Extra filters: [With Repro]

Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Closed	Patch
UBSan: Undefined Behavior in usb_free_device (2)	-1	syz, C			117	1686d	1788d	0/3	never	ee30345caf41 usb(9): Record config index, not just number, in struct usbd_device. 0ed3a32984ce usb(9): Use ud_configidx, not ud_config, to see if unconfigured.
MSan: Uninitialized Memory in ip6_hopopts_input	-1	syz, C			6	925d	927d	3/3	924d	5c6e5685cb2e ip6_output: Initialize plen for ip6_hopopts_input.
UBSan: Undefined Behavior in dounmount	-1	syz, C			130	925d	927d	3/3	924d	45a3b0de2942 dounmount: Avoid &((struct vnode_impl *)NULL)->vi_vnode.
assert failed: sc->sc_parent->dk_rawopens > NUM	-1	syz, C			59	1494d	1525d	3/3	1189d	804127267a30 dk(4): Use disk_begindetach and rely on vdevgone to close instances.
panic: kernel di.NUM=S2dagnostic assertion "uio->uio_iovcnt > NUM" failed: file "/syzkaller/managers/ci2-netbs	2				1	1301d	1301d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
assert failed: uAiio->uio_iovcnt > NUM	-1				1	1289d	1289d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
assert failed: uio->uio_iovcnt > NUM	-1	syz, C			34	1264d	1726d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
assert failed: %uio->uio_iovcnt > NUM	-1	syz, C			1	1299d	1299d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
panic: keexecrnel diagnostic assertion "uio->uio_iovcnt > NUM" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kerne	2	syz			1	1504d	1504d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
panic: F8kernel diagnostic assertion "uio->uio_iovcnt > NUM" failed: file "/syzkaller/managers/ci2-netbsd-	2	syz, C			1	1726d	1726d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
ASan: Unauthorized Access in uiomove	-1	syz, C			16	1299d	1753d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
panic: kernel dAiagnos@t ic assertion "uio->uio_iovcnt > NUM" failed: f	2				1	1301d	1301d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
assert failed: uio->uio_iohsyz-vcnt > NUM	-1	syz, C			1	1299d	1299d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
panic: kernel diagnostic assertion "uio->uio_iovcnt > NUM" failed: file "/syzkaller/managers/ci2-netbsd-kmsa	2				1	1291d	1291d	3/3	1257d	b31adf0b1e2d tty(9): Make ttwrite update uio with only how much it has consumed.
assert failed: !netq->netq_stopping	-1				1	1280d	1280d	3/3	1268d	c69fcfaebed9 Fix missing check for netq->netq_stopping in vioif_rx_intr()
assert failed: sc->sc_dk.dk_openmask == NUM	-1	syz, C			22	1270d	1287d	3/3	1270d	ee1fb5e72c05 dk(4): dkclose must handle a dying wedge too to close the parent. 9fa2d7efad52 ioctl(DIOCRMWEDGES): Delete only idle wedges.
assert failed: mutex_owned(&sc->sc_dk.dk_openlock)	-1				4	1282d	1287d	3/3	1280d	91ee275156c4 dk(4): Fix lock assertion in size increase: parent's, not wedge's.
UBSan: Undefined Behavior in tmpfs_reg_resize	-1				1	1283d	1283d	3/3	1280d	cd541da68184 tmpfs: Refuse sizes that overflow round_page.
panic: LOCKDEBUG: Mutex error: mi_userret,NUM: sleep lock held	2				6	1287d	1288d	3/3	1287d	5d890d2b118a disk(9): Fix missing unlock in error branch in previous change.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/subr_pserialize.c:LINE, member	-1				39	1296d	1298d	3/3	1294d	245f5e21b00b pserialize(9): Fix bug in recent micro-optimization.
panic: kernel debugging assertion "notin" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/kern/subr_pserialize.c	2				1	1294d	1294d	3/3	1294d	62ab30f06bcb pserialize(9): Fix buggy assertion inside assertion.
UBSan: Undefined Behavior in playtone	-1	syz, C			1	1310d	1310d	3/3	1309d	2ca1ca999393 spkr(4): Avoid some overflow issues.
ASan: Unauthorized Access in playtone	-1	syz, C			2	1310d	1310d	3/3	1309d	2ca1ca999393 spkr(4): Avoid some overflow issues.
panic: sockaddr_copy: source too long, NUM < NUM bytes	2	syz, C			9	1312d	1320d	3/3	1310d	f13466450eff atalk(4): Don't let userland control sa_len when adding addresses.
ASan: Unauthorized Access in ifreq_setaddr (2)	-1				7	1310d	1336d	3/3	1310d	f13466450eff atalk(4): Don't let userland control sa_len when adding addresses.
