syz-executor
 49663  400138  19845     0  3    0x100002       0x88 sigsusp   ksh
 19845  333554  91622     0  3        0x10       0x88 kqread    sshd-session
 91622  197641  83115     0  3        0x12       0x80 kqread    sshd-session
 36102  335619      1     0  3    0x100003       0x80 ttyin     getty
 83115  291097      1     0  3           0       0x88 kqread    sshd
 55143  155357  31272    74  3   0x1100012       0x80 bpf       pflogd
 31272  402467      1     0  3           0       0x80 sbwait    pflogd
 56516   93011  14112    73  3   0x1100010       0x80 kqread    syslogd
 14112  485717      1     0  3    0x100002       0x80 sbwait    syslogd
  2515   39801      1     0  3    0x100000       0x80 kqread    resolvd
 42001  313110  14193    77  3    0x100012       0x80 kqread    dhcpleased
 14949  107954  14193    77  3    0x100012       0x80 kqread    dhcpleased
 14193   53976      1     0  3           0       0x80 kqread    dhcpleased
  5911  389687      0     0  3     0x14000      0x200 bored     smr
 57402  523499      0     0  2     0x14000      0x200           zerothread
 17000   44129      0     0  3     0x14000      0x200 aiodoned  aiodoned
 57362   44355      0     0  3     0x14000      0x200 syncer    update
 72179  239734      0     0  3     0x14000      0x200 cleaner   cleaner
  8915  267210      0     0  3     0x14000      0x200 reaper    reaper
 84972  225645      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 35321  472444      0     0  3     0x14000      0x200 bored     viomb
 77896  490048      0     0  3     0x14000 0x40000200 acpi0     acpi0
 64715  250316      0     0  3     0x14000 0x40000200           idle1
 58850  169589      0     0  3     0x14000      0x200 bored     softnet1
 51208  300388      0     0  2     0x14000      0x200           softnet0
 10031  319500      0     0  3     0x14000      0x200 bored     systqmp
 73237  436625      0     0  3     0x14000      0x200 bored     systq
 43866  141676      0     0  3     0x14000      0x200 tmoslp    softclockmp
 56439  402538      0     0  3     0x14000 0x40000200 tmoslp    softclock
 58791  309602      0     0  3     0x14000 0x40000200           idle0
     1   94337      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 13573 (syz-executor) thread 0xffff80003c3b8020 (471100)
exclusive rwlock pf_lock r = 0 (0xffffffff839b4438)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x13ca sys/net/pf_ioctl.c:3241
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff839b44c8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2075
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff839e5080)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11068  12158K   12354K 166960K     12393        0
            pcb    20     12K      12K 166960K        59        0
         rtable   254      9K      10K 166960K       444        0
             pf    34     17K      23K 166960K        86        0
         ifaddr    43      7K       7K 166960K        56        0
        ifgroup    55      2K       2K 166960K        75        0
         sysctl     4      1K       9K 166960K        11        0
       counters    70     37K      37K 166960K        90        0
       ioctlops     1      2K       4K 166960K      1509        0
            iov     0      0K      16K 166960K         8        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1359     85K      86K 166960K      1562        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         4        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        24        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    18     65K      85K 166960K       339        0
          sigio     1      0K       0K 166960K         7        0
           proc    72    115K     164K 166960K       611        0
        subproc    72      4K       4K 166960K        81        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        16        0
       in_multi    99      6K       6K 166960K       112        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     1      0K       0K 166960K        15        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    67    307K     307K 166960K        67        0
           exec     0      0K       1K 166960K       407        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   249    168K     177K 166960K      4914        0
       UVM aobj    10      2K       2K 166960K        11        0
     pinsyscall    43     86K     102K 166960K      1521        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         5        0
            NDP    12      0K       1K 166960K        36        0
           temp    43   9119K    9135K 166960K      9169        0
         kqueue    14     22K      26K 166960K        52        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       43    0       40     1     0     1     1     0     8    0
rtentry    176      134    0       22     6     0     6     6     0     8    0
unpcb      144      139    0      120     1     0     1     1     0     8    0
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736       41    0       37     1     0     1     1     0     8    0
arp        136       22    0        5     1     0     1     1     0     8    0
inpcb      328      205    0      193     3     1     2     2     0     8    0
nd6        152       30    0        4     2     0     2     2     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48        9    0        1     1     0     1     1     0     8    0
ppxss      1192       7    0        7     2     1     1     1     0     8    1
pffrag     232        4    0        0     1     0     1     1     0   482    0
pffrnode    88        4    0        0     1     0     1     1     0     8    0
pffrent     40        6    0        2     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       8    0        8     1     0     1     1     0     8    1
pfsrclim   320        2    0        2     2     2     0     1     0     8    0
pfanchor   1288       2    0        2     1     0     1     1     0     8    1
pfstitem    24       37    0        0     1     0     1     1     0     8    0
