syzbot

Title	Repro	Count	Last	Reported	Patched	Closed	Patch
freebsd test error: Fatal trap NUM: page fault while in kernel mode		11	42d	42d	2/2	42d	517c5854588e vm_phys: Make sure that vm_phys_enq_chunk() stays in bounds
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (4)		1	100d	100d	2/2	92d	d66399326cb4 kthread: Set *tdptr earlier in kproc_kthread_add()
Fatal trap NUM: page fault in strlcpy	C	3	108d	109d	2/2	107d	b112232e4fb9 uipc_shm: Copyin userpath for ktrace(2)
panic: Unaligned free of ADDR from zone ADDR(mbuf) slab ADDR(NUM)	C	28	108d	109d	2/2	108d	fb8a8333b481 unix: return immediately on MSG_OOB
Fatal trap NUM: page fault in uipc_soreceive_stream_or_seqpacket	C	3	109d	109d	2/2	108d	d1cbb17a873c unix: fix the ad hoc STAILQ_PREPEND()
panic: Assertion size > NUM failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE	C	69	130d	134d	2/2	130d	b5a9299bb8b9 ktls: catch invalid parameters earlier
panic: Assertion size > NUM failed at /syzkaller/managers/i386/kernel/sys/kern/subr_vmem.c:LINE		1	130d	130d	2/2	130d	b5a9299bb8b9 ktls: catch invalid parameters earlier
panic: Assertion !callout_active(&tp->t_callout) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_subr.c:LINE		3	166d	167d	2/2	165d	57e27ff07aff tcp: partially undo D43792
panic: Assertion !callout_active(&tp->t_callout) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE		13	165d	167d	2/2	165d	57e27ff07aff tcp: partially undo D43792
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_usrreq.c:LINE		565	191d	192d	2/2	191d	a079c891c01b sctp: restore missing inpcb lock
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:LINE	C	455	191d	192d	2/2	191d	a079c891c01b sctp: restore missing inpcb lock
panic: sbflush_internal: ccc NUM mb ADDR mbcnt NUM	C	3	203d	203d	2/2	199d	59ce044a7856 sockets: on shutdown(2) do sorflush() only in case of generic sockbuf
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM	C	4	235d	245d	2/2	206d	7df9da47e8f0 Fix udp IPv4-mapped address
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_subr.c:LINE		9	232d	235d	2/2	219d	ade05d63b727 tcp: stop stack timers in tcp_switch_back_to_default()
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (3)		1	231d	231d	2/2	229d	ae77041e0714 kthread: Set *newtdp earlier in kthread_add1()
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_hpts.c:LIN	C	375	232d	235d	2/2	232d	3f46be6acadd tcp_hpts: let tcp_hpts_init() set a random CPU only once
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE	C	35	232d	235d	2/2	232d	ade05d63b727 tcp: stop stack timers in tcp_switch_back_to_default()
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_hpts.c:LIN		211	232d	235d	2/2	232d	3f46be6acadd tcp_hpts: let tcp_hpts_init() set a random CPU only once
panic: ASan: Invalid access, NUM-byte read at ADDR, MallocRedZone(fb) (2)		6	285d	296d	2/2	283d	761ae1ce798a ktrace: Handle uio_resid underflow via MSG_TRUNC
panic: in_pcblookup_hash_locked: invalid local address (2)	C	94	296d	507d	2/2	293d	abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: in_pcblookup_hash_locked: invalid foreign address (2)	C	38	301d	507d	2/2	293d	abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: Rack:ADDR sb:ADDR rsm:ADDR -- first rsm mbuf not aligned to sb (2)		1	346d	346d	2/2	295d	8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: rsm:ADDR nrsm:ADDR hit at soff:NUM null m		1	373d	373d	2/2	295d	8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: mbuf:ADDR len:NUM rsm:ADDR oml:NUM soff:NUM	C	4	297d	346d	2/2	296d	8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: Counter goes negative (3)	C	595	318d	874d	2/2	317d	bb56b36d7188 sctp: further improve shutting down the read side of a socket
panic: sbflush_internal: residual data (3)	C	33	410d	776d	2/2	318d	81c5f0fac91d sctp: improve shutting down the read side of a socket
panic: malloc: called with spinlock or critical section held	C	3	333d	333d	2/2	332d	6b635c74fd41 aesni: Push FPU sections down further
panic: sbcut_internal: no next, len NUM	C	2	351d	351d	2/2	337d	847fa61fad5e sctp: improve handling of socket shutdown for reading
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (2)		51	357d	358d	2/2	352d	ccdb28275db7 vm_phys_enq_range: no alignment assert for npages==0
freebsd boot error: panic: vm_phys_enq_range: page ADDR and npages NUM are misaligned		18	359d	360d	2/2	359d	b7370efade86 Revert "vm_phys_enqueue_contig: handle npages==0"
Fatal trap NUM: page fault in tcp_input_with_port	C	6	382d	422d	2/2	365d	a43e7a96b64e inpcb: use internal flag to mark pcbs that are inserted into lbgroup
panic: in_pcbconnect: inp is already connected	C	2	407d	407d	2/2	399d	de0a2eb2ef86 tcp: Disallow connecting a disconnected socket
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	C	2	401d	401d	2/2	401d	712079d38106 unix: Fix uipc_peeraddr() to handle self-connected sockets
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/i386/kernel/sys/kern/uipc_usrreq.c:LINE		1	401d	401d	2/2	401d	712079d38106 unix: Fix uipc_peeraddr() to handle self-connected sockets
panic: filesystem goof: vop_panic[vop_fplookup_vexec]		6	477d	477d	2/2	476d	4032c388146b ufs: add missing vop_fplookup ops to fifo vectors
panic: ASan: Invalid access, NUM-byte write at ADDR, StackMiddle(f2) (3)		4274	479d	479d	2/2	479d	030434acaf46 Update rack to the latest code used at NF.
panic: in6_pcblookup_hash_locked: invalid local address	syz	37	523d	539d	2/2	501d	aa71d6b4a2ec netinet: Disallow unspecified addresses in ICMP-embedded packets
panic: in_pcblookup_hash_l[o ctkherde:a di nvaplidi d 1l1o86 catlid a1d0dr0e6s9s1 ]		1	520d	520d	2/2	507d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
panic: in_pcblookup_hash_locked: invalid local address	syz	165751	507d	539d	2/2	507d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
panic: in_pcblookup_hash_locked: invalid foreign address	syz	152	508d	539d	2/2	507d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
freebsd build error (16)		214	519d	535d	2/2	519d	8c8574acb851 config: Include errno.h in mkmakefile.cc
Fatal trap NUM: page fault in sctp_notify_stream_reset_tsn	syz	2	540d	540d	2/2	540d	7b2f1a7fe944 sctp: improve delivery of stream reset notifications
Fatal trap NUM: page fault in kern_cpuset_getid	C	3	544d	544d	2/2	543d	2058f075b4af cpuset: Handle CPU_WHICH_TIDPID wherever cpuset_which() is called.