MSan: Uninitialized Memory in ifreq_setaddr	-1	syz, C			8	1310d	1320d	3/3	1310d	f13466450eff atalk(4): Don't let userland control sa_len when adding addresses.
ASan: Unauthorized Access in sockaddr_dup	-1	syz, C			3	1316d	1319d	3/3	1310d	f13466450eff atalk(4): Don't let userland control sa_len when adding addresses.
MSan: Uninitialized Memory in sin_print	-1	syz, C			4	1336d	1352d	3/3	1310d	8d2c9c078303 sockaddr_alloc(9): Avoid uninitialized buffer in sockaddr_checklen.
assert failed: sa->sa_len <= sizeof(ifr.ifr_ifru)	-1	syz, C			10	1311d	1316d	3/3	1310d	f13466450eff atalk(4): Don't let userland control sa_len when adding addresses.
ASan: Unauthorized Access in sat_print	-1	syz, C			10	1311d	1332d	3/3	1310d	f13466450eff atalk(4): Don't let userland control sa_len when adding addresses.
netbsd boot error: ASan: Unauthorized Access in evcnt_attach_dynamic	-1				33	1316d	1318d	3/3	1312d	317ef74dd360 vioif(4): fix wrong memory allocation size
netbsd boot error: assert failed: len <= map->dm_mapsize - offset (2)	-1				135	1312d	1315d	3/3	1312d	f5ab0ea696d5 virtio(4): Fix sizing of virtqueue allocation.
netbsd boot error: page fault in virtio_free_vq	-1				27	1316d	1317d	3/3	1312d	a66d32465828 Added check of pointer for allocated memory before release of resource
panic: kernel debugging assertion "off + len <= m_length(m0)" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel	2	syz			5	1321d	1339d	3/3	1318d	4ae0945c2b68 in6: make sure a user-specified checksum field is within a packet
panic: kernel debugging assertion "off + len <= m_length(m0)" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/ke	2	syz			1	1321d	1321d	3/3	1318d	4ae0945c2b68 in6: make sure a user-specified checksum field is within a packet
panic: kernel debugging assertion "off + len <= m_length(m0)" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/kernel/	2	syz			3	1321d	1339d	3/3	1318d	4ae0945c2b68 in6: make sure a user-specified checksum field is within a packet
assert failed: fmi->fmi_mount->mnt_lower == NULL	-1	syz, C			5	1361d	1370d	3/3	1355d	6587ec829804 When mounting a union file system set its lower mount only on success.
assert failed: size > NUM	-1	syz, C			4	1388d	1388d	3/3	1386d	e4a063c01894 It is not sufficient to have a comment /* Sanity check the size. */, also check the size is greater than zero and a multiple of DEV_BSIZE.
protection fault in __asan_load4	-1	syz, C			3	1474d	1626d	3/3	1409d	10437a31e86e ppp: remove ioctls that never worked and crash the kernel
page fault in __asan_load4 (3)	-1	syz, C			64	1424d	1579d	3/3	1409d	10437a31e86e ppp: remove ioctls that never worked and crash the kernel
page fault in ppptioctl	-1	syz, C			6	1463d	1567d	3/3	1409d	10437a31e86e ppp: remove ioctls that never worked and crash the kernel
protection fault in ppptioctl	-1	syz, C			3	1435d	1626d	3/3	1409d	10437a31e86e ppp: remove ioctls that never worked and crash the kernel
UBSan: Undefined Behavior in ppptioctl	-1	syz, C			9	1420d	1567d	3/3	1409d	10437a31e86e ppp: remove ioctls that never worked and crash the kernel
assert failed: bp->b_vp == vp	-1	syz, C			125	1411d	2131d	3/3	1410d	03c421ecc1ee swap: disallow user opens of swap block device
panic: dead fs operation used (2)	2	syz, C			8	1420d	1430d	3/3	1419d	ea1b2266a84e Harden layered file systems usage of field "mnt_lower" against forced unmounts of the lower layer.
page fault in VFS_STATVFS	-1	syz			1	1427d	1427d	3/3	1419d	ea1b2266a84e Harden layered file systems usage of field "mnt_lower" against forced unmounts of the lower layer.