pfstkey    128       37    0        0     2     0     2     2     0     8    0
pfstate    448       37    0        0     5     0     5     5     0     8    0
pfrule     1360      23    0       18     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      535    0       68    30     0    30    30     0     8    0
art_table   40      537    0       68     5     0     5     5     0     8    0
art_node    32      134    0       32     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        1     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl      72       22    0       12     1     0     1     1     0     8    0
shmpl      112        8    0        1     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1869    0      400    93     0    93    93     0     8    0
ffsino     296     1869    0      400   114     0   114   114     0     8    0
nchpl      144     2398    0      690    64     0    64    64     0     8    0
rtmask      32        2    0        2     1     0     1     1     0     8    1
vnodes     216     2118    0        0   118     0   118   118     0     8    0
namei      1024    7691    0     7691     2     1     1     2     0     8    1
percpumem   16       61    0       10     1     0     1     1     0     8    0
pfiaddrpl  120        2    0        2     1     0     1     1     0     8    1
kstatmem   264       39    0       12     2     0     2     2     0     8    0
scxspl     216     8274    0     8274     8     3     5     5     1     8    5
plimitpl   152       46    0       29     1     0     1     1     0     8    0
sigapl     424      655    0      606     7     1     6     7     0     8    0
knotepl    120      305    0        0    10     0    10    10     0     8    0
kqueuepl   224       61    0       51     1     0     1     1     0     8    0
pipepl     344      140    0      112     3     0     3     3     0     8    0
fdescpl    528      638    0      606     3     0     3     3     0     8    0
filepl     160     2730    0     2490    13     0    13    13     0     8    3
lockfpl    104       82    0       77     1     0     1     1     0     8    0
lockfspl    48       43    0       38     1     0     1     1     0     8    0
sessionpl  144       40    0       29     1     0     1     1     0     8    0
pgrppl      48       52    0       33     1     0     1     1     0     8    0
ucredpl    104      301    0      288     1     0     1     1     0     8    0
zombiepl   144      709    0      709     2     1     1     1     0     8    1
processpl  1232     655    0      606     5     1     4     5     0     8    0
procpl     664      998    0      937     7     1     6     6     0     8    0
sockpl     752      402    0      368     6     1     5     5     0     8    0
mcl64k     65536      4    0        0     1     0     1     1     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     125    0        0    16     0    16    16     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      16    0        0     2     0     2     2     0     8    0
mextrefs    64       13    0        0     1     0     1     1     0     8    0
mtagpl      96       13    0        0     1     0     1     1     0     8    0
mbufpl     256      184    0        0    12     0    12    12     0     8    0
bufpl      272     2759    0      105   177     0   177   177     0     8    0
anonpl      32     7279    0        0    59     0    59    59     0   247    0
amapchunkpl 152   14575    0    14035    31     6    25    26     0   158    4
amappl16   200     2328    0     2296    17     6    11    14     0     8    7
amappl15   192        7    0        7     1     1     0     1     0     8    0
amappl14   184      442    0      441     1     0     1     1     0     8    0
amappl13   176      207    0      195     1     0     1     1     0     8    0
amappl12   168      909    0      878     2     0     2     2     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       77    0       62     1     0     1     1     0     8    0
amappl9    144      276    0      275     1     0     1     1     0     8    0
amappl8    136      101    0       99     1     0     1     1     0     8    0
amappl7    128      161    0      148     1     0     1     1     0     8    0
amappl6    120      173    0      172     1     0     1     1     0     8    0
amappl5    112      104    0       94     1     0     1     1     0     8    0
amappl4    104      290    0      272     1     0     1     1     0     8    0
amappl3     96     2611    0     2499     3     0     3     3     0     8    0
amappl2     88      754    0      676     2     0     2     2     0     8    0
amappl1     80    11251    0    10642    15     2    13    15     0     8    0
amappl      88     4134    0     3959     5     0     5     5     0    92    1
uvmvnodes   80      112    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       10    0        1     1     0     1     1     0     8    0
uaddrrnd    24      638    0      606     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      638    0      606     1     0     1     1     0     8    0
vmmpekpl   168     7145    0     7100     3     0     3     3     0     8    0
vmmpepl    168    49578    0    47592    96     3    93    93     0   357    5
vmsppl     488      637    0      606     5     0     5     5     0     8    1
rwobjpl     80    17306    0    16233    27     1    26    26     0     8    2
pdppl      4096    1283    0     1212   101    28    73    83     0     8    2
pvpl        32    13800    0        0   112     0   112   112     0   265    0
pmappl     256      637    0      606     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      456    0       33    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff8397bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839e4880) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839e4880) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff800037fd3390,ffff80000006e200) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__mp_lock(ffffffff839e4880) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839e4880) at __mp_lock+0x192 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff839e4880) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff839e4880) at __mp_lock+0x192 sys/kern/kern_lock.c:173