panic: ipreass_callout: stray callout on bucket ADDR		10	685d	687d	2/2	670d	15b73a2a14d1 ip_reass: use correct comparison in ipreass_callout()
panic: ipreass_callout: stray callout on bucket ADDR, NUM < NUM		34	681d	685d	2/2	681d	15b73a2a14d1 ip_reass: use correct comparison in ipreass_callout()
panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	C	2	707d	707d	2/2	700d	820bafd0bc14 unix/dgram: don't panic if socket buffer has negative space
Fatal trap NUM: page fault in key_attach	C	117	714d	715d	2/2	714d	b7bf3cb07fcf keysock: explicitly initialized LIST_HEAD
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)	C	3	821d	845d	2/2	716d	bb995f2ef0e7 sctp: improve handling of send() calls with no user data`
panic: seq_out not found rack:ADDR tp:ADDR	C	108	741d	1139d	2/2	738d	5b741298b11c tcp rack: fix switching to RACK when FIN has been sent
Fatal trap NUM: page fault in soclose	C	245	760d	763d	2/2	759d	bafe71fd2720 sctp: do not clobber listening socket with sockbuf operations
panic: Assertion v != tid failed at /syzkaller/managers/main/kernel/sys/kern/kern_mutex.c:LINE	C	245	775d	1415d	2/2	773d	a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Assertion v != tid failed at /syzkaller/managers/i386/kernel/sys/kern/kern_mutex.c:LINE	syz	115	778d	1409d	2/2	773d	a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Assertion (t->parent->p_treeflag & P_TREE_REAPER) != NUM failed at /syzkaller/managers/main/kernel/sys/kern/kern_		7	776d	820d	2/2	774d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Thread not suspended	syz	30	776d	820d	2/2	774d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Assertion TD_CAN_RUN(td) failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:LINE	C	1	820d	820d	2/2	774d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: td ADDR is not suspended	C	11	775d	820d	2/2	774d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: already suspended	C	130	774d	820d	2/2	774d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Lock pf config not exclusively locked @ /syzkaller/managers/i386/kernel/sys/netpfil/pf/pf_ioctl.c:LINE		109	808d	850d	2/2	774d	826c58d6656c pf: add missing unlock on error in DIOCCHANGERULE
panic: Lock pf config not exclusively locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:LINE	C	142	808d	851d	2/2	774d	826c58d6656c pf: add missing unlock on error in DIOCCHANGERULE
Fatal trap NUM: page fault in tcp_sack_output		4	779d	780d	2/2	779d	ce2525c8108a tcp: remove goto and address another NULL deref in SACK
panic: sctp_inpcb_free: inp ADDR still has socket	syz	12	813d	1001d	2/2	783d	a5c2009dd8ab sctp: improve handling of sctp inpcb flags
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT (2)	C	27	789d	806d	2/2	787d	a3d974082549 pf: make sure the rule tree is allocated in DIOCCHANGERULE
panic: sbflush_internal: residual data (2)	C	263	789d	1051d	2/2	789d	a6a596e102be sctp: improve handling of listen() call
panic: Queues are not empty when handling SHUTDOWN-ACK (2)		1	790d	790d	2/2	790d	64b297e803bd sctp: improve handling of send() when association is shutdown
panic: Warning: Last msg marked incomplete, yet nothing left? (2)	C	3	791d	799d	2/2	790d	2646cd085850 sctp: use a consistent view of the send parameters
panic: Queues are not empty when handling SHUTDOWN-COMPLETE	C	17	828d	1357d	2/2	790d	64b297e803bd sctp: improve handling of send() when association is shutdown
panic: sctp: no chunks on the queues (2)	syz	1813	790d	1434d	2/2	790d	2646cd085850 sctp: use a consistent view of the send parameters
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/i386/kernel/sys/kern/uipc_usr		18	792d	793d	2/2	792d	75e7e3ce34d9 unix: fix incorrect assertion in 4682ac697ce
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usr	C	6	793d	793d	2/2	792d	75e7e3ce34d9 unix: fix incorrect assertion in 4682ac697ce
freebsd build error (13)		9	798d	799d	2/2	798d	4a3e51335e86 cpuset: Fix the KASAN and KMSAN builds
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (3)	syz	3	822d	828d	2/2	821d	490a0f77de77 sctp: improve locking
panic: ASan: Invalid access, NUM-byte write at ADDR, UMAUseAfterFree(fd)		8	830d	844d	2/2	829d	868868f14efc sctp: improve stopping of timers
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd) (2)	C	7	829d	831d	2/2	829d	a12d89332efe sctp: hold the inp lock while calling ip6_output
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (2)		1	906d	906d	2/2	832d	3dc57df91e65 sctp: don't wakeup 1-to-1 listening sockets for data or notifications
Fatal trap NUM: page fault in __mtx_lock_flags (2)	C	2	841d	841d	2/2	832d	3dc57df91e65 sctp: don't wakeup 1-to-1 listening sockets for data or notifications
panic: ASan: Invalid access, NUM-byte read in sctp_med_chunk_output	C	180	986d	1043d	2/2	833d	eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd)	C	515	833d	953d	2/2	833d	eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, 4-byte write at ADDR, UMAUseAfterFree(fd)	C	462	848d	1115d	2/2	845d	52106f072fd0 sctp: don't refer to a potentially outdated stream
panic: ASan: Invalid access, NUM-byte write at ADDR, UseAfterScope(f8)		11	848d	970d	2/2	846d	39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, StackRight(f3)		102	847d	850d	2/2	846d	39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, KernelStack(fe)		149	847d	850d	2/2	846d	39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, StackMiddle(f2) (2)		1	848d	848d	2/2	846d	39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, StackLeft(f1)		48	847d	850d	2/2	846d	39a22011bbb8 sctp: clear pointer to stack when returning from function.
