syzbot

panic: pool_do_get: shmpl free list modified: page 0xfffffd80607b0000; item addr 0xfffffd80607b0da0; offset 0x0=0x0 != 0xa2ed9287b39e1cd4
Starting stack trace...
panic(ffffffff833b4c29) at panic+0x1ba sys/kern/subr_prf.c:229
pool_do_get(ffffffff83974650,1,ffff80003c9533a8) at pool_do_get+0x574 sys/kern/subr_pool.c:743
pool_get(ffffffff83974650,1) at pool_get+0x11a sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff80002a86c568,ffff80003c9535f0,186,ffff80003c953540) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff80002a86c568,ffff80003c9535f0,ffff80003c953540) at sys_shmget+0x195 sys/kern/sysv_shm.c:482
syscall(ffff80003c9535f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c9535f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xcd49fb46430, count: 250
End of stack trace.