ktrsysret(ffff80003c3b94e0,4a,0,ffff800037fd3710) at ktrsysret+0xde ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80003c3b94e0,4a,0,ffff800037fd3710) at ktrsysret+0xde sys/kern/kern_ktrace.c:209
syscall(ffff800037fd37c0) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff800037fd37c0) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:812
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x739992190010, count: -14
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff83997510,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff839974f8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffff6006cce57e0,ffff800037fde378,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(fffff6006cce57e0,1000,ffff800037fde448,ffff800037fde42c,0,1,b11882a69f787563,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff800037fde660,ffff800037fde698,ffff800037fde4e0,ffff800037fde4c8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff800037fde660,ffff800037fde698,ffff800037fde5e0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffff6006c9853f0,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff800037fde810,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff800037fde810) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(14900,c4504441,ffff800001615000,1,ffff80003c3b8020) at pfioctl+0x13ff sys/net/pf_ioctl.c:3241
VOP_IOCTL(fffff6000dcab288,c4504441,ffff800001615000,1,fffff600097fd7b8,ffff80003c3b8020) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff6006cc52cc8,c4504441,ffff800001615000,ffff80003c3b8020) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80003c3b8020,ffff800037fdf3c0,ffff800037fdf310) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff800037fdf3c0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037fdf3c0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x50062f681d0, count: -18

Crashes (148):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/24 02:03 openbsd cf84231e2650 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 21:58 openbsd 69b59cbe79d8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 18:31 openbsd 69b59cbe79d8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 08:12 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 01:39 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/22 09:52 openbsd 94b8f25de2d2 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/21 23:01 openbsd d8ab52b87c98 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/21 09:02 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/21 05:34 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/20 05:44 openbsd 1a498b6f2b58 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/19 19:26 openbsd b71086f46363 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/19 08:02 openbsd aeb4a173c2e6 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/19 02:07 openbsd aeb4a173c2e6 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/19 00:41 openbsd aeb4a173c2e6 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/18 17:24 openbsd c2844c6b7636 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/18 13:36 openbsd c2844c6b7636 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/18 09:43 openbsd caeb0e649bb8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/18 07:39 openbsd caeb0e649bb8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/18 02:33 openbsd caeb0e649bb8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/17 12:42 openbsd 3b8d610e537f 905244d6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/17 09:41 openbsd 3b8d610e537f 905244d6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/17 07:36 openbsd 3b8d610e537f 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/16 16:44 openbsd ae3832a13713 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/16 12:55 openbsd 63d30f6f93ff 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/16 02:14 openbsd 63d30f6f93ff 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/15 20:26 openbsd b903a0834f41 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/15 11:02 openbsd a536f3ad0739 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/14 05:49 openbsd 52741ec3fdca b13552fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/13 21:31 openbsd b8ee6bbd8ccb 4d118901 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/13 09:04 openbsd a63ea9f8f0de 359b2492 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/24 17:22 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 b55bd4c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/24 07:45 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/24 05:12 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 23:39 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 19:51 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 17:11 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 10:06 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 05:38 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 00:16 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/22 03:19 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 16d1c2a497d4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/21 19:06 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 16d1c2a497d4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/21 19:06 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 16d1c2a497d4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/13 19:41 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3be50a05e816 4d118901 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/13 07:07 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan a2d10d12a513 359b2492 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/13 05:35 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan a2d10d12a513 359b2492 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/12 19:00 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b7bfd6278925 ee03bfea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.