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT	C	81	850d	851d	2/2	850d	e123e2294cb5 pf: guard against DIOCADDRULE without DIOCXBEGIN
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-tcb @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_outp		2	850d	850d	2/2	850d	5d0c76c7302b sctp: don't lock an already locked stcb.
panic: Don't own TCB send lock	C	8016	850d	1035d	2/2	850d	5ac91821f5d7 sctp: get rid of stcb send lock
panic: Association about to be freed (2)	C	4834	850d	887d	2/2	850d	5ac91821f5d7 sctp: get rid of stcb send lock
panic: hold_tcblock is false	C	468	887d	888d	2/2	887d	e255f0c9fbd2 sctp: make sure new locking requirements are satisfied.
panic: Association about to be freed	C	57	887d	888d	2/2	887d	bdb99f6f5e31 sctp: remove KASSERT() which not always holds
panic: create_lock_applied is true	C	104	887d	888d	2/2	887d	2f0656fb9ba2 sctp: don't hold the assoc create lock longer than needed
panic: refcount ADDR wraparound (4)		21	911d	978d	2/2	899d	300cfb96fc22 file: Make fget() and getvnode() consistent about initializing *fpp
panic: Bad link elm ADDR prev->next != elm (3)		8	911d	963d	2/2	904d	b84ed4e7f626 filemon: Reject FILEMON_SET_FD commands when the fd is a kqueue
panic: lock ADDR is not initialized (2)		171	906d	922d	2/2	906d	773e3a71b2f1 pf: Initialize pf_kpool mutexes earlier
freebsd boot error: can't ssh into the instance		22	920d	921d	2/2	920d	46d35d415aa9 fork: Copy the vm_stacktop field into the new vmspace
panic: lock ADDR is not initialized		1457	922d	924d	2/2	922d	e5ca5e801d3c pf: ensure we don't destroy an uninitialised lock
Fatal trap NUM: page fault in inp_next	syz	3	941d	946d	2/2	937d	430df2abee90 in_pcb: improve inp_next()
panic: mutex blocked lock not owned at /syzkaller/managers/main/kernel/sys/kern/sched_ule.c:LINE	C	33	938d	938d	2/2	937d	6b95cf5bdedc callout: Wait for the softclock thread to switch before rescheduling
Fatal trap NUM: page fault in tcp_usr_send	syz	1	941d	941d	2/2	941d	4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: overhead (NUM) not a multiple of NUM	C	248	941d	942d	2/2	941d	ca0dd19f0933 sctp: check that the computed frag point is a multiple of 4
Fatal trap NUM: page fault in tcp_usr_shutdown	C	5	942d	942d	2/2	941d	4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
Fatal trap NUM: page fault in tcp_usr_rcvd	C	7	942d	943d	2/2	942d	37a7f5573716 tcp_usr_rcvd: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: m_apply, offset > size of mbuf chain	C	2	948d	948d	2/2	942d	989453da0589 sctp: cleanup the SCTP_MAXSEG socket option.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE (2)	C	314	952d	956d	2/2	952d	9f5432d5e5f0 netinet6: ip6_setpktopt() requires NET_EPOCH
panic: ASan: Invalid access, 2-byte read at ADDR, UMAUseAfterFree(fd)	C	1103	953d	1114d	2/2	953d	014f98b11992 udp: Fix a use-after-free in udp_multi_input()
Fatal trap NUM: page fault in memcpy_erms	C	306	954d	960d	2/2	954d	aa2681752d0d cryptosoft: Don't treat CRYPTO_NULL_HMAC as an hmac algorithm.
Fatal trap NUM: page fault while in kernel mode (2)		1	967d	967d	2/2	956d	12ae3476f35c tcp_drain(): initialize the inpcb iterator when curvnet is set
Fatal trap NUM: page fault in tcp_drain		12	966d	967d	2/2	956d	12ae3476f35c tcp_drain(): initialize the inpcb iterator when curvnet is set
panic: Lock tcpinp not exclusively locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_log_buf.c:LINE		13	986d	988d	2/2	985d	2f62f92e3745 tcp: Fix a locking issue related to logging
panic: Lock tcpinp not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/tcp_log_buf.c:LINE		6	985d	988d	2/2	985d	2f62f92e3745 tcp: Fix a locking issue related to logging
panic: witness_warn (2)		29	987d	988d	2/2	987d	df07bfda67ad tcp: Fix a locking issue
panic: chacha20_poly1305_reinit: invalid nonce length		2	997d	997d	2/2	990d	442ad83e38e8 crypto: Don't assert on valid IV length for Chacha20-Poly1305.
panic: condition vp->v_type == VDIR \|\| VN_IS_DOOMED(vp) not met at /syzkaller/managers/i386/kernel/sys/kern/vfs_cache.c:		1	1009d	1009d	2/2	1003d	628c3b307fb2 cache: only let non-dir descriptors through when doing EMPTYPATH lookups
Fatal trap NUM: page fault in filt_bpfwrite	C	4	1011d	1017d	2/2	1004d	426682b05a4c bpf: Fix the write filter for detached descriptors
panic: ASan: Invalid access, NUM-byte read in newreno_cong_signal	C	4	1005d	1008d	2/2	1004d	b15b0535968e tcp: allow new reno functions to be called from other CC modules
panic: ASan: Invalid access, NUM-byte read in newreno_ack_received		2	1006d	1006d	2/2	1004d	b15b0535968e tcp: allow new reno functions to be called from other CC modules
panic: Assertion (cnp->cn_flags & (LOCKPARENT \| WANTPARENT)) == NUM failed at /syzkaller/managers/main/kernel/sys/kern/v	C	87	1013d	1014d	2/2	1013d	1045352f1503 cache: only assert on flags when dealing with EMPTYPATH
panic: TLS trailer length too long: NUM	C	2	1022d	1022d	2/2	1017d	a63752cce646 ktls: Reject attempts to enable AES-CBC with TLS 1.3.
panic: filesystem goof: vop_panic[vop_readdir]		1	1022d	1022d	2/2	1017d	03d5820f738d mount: Check for !VDIR mount points before handling -o emptydir
freebsd build error (9)		1	1019d	1019d	2/2	1019d	c05b382edb17 Revert "bootstrap: No need to disable shared libraries for bootstrap tools"
panic: invalid payload start		6	1044d	1156d	2/2	1023d	a0cbcbb7917b cryptodev: Allow some CIOCCRYPT operations with an empty payload.
panic: filt_timerattach: periodic timer has a calculated zero timeout		12	1029d	1029d	2/2	1029d	2f4dbe279f6b kqueue: fix recent assertion
panic: strq ADDR not scheduled		12189	1029d	1032d	2/2	1029d	3ff3733991ba sctp: don't keep being locked on a stream which is removed
panic: strq ADDR is not scheduled		541	1031d	1032d	2/2	1031d	28ea9470782d sctp: provide a specific stream scheduler function for FCFS
Fatal trap NUM: page fault in sctp_ss_rrp_packet_done		328	1032d	1035d	2/2	1031d	5b53e749a95e sctp: fix usage of stream scheduler functions
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-send-tcb @ /syzkaller/managers/i386/kernel/sys/netinet/sctp		2	1032d	1034d	2/2	1031d	171633765c43 sctp: avoid locking an already locked mutex
Fatal trap NUM: page fault while in kernel mode		177	1031d	1035d	2/2	1031d	5b53e749a95e sctp: fix usage of stream scheduler functions
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-send-tcb @ /syzkaller/managers/main/kernel/sys/netinet/sctp		10	1032d	1035d	2/2	1031d	171633765c43 sctp: avoid locking an already locked mutex
Fatal trap NUM: page fault in sctp_ss_default_select		20939	1031d	1035d	2/2	1031d	5b53e749a95e sctp: fix usage of stream scheduler functions
Fatal trap NUM: page fault in sctp_ss_fb_select		12	1032d	1035d	2/2	1031d	5b53e749a95e sctp: fix usage of stream scheduler functions
Fatal trap NUM: page fault in sctp_ss_prio_select		761	1031d	1035d	2/2	1031d	5b53e749a95e sctp: fix usage of stream scheduler functions
panic: runtime error: invalid memory address or nil pointer dereference		12	1033d	1035d	2/2	1033d	b1e2f063ae91 amd64 sendsig: fix context corruption
freebsd boot error: panic: ASan: Invalid access, NUM-byte read at ADDR, UseAfterScope(f8)		270	1035d	1039d	2/2	1035d	ca1e447b1048 amd64: Avoid copying td_frame from kernel procs
panic: ASan: Invalid access, 2-byte read in sctp_ss_prio_add		1	1109d	1109d	2/2	1039d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
Fatal trap 9: general protection fault in sctp_ss_prio_add		1	1127d	1127d	2/2	1040d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
Fatal trap 12: page fault in sctp_ss_default_add (2)		1	1117d	1117d	2/2	1040d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: ASan: Invalid access, 8-byte read in sctp_ss_default_add		326	1043d	1112d	2/2	1040d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (4)	C	147	1115d	1339d	2/2	1040d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: ASan: Invalid access, 8-byte read in sctp_ss_fb_add		22	1077d	1111d	2/2	1040d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: ASan: Invalid access, 8-byte read in kern_sendit		2	1044d	1084d	2/2	1041d	fea1a98ead91 freebsd32: Fix a double copyin in sendmsg() and recvmsg()
panic: Bad link elm ADDR prev->next != elm (2)		8	1041d	1053d	2/2	1041d	e19d93b19dce sctp: fix FCFS stream scheduler
Fatal trap 12: page fault while in kernel mode (3)	C	140	1043d	1649d	2/2	1043d	ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
Fatal trap 12: page fault in soo_aio_queue	C	349	1043d	1148d	2/2	1043d	ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE	C	3	1055d	1120d	2/2	1046d	e6c19aa94da4 sctp: Allow blocking on I/O locks even with non-blocking sockets
Fatal trap 12: page fault in __mtx_lock_flags	C	1065	1049d	1548d	2/2	1049d	2d5c48eccd9f sctp: Tighten up locking around sctp_aloc_assoc()
panic: Assertion job->uiop != &job->uio && job->uiop != NULL failed at /syzkaller/managers/i386/kernel/sys/kern/vfs_aio.		1	1053d	1053d	2/2	1049d	2884918c7338 aio: Fix up the opcode in aiocb32_copyin()
panic: ASan: Invalid access, 4-byte read in sctp_sendall_completes		39	1053d	1111d	2/2	1049d	173a7a4ee4fa sctp: Fix iterator synchronization in sctp_sendall()
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/i386/kernel/sys/kern/subr_turnstile.c: (2)		9	1101d	1194d	2/2	1050d	141fe2dceeae aio: Interlock with listen(2)
panic: ASan: Invalid access, 1-byte read in udp6_common_ctlinput		1	1092d	1092d	2/2	1050d	b1e6a792d68e net: Enter a net epoch around protocol if_up/down notifications
panic: unexpected security protocol NUM	syz	7	1051d	1066d	2/2	1050d	10eb2a2bde61 ipsec: Validate the protocol identifier in ipsec4_ctlinput()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE (2)		68	1055d	1145d	2/2	1050d	141fe2dceeae aio: Interlock with listen(2)
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)	C	109	1053d	1148d	2/2	1050d	141fe2dceeae aio: Interlock with listen(2)
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:	C	46	1113d	1369d	2/2	1050d	141fe2dceeae aio: Interlock with listen(2)
panic: Lock sctp-info not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:LINE	C	363	1051d	1051d	2/2	1051d	0c1a20beb456 sctp: use appropriate argument when freeing association
panic: ASan: Invalid access, 8-byte read in osd_get		13	1052d	1111d	2/2	1051d	187afc58791c osd: Fix racy assertions
Fatal trap 9: general protection fault in strlen	C	1506	1116d	1874d	2/2	1051d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mtx_lock() of destroyed mutex at sys/kern/uipc_sockbuf.c:LINE	syz	4	1201d	1391d	2/2	1051d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mutex so_snd not owned at /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:LINE	syz	1	1345d	1345d	2/2	1051d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.	C	131	1052d	1052d	2/2	1052d	6e3af6321ba4 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb.		111	1052d	1052d	2/2	1052d	6e3af6321ba4 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/netinet/tcp_output.c:LINE	syz	707	1075d	1960d	2/2	1052d	bd4a39cc93d9 socket: Properly interlock when transitioning to a listening socket
panic: ASan: Invalid access, NUM-byte read in strncmp	C	12	1053d	1058d	2/2	1053d	5402baa5b5d1 g_label: Handle small sector sizes when tasting
Fatal trap 12: page fault in knlist_remove_kq		3	1124d	1132d	2/2	1059d	c511383de7a0 kevent: Fix races between timer detach and kqtimer_proc_continue()
Fatal trap 12: page fault in filt_timerdetach		1	1128d	1128d	2/2	1059d	c511383de7a0 kevent: Fix races between timer detach and kqtimer_proc_continue()
panic: ASan: Invalid access, 8-byte read in sctp_free_assoc		112	1059d	1112d	2/2	1059d	d35be50f5779 sctp: Hold association locks across socket wakeups when freeing
Fatal trap 9: general protection fault in sctp_free_assoc	syz	14	1121d	1429d	2/2	1059d	d35be50f5779 sctp: Hold association locks across socket wakeups when freeing
Fatal trap 9: general protection fault in itimer_proc_continue	syz	2	1153d	1153d	2/2	1060d	3138392a46a4 itimer: Serialize access to the p_itimers array
panic: ASan: Invalid access, 1-byte read at ADDR, RedZonePartial(2)		17	1113d	1115d	2/2	1060d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 8-byte read in itimer_proc_continue		1	1098d	1098d	2/2	1060d	3138392a46a4 itimer: Serialize access to the p_itimers array
panic: ASan: Invalid access, 1-byte read at ADDR, RedZonePartial(1)		13	1070d	1114d	2/2	1060d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 1-byte read in g_raid_md_taste_ddf	C	18	1065d	1112d	2/2	1060d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 2-byte read in g_raid_md_taste_sii	C	7	1073d	1098d	2/2	1060d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: Bad list head ADDR first->prev != head	C	3409	1060d	1958d	2/2	1060d	4a36122b1db1 sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(7)		28	1113d	1116d	2/2	1061d	564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(6)		20	1113d	1116d	2/2	1061d	564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: ASan: Invalid access, 8-byte read at ADDR, StackMiddle(f2)		18	1113d	1115d	2/2	1061d	36226163fa48 x86: Mark the trapframe as initialized in ipi_bitmap_handler()
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(3)		9	1113d	1114d	2/2	1061d	564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: ASan: Invalid access, 16-byte read in aesni_encrypt_icm	C	114	1062d	1113d	2/2	1061d	564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/i386/kernel/sys/kern/subr_sleepqueue.c:LINE		1	1140d	1140d	2/2	1075d	c4feb1ab0ae0 sigtimedwait: Use a unique wait channel for sleeping
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/main/kernel/sys/kern/subr_sleepqueue.c:LINE (2)	C	7	1117d	1141d	2/2	1075d	c4feb1ab0ae0 sigtimedwait: Use a unique wait channel for sleeping
panic: ASan: Invalid access, 4-byte read in sctp6_connect		64	1088d	1113d	2/2	1084d	784692c74019 sctp: improve handling of IPv4 addresses on IPV6 sockets Reported by: syzbot+08fe66e4bfc2777cba95@syzkaller.appspotmail.com MFC after: 3 days
panic: ASan: Invalid access, 4-byte read in sctp_sosend	C	518	1084d	1113d	2/2	1084d	b732091a761a sctp: improve input validation of mapped addresses in send() Reported by: syzbot+35528f275f2eea6317cc@syzkaller.appspotmail.com Reported by: syzbot+ac29916d5f16d241553d@syzkaller.appspotmail.com MFC after: 3 days
freebsd boot error: panic: sleeping without a lock		6	1086d	1086d	2/2	1086d	2694c869ff9f ktls: fix a panic with INVARIANTS
panic: ASan: Invalid access, 4-byte read in tcp_usr_bind	C	50	1086d	1111d	2/2	1086d	3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: ASan: Invalid access, 4-byte read in udp_bind	C	69	1086d	1112d	2/2	1086d	3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: pmap_growkernel: no memory to grow kernel (2)	syz	299	1089d	1549d	2/2	1086d	600745f1e226 pf: bound DIOCGETSTATES memory use
panic: pmap_kasan_enter_alloc_4k: no memory to grow shadow map	C	20	1089d	1108d	2/2	1086d	600745f1e226 pf: bound DIOCGETSTATES memory use
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR (2)	C	75	1125d	1169d	2/2	1094d	64432ad2a2c4 pf: Validate user string nul-termination before copying
freebsd boot error: panic: ASan: Invalid access, 1-byte read at ADDR, MallocRedZone(fb)		156	1109d	1116d	2/2	1109d	4a9a41650c90 uart: Fix an out-of-bounds read in ns8250_bus_probe()
panic: Assertion (cnp->cn_flags & (LOCKPARENT \| WANTPARENT)) == 0 failed at /syzkaller/managers/main/kernel/sys/kern/vfs	C	4	1171d	1171d	2/2	1111d	6de3cf14c47d vn_open_cred(): disallow O_CREAT \| O_EMPTY_PATH
panic: ASan: Invalid access, 32-byte read at ADDR, StackMiddle(f2)		1	1113d	1113d	2/2	1112d	36226163fa48 x86: Mark the trapframe as initialized in ipi_bitmap_handler()
panic: ASan: Invalid access, 8-byte read in handleevents		34	1112d	1113d	2/2	1112d	36226163fa48 x86: Mark the trapframe as initialized in ipi_bitmap_handler()
panic: thread_lock() of sleep mutex `*Fv @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE		1	1155d	1155d	2/2	1151d	4a59cbc12532 amd64: Avoid enabling interrupts when handling kernel mode prot faults
panic: thread_lock() of sleep mutex ` @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE	C	1	1155d	1155d	2/2	1151d	4a59cbc12532 amd64: Avoid enabling interrupts when handling kernel mode prot faults
panic: Assertion p2->p_ktrioparms == NULL failed at /syzkaller/managers/i386/kernel/sys/kern/kern_ktrace.c:LINE		1	1159d	1159d	2/2	1156d	f3851b235b23 ktrace: Fix a race with fork()
panic: Assertion p2->p_ktrioparms == NULL failed at /syzkaller/managers/main/kernel/sys/kern/kern_ktrace.c:LINE		1	1160d	1160d	2/2	1156d	f3851b235b23 ktrace: Fix a race with fork()
Fatal trap 12: page fault in rack_process_to_cumack (2)	syz	3	1159d	1160d	2/2	1158d	13c0e198ca27 tcp: Fix bugs related to the PUSH bit and rack and an ack war
panic: refcount ADDR wraparound (3)	C	9	1160d	1161d	2/2	1160d	6f6cd1e8e8aa ktrace: Remove vrele() at the end of ktr_writerequest()
panic: Non-zero write count		98	1160d	1161d	2/2	1160d	6f6cd1e8e8aa ktrace: Remove vrele() at the end of ktr_writerequest()
Fatal trap 9: general protection fault in rack_ctloutput	syz	2	1163d	1163d	2/2	1161d	8923ce630492 tcp: Handle stack switch while processing socket options
panic: ktrace_enter: flag set	C	44	1161d	1163d	2/2	1161d	e4b16f2fb18b ktrace: Avoid recursion in namei()
panic: _mtx_lock_sleep: recursed on non-recursive mutex so_snd @ /syzkaller/managers/i386/kernel/sys/modules/tcp/rack/..		4	1162d	1162d	2/2	1162d	39756885633f rack: honor prior socket buffer lock when doing the upcall
panic: _mtx_lock_sleep: recursed on non-recursive mutex so_snd @ /syzkaller/managers/main/kernel/sys/modules/tcp/rack/..		2	1162d	1162d	2/2	1162d	39756885633f rack: honor prior socket buffer lock when doing the upcall
panic: Memory modified after free ADDR(4096) val=ADDR @ ADDR	C	1	1167d	1167d	2/2	1162d	500eb6dd8040 tcp: Fix sending of TCP segments with IP level options
freebsd boot error: panic: scsi_action: ccb ADDR, func_code 0x6 should not be allocated from UMA zone		42	1167d	1168d	2/2	1166d	5b81e2e1bcdc virtio_scsi: Zero stack-allocated CCBs
Fatal trap 12: page fault in callout_process (2)		7	1172d	1201d	2/2	1169d	2cca77ee0134 kqueue timer: Remove detached knotes from the process stop queue
Fatal trap 9: general protection fault in kqtimer_proc_continue		109	1170d	1203d	2/2	1169d	2cca77ee0134 kqueue timer: Remove detached knotes from the process stop queue
panic: releasing active pmap ADDR	C	11	1172d	1215d	2/2	1170d	9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
panic: pmap active ADDR	C	5	1177d	1215d	2/2	1170d	9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
Fatal trap 18: integer divide fault in realtimer_expire_l	C	15	1171d	1198d	2/2	1170d	8b3c4231abf0 posix timers: Check for overflow when converting to ns
Fatal trap 18: integer divide fault in realtimer_expire	C	20	1202d	1223d	2/2	1170d	8b3c4231abf0 posix timers: Check for overflow when converting to ns
Fatal trap 9: general protection fault in crypto_ioctl		1	1177d	1176d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: crp_iv_start set when IV isn't used	C	2	1175d	1176d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR		5	1175d	1213d	2/2	1171d	c8bbb1272c8b vfs: Fix error handling in vn_fullpath_hardlink()
panic: IV outside buffer length	C	16	1172d	1177d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
Fatal trap 9: general protection fault in mb_free_ext		1	1173d	1173d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: More encryption data than allowed	C	2	1173d	1173d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: AEAD without a separate IV	C	25	1172d	1177d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
Fatal trap 12: page fault in memcpy_erms	C	2	1173d	1173d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: IV_SEPARATE set when IV isn't used	C	4	1173d	1176d	2/2	1171d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_sig	syz	2	1200d	1200d	2/2	1171d	5cc1d199412e realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/i386/kernel/sys/kern/kern_eve		2	1200d	1201d	2/2	1171d	75c5cf7a720f filt_timerexpire: avoid process lock recursion
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_eve		1	1201d	1201d	2/2	1171d	75c5cf7a720f filt_timerexpire: avoid process lock recursion
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/i386/kernel/sys/kern/kern_sig		1	1203d	1203d	2/2	1171d	5cc1d199412e realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
Fatal trap 12: page fault in pmap_kextract (2)	C	8	1201d	1202d	2/2	1201d	5e98cae661f3 pf: Ensure that we don't use kif passed to pfi_kkif_attach()
panic: to_ticks == 0 for timer type 5 (2)	syz	2	1223d	1223d	2/2	1222d	d995cc7e5431 sctp: fix handling of RTO.initial of 1 ms
panic: to_ticks == 0 for timer type 5	C	2	1249d	1249d	2/2	1245d	70e95f0b6917 sctp: avoid integer overflow when starting the HB timer
Fatal trap 12: page fault in sctp_find_alternate_net	syz	131	1251d	1395d	2/2	1251d	b963ce4588b3 sctp: improve computation of an alternate net
panic: pfi_dynaddr_setup: non-NULL dyn (2)	C	4	1282d	1282d	2/2	1276d	7a808c5ee329 pf: Improve pf_rule input validation
Fatal trap 12: page fault in copyin_nosmap_erms	C	8	1319d	1366d	2/2	1290d	ea36212bf571 pf: Don't hold PF_RULES_WLOCK during copyin() on DIOCRCLRTSTATS
freebsd boot error: panic: IPI scoreboard is zero, initiator 1 target 1		9	1291d	1292d	2/2	1291d	44121a0fbee0 amd64: fix tlb shootdown when all cpus are passed in the bitmap
freebsd boot error: panic: IPI scoreboard is zero, initiator 0 target 0		3	1291d	1292d	2/2	1291d	44121a0fbee0 amd64: fix tlb shootdown when all cpus are passed in the bitmap
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/uipc_ktls.c:LINE	C	11	1297d	1522d	2/2	1294d	6685e259e319 tcp: don't use KTLS socket option on listening sockets
panic: Memory modified after free ADDR(112) val=ADDR @ ADDR (2)	syz	475	1298d	1542d	2/2	1298d	a7aa5eea4fff sctp: improve handling of aborted associations
panic: sched_pickcpu: Failed to find a cpu.	C	4	1326d	1327d	2/2	1326d	f1b18a668deb cpuset_set{affinity,domain}: do not allow empty masks
Fatal trap 9: general protection fault in cpuset_setproc	syz	2	1327d	1327d	2/2	1326d	b2780e8537da kern: cpuset: resolve race between cpuset_lookup/cpuset_rel
panic: sleeping without a lock	C	29	1331d	1498d	2/2	1330d	34af05ead3cf kern: soclose: don't sleep on SO_LINGER w/ timeout=0
panic: uma_zalloc_debug: called within spinlock or critical section	C	9	1337d	1341d	2/2	1336d	e07e3fa3c95c kern: cpuset: drop the lock to allocate domainsets
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (3)	C	12	1340d	1341d	2/2	1339d	5d49283f8857 pf: Make tag hashing more robust
panic: fc_ioctls != NULL, but fc_nioctls=-NUM		5591	1342d	1342d	2/2	1342d	3d4ae1b3d110 kern: dup: do not assume oldfde is valid
Fatal trap 12: page fault in __mtx_lock_spin_flags		3	1346d	1350d	2/2	1345d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
panic: spin lock held too long	C	1	1350d	1350d	2/2	1345d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
Fatal trap 12: page fault in _callout_stop_safe	C	1	1350d	1350d	2/2	1345d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
panic: Most recently used by pf_ifnet	C	6	1383d	1383d	2/2	1382d	52b83a06184c pf: do not remove kifs that are referenced by rules
Fatal trap 9: general protection fault in sctp_lower_sosend	C	22	1482d	1534d	2/2	1440d	f5d30f7f7606 Improve the handling of concurrent send() calls for SCTP sockets, especially when having the explicit EOR mode enabled.
panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb	C	2	1488d	1488d	2/2	1452d	cfae6a92ac01 Remove an incorrect assertion from in6p_lookup_mcast_ifp().
Fatal trap 12: page fault in uipc_ready	C	5	1483d	1510d	2/2	1457d	1b778ba2609f Fix a logic error in uipc_ready_scan().
panic: witness_warn	syz	1	1502d	1502d	2/2	1486d	e54b7cd007b5 Fix the cleanup handling in a error path for TCP BBR.
Fatal trap 12: page fault in sctp_find_ifa_in_ep	C	3	1489d	1489d	2/2	1486d	7a3f60e7f571 Fix a bug introduced in https://svnweb.freebsd.org/changeset/base/362173
freebsd test error: Fatal trap 12: page fault in in_pcb_lport_dest		9	1530d	1530d	2/2	1506d	1ec42007fec3 Fix NULL-pointer bug from r361228.
Fatal trap 12: page fault in sctp_process_control	C	47	1537d	1538d	2/2	1536d	86fd36c502db Fix a copy and paste error introduced in r360878.
Fatal trap 9: general protection fault in sctp_process_control	C	11	1537d	1538d	2/2	1536d	86fd36c502db Fix a copy and paste error introduced in r360878.
panic: sctp_timer_start of type 1: inp = ADDR, stcb = ADDR, net = 0		1	1542d	1542d	2/2	1538d	efd5e6929194 Ensure that we have a path when starting the T3 RXT timer.
panic: sctp_timer_start of type 10: inp = ADDR, stcb->sctp_ep ADDR		1	1548d	1548d	2/2	1538d	83ed508055c0 Ensure that the SCTP iterator runs with an stcb and inp, which belong to each other.
panic: pfi_dynaddr_setup: dyn is ADDR (2)	C	22	1548d	1559d	2/2	1545d	1ef06ed8def9 pf: Improve DIOCADDRULE validation
panic: mallocarray: ADDR * 1064 overflowed	C	3	1556d	1560d	2/2	1552d	a7c8533634ab pf: Improve input validation
Fatal trap 9: general protection fault in in6_selecthlim		25	1552d	1553d	2/2	1552d	17cb6ddba8ab Fix order of arguments in fib[46]_lookup calls in SCTP.
panic: pfi_dynaddr_setup: dyn is ADDR	C	7	1560d	1564d	2/2	1559d	98582ce38183 pf: Improve ioctl() input validation
panic: Assertion size0 > 0 failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE	C	2	1563d	1563d	2/2	1561d	95324dc3f4d2 pf: Do not allow negative ps_len in DIOCGETSTATES
panic: mtx_unlock() of destroyed mutex at sys/kern/sys_socket.c:LINE	syz	1	1652d	1652d	2/2	1564d	99258935eb2b Lock the socket in soo_stat().
panic: sbfree: m ADDR !M_NOTREADY	C	32	1934d	1960d	2/2	1566d	dde1b5985fcc Properly handle disconnected sockets in uipc_ready().
panic: allocdirect_merge: old blkno 9384 != new 9384 \|\| old size 4096 != new NUM		2	1572d	1572d	2/2	1568d	Revert -r359612 as it can cause other panics. An updated version will be made when the issue has been resolved.
panic: Duplicate free of ADDR from zone ADDR(mbuf) slab ADDR(8)	C	1	1957d	1957d	2/2	1568d	3d36b367cfb6 sbappendcontrol() needs to avoid clearing M_NOTREADY on data mbufs.
panic: to_ticks == 0 for timer type 2	C	27	1581d	1585d	2/2	1581d	25ec35535397 Handle integer overflows correctly when converting msecs and secs to ticks and vice versa. These issues were caught by recently added panic() calls on INVARIANTS systems.
panic: mtx_unlock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE		1	1603d	1603d	2/2	1589d	99258935eb2b Lock the socket in soo_stat().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/ip_output.c:LINE	syz	1870	1590d	1647d	2/2	1589d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/ip6_output.c:LINE	syz	229	1590d	1647d	2/2	1589d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet6/ip6_output.c:LINE	C	591	1590d	1647d	2/2	1589d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:LINE	C	2840	1590d	1647d	2/2	1589d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
freebsd boot error: Fatal trap 9: general protection fault in biotrack_buf		24	1628d	1628d	2/2	1590d	dcebfcf3d468 Revert r357710 and 357711 until they can be debugged
panic: Most recently used by ip6opt (2)	syz	4	1593d	1639d	2/2	1590d	e02582d1ae44 Fix synchronization in the IPV6_2292PKTOPTIONS set handler.
panic: mutex process lock not owned at /syzkaller/managers/i386/kernel/sys/kern/kern_time.c:LINE	C	33	1634d	1634d	2/2	1590d	55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: cap_rights_is_vset:LINE (3)		1	1602d	1602d	2/2	1590d	429537caeb13 kern_dup(): Call filecaps_free_prep() in a write section.
panic: refcount ADDR wraparound	C	6	1635d	1635d	2/2	1590d	adbdb897689b fd: always nullify fdp in fget routines
panic: mutex process lock not owned at /syzkaller/managers/main/kernel/sys/kern/kern_time.c:LINE	C	83	1634d	1634d	2/2	1633d	55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: condition !vn_need_pageq_flush(vp) not met at /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:LINE (vgonel)		1	1638d	1638d	2/2	1638d	0f4d8b77c02c vfs: revert the overzealous assert added in r357285 to vgone
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE		3062	1752d	1753d	2/2	1648d	Remove epoch assertion from if_setlladdr(). Originally this function was protected by IF_ADDR_LOCK(), which was a mutex, so that two simultaneous if_setlladdr() can't execute. Later it was switched to IF_ADDR_RLOCK(), likely by a mistake. Later it was switched to NET_EPOCH_ENTER(). Then I incorrectly added NET_EPOCH_ASSERT() here.
panic: mutex if_addr_lock not owned at /syzkaller/managers/main/kernel/sys/netinet/in_mcast.c:LINE		1	1669d	1669d	2/2	1655d	31069f383af1 Take the ifnet's address lock in igmp_v3_cancel_link_timers().
panic: pipe_destroy_write_buffer: pipe map for ADDR contains residual data	syz	11	1727d	1771d	2/2	1719d	1cbfe73da570 Fix handling of PIPE_EOF in the direct write path.
panic: mutex pcbinfohash not owned at /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:LINE	C	5	1721d	1722d	2/2	1719d	c17cd08f5302 It is unclear why in6_pcblookup_local() would require write access to the PCB hash. The function doesn't modify the hash. It always asserted write lock historically, but with epoch conversion this fails in some special cases.
panic: in_pcb_lport: laddrp NULL for v4 inp ADDR	C	8	1764d	1880d	2/2	1737d	4a91aa8fc9b6 Ensure that the flags indicating IPv4/IPv6 are not changed by failing bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@.
panic: Assertion td->td_epochnest failed at /syzkaller/managers/i386/kernel/sys/kern/subr_epoch.c:LINE		3	1752d	1752d	2/2	1745d	ip6_output() has a complex set of gotos, and some can jump out of the epoch section towards return statement. Since entering epoch is cheap, it is easier to cover the whole function with epoch, rather than try to properly maintain its state.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/igmp.c:LINE		2	1752d	1752d	2/2	1745d	7299f8c33d62 Enter network epoch in domain callouts.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/in6_ifattach.c:LINE	syz	2	1751d	1751d	2/2	1745d	in6ifa_llaonifp() is never called from fast path, so do not require epoch being entered.
Fatal trap 12: page fault in uipc_send	syz	123	1754d	1885d	2/2	1752d	4013d7268446 Fix handling of empty SCM_RIGHTS messages.
freebsd boot error: panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/net/if.c:LINE		18	1753d	1753d	2/2	1753d	In DIAGNOSTIC block of if_delmulti_ifma_flags() enter the network epoch. This quickly plugs the regression from r353292. The locking of multicast definitely needs a broader review today...
Fatal trap 18: integer divide fault in kern_fcntl		22	1777d	1803d	2/2	1759d	4a7b33ecf4d8 Disallow fcntl(F_READAHEAD) when the vnode is not a regular file.
panic: rcv_start < rcv_end		1	1784d	1784d	2/2	1760d	Only update SACK/DSACK lists when a non-empty segment was received. This fixes hitting a KASSERT with a valid packet exchange.
Fatal trap 12: page fault in inp_freemoptions (2)	syz	14	1871d	1880d	2/2	1761d	Convert all IPv4 and IPv6 multicast memberships into using a STAILQ instead of a linear array.
panic: vm_page_swapqueue: page ADDR is unmanaged		1	1771d	1771d	2/2	1764d	3a79b409bb89 Fix a race in vm_page_swapqueue().
freebsd boot error: panic: sched_pickcpu: Failed to find a cpu.		30	1766d	1767d	2/2	1766d	967c0718849e Fix wrong assertion in r352658.
panic: m_getm2: len is < 0	syz	13	1953d	1959d	2/2	1767d	2ef5bd2f0c46 Limit the number of bytes which can be queued for SCTP sockets. This is joint work with rrs@. Reported by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com MFC after: 1 week
panic: indir_trunc: Bad indirdep 0 from buf ADDR		1	1878d	1878d	2/2	1824d	577fca0e204d Lock the vnode before calling ufs_bmap_seekdata().
panic: ffs_blkfree_cg: freeing free block (2)		2	1894d	1914d	2/2	1824d	577fca0e204d Lock the vnode before calling ufs_bmap_seekdata().
Fatal trap 9: general protection fault in sctp_copy_skeylist	syz	3	1877d	1877d	2/2	1839d	8a956abe12c6 When calling sctp_initialize_auth_params(), the inp must have at least a read lock. To avoid more complex locking dances, just call it in sctp_aloc_assoc() when the write lock is still held.
panic: udp6_output: non-excl udbinfo lock, excl inp lock: pcbinfo ADDR 0x1 inp ADDR 0x2		1	1860d	1860d	2/2	1840d	9e44bc22d884 r348494 fixes a race in udp_output(). The same race exists in udp_output6(), therefore apply a similar patch to IPv6.
panic: Most recently used by tty	syz	24	1892d	1906d	2/2	1849d	6a01874c5afa Defer funsetown() calls for a TTY to tty_rel_free().
freebsd boot error: panic: Bad entry start/end for new stack entry		9	1858d	1858d	2/2	1851d	639f3e01b444 Revert r349393, which leads to an assertion failure on bootup, in vm_map_stack_locked.
panic: cap_rights_is_vset:LINE	syz	3	1873d	1873d	2/2	1854d	7c3703a69466 Use a consistent snapshot of the fd's rights in fget_mmap().
Fatal trap 12: page fault in vm_page_unhold_pages	C	1169	1862d	1956d	2/2	1854d	02476c44c5eb Fix mutual exclusion in pipe_direct_write().
panic: udp_output: shared udbinfo lock, excl inp lock (2)	syz	7	1895d	1914d	2/2	1882d	eafaa1bc35e9 After parts of the locking fixes in r346595, syzkaller found another one in udp_output(). This one is a race condition. We do check on the laddr and lport without holding a lock in order to determine whether we want a read or a write lock (this is in the "sendto/sendmsg" cases where addr (sin) is given).
Fatal trap 12: page fault in inp_freemoptions	C	11	1902d	1955d	1/2	1900d	5a1e222bfda7 Close some races in multicast socket option handling.
panic: inp_leave_group: imf_sources not empty	C	6	1902d	1923d	1/2	1900d	5a1e222bfda7 Close some races in multicast socket option handling.
panic: vm_object_vndeallocate: bad object reference count	C	974	1901d	1901d	1/2	1901d	8cd6a80d7d68 Restore the pre-r347532 behaviour of ignoring wiring failures in mmap().
panic: ffs_blkfree_cg: freeing free block	C	5	1958d	1958d	1/2	1915d	a7a455c299b0 Optimize lseek(SEEK_DATA) on UFS.
panic: udp_output: shared udbinfo lock, excl inp lock	C	46	1922d	1960d	1/2	1921d	d86ecbe993a7 iFix udp_output() lock inconsistency.
Fatal trap 12: page fault in in6_cksum_partial	syz	6	1925d	1955d	1/2	1925d	70a0f3dcdc1f When a checksum has to be computed for a received IPv6 packet because it is requested by the application using the IPPROTO_IPV6 level socket option IPV6_CHECKSUM on a raw socket, ensure that the packet contains enough bytes to contain the checksum at the specified offset.
panic: rtrequest1_fib: locked	C	10	1932d	1957d	1/2	1930d	e6481fd4c46a When sending a routing message, don't allow the user to set the RTF_RNH_LOCKED flag in rtm_flags, since this flag is used only internally.
panic: inp_join_group: imf_sources not empty	C	398	1933d	1960d	1/2	1933d	f1ef572a1ecd Reinitialize multicast source filter structures after invalidation.
Fatal trap 12: page fault in __mtx_assert	syz	4	1951d	1952d	1/2	1949d	7854c63d6fbe Fix a small bug in the tcp_log_id where the bucket was unlocked and yet the bucket-unlock flag was not changed to false. This can cause a panic if INVARIANTS is on and we go through the right path (though rare).
panic: Can't clear local locks with F_UNLCKSYS	C	9	1950d	1960d	1/2	1950d	fd76e780a7c0 Reject F_SETLK_REMOTE commands when sysid == 0.
panic: Counter goes negative	C	2	1957d	1957d	1/2	1951d	0d3cf13dabf8 Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 24 - 0 != 60	C	2	1958d	1958d	1/2	1952d	05fb056c068d Fix a KASSERT() in tcp_output().
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 28 - 0 != 60		1	1956d	1956d	1/2	1952d	05fb056c068d Fix a KASSERT() in tcp_output().
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 12 - 0 != 60		1	1960d	1960d	1/2	1952d	05fb056c068d Fix a KASSERT() in tcp_output().
panic: pmap_demote_pde: page table page for a wired mapping is missing	C	56	1954d	1959d	1/2	1954d	64087fd7f372 Disallow preemptive creation of wired superpage mappings.
panic: invalid dst page ADDR	C	33	1956d	1960d	1/2	1955d	45d72c7d7fca vm_fault_copy_entry: accept invalid source pages.