UBSan: Undefined Behavior in ip_ctloutput	-1	syz, C			22	1460d	1464d	3/3	1433d	74557efd80ae tcp: restore NULL check for inp in tcp_ctloutput
page fault in ip_ctloutput	-1	syz, C			18	1460d	1463d	3/3	1433d	74557efd80ae tcp: restore NULL check for inp in tcp_ctloutput
UBSan: Undefined Behavior in tcp_bind_wrapper	-1	syz, C			8	1461d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
UBSan: Undefined Behavior in tcp_shutdown_wrapper	-1	syz, C			45	1460d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
page fault in tcp_bind_wrapper	-1	syz, C			9	1462d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
page fault in tcp_recvoob_wrapper	-1	syz, C			23	1460d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
page fault in tcp_sockaddr_wrapper	-1	syz, C			32	1460d	1463d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
UBSan: Undefined Behavior in ip6_ctloutput	-1	syz, C			5	1461d	1463d	3/3	1433d	74557efd80ae tcp: restore NULL check for inp in tcp_ctloutput
page fault in ip_setmoptions	-1	syz, C			2	1463d	1463d	3/3	1433d	74557efd80ae tcp: restore NULL check for inp in tcp_ctloutput
page fault in ip6_ctloutput	-1	syz, C			4	1461d	1463d	3/3	1433d	74557efd80ae tcp: restore NULL check for inp in tcp_ctloutput
UBSan: Undefined Behavior in tcp_listen_wrapper	-1	syz, C			15	1460d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
UBSan: Undefined Behavior in tcp_connect_wrapper	-1	syz, C			23	1461d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
UBSan: Undefined Behavior in tcp_recvoob_wrapper	-1	syz, C			26	1460d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
UBSan: Undefined Behavior in tcp_sockaddr_wrapper	-1	syz, C			25	1460d	1464d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
page fault in tcp_connect_wrapper	-1	syz, C			18	1460d	1463d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
page fault in tcp_listen_wrapper	-1	syz, C			17	1460d	1463d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
page fault in tcp_shutdown_wrapper	-1	syz, C			36	1460d	1463d	3/3	1433d	443b5cdb2251 tcp: restore NULL checks for inp
UBSan: Undefined Behavior in lf_advlock (3)	-1	syz, C			2	1457d	1457d	3/3	1433d	7dc16c04c41d kern/vfs_lockf.c: Parenthesize to make arithmetic match check.
assert failed: !topdown || hint <= orig_hint	-1	syz, C			474	1436d	1608d	3/3	1436d	94439ddc9c53 mmap(2): Avoid arithmetic overflow in search for free space.
page fault in umap_bypass	-1	syz, C			9	1438d	1444d	3/3	1437d	65e6ed3eadc8 When testing whiteout support on the underlying file system union_mount() should not use a NULL componentname as not all file systems can handle it.
UBSan: Undefined behavior (7)	-1				1	1443d	1443d	3/3	1437d	65e6ed3eadc8 When testing whiteout support on the underlying file system union_mount() should not use a NULL componentname as not all file systems can handle it.
UBSan: Undefined Behavior in umap_bypass	-1	syz, C			30	1438d	1444d	3/3	1437d	65e6ed3eadc8 When testing whiteout support on the underlying file system union_mount() should not use a NULL componentname as not all file systems can handle it.
assert failed: fstrans_is_owner(mp) (2)	-1	syz, C			3	1468d	1468d	3/3	1450d	78705bd7aed6 Tmpfs_mount() uses tmpfs_unmount() for cleanup if set_statvfs_info() fails. This will not work as tmpfs_unmount() needs a suspended file system.
UBSan: Undefined Behavior in quota1_handle_cmd_get	-1	syz, C			2	1501d	1501d	3/3	1500d	86778a9b6d3d compat_50_quota: reject invalid quota id types.
UBSan: Undefined Behavior in bpf_ioctl (2)	-1	syz, C			2	1519d	1519d	3/3	1518d	648957bead21 bpf(4): Reject bogus timeout values before arithmetic overflows.
page fault in raidioctl	-1				1	1526d	1526d	3/3	1525d	c6afd038f959 RAIDframe must be initialized for the RAIDFRAME_SET_LAST_UNIT and RAIDFRAME_SHUTDOWN ioctls.
assert failed: (l = dev->dv_detaching) == curlwp	-1	syz, C			2	1529d	1529d	3/3	1527d	61ea95712f31 audio(4): Fix bug in detaching audio16 and beyond.
UBSan: Undefined Behavior in config_detach_commit	-1	syz, C			13	1528d	1539d	3/3	1527d	61ea95712f31 audio(4): Fix bug in detaching audio16 and beyond.
panic: netbsd:vpanic+0x282	2				1	1547d	1547d	3/3	1527d	61ea95712f31 audio(4): Fix bug in detaching audio16 and beyond.
page fault in __asan_load8 (6)	-1	syz, C			23	1528d	1567d	3/3	1527d	61ea95712f31 audio(4): Fix bug in detaching audio16 and beyond.
page fault in config_detach_commit	-1	syz, C			8	1529d	1539d	3/3	1527d	61ea95712f31 audio(4): Fix bug in detaching audio16 and beyond.
assert failed: dev->dv_detaching == curlwp	-1	syz, C			236	1540d	1655d	3/3	1527d	61ea95712f31 audio(4): Fix bug in detaching audio16 and beyond.
assert failed: kpreempt_disabled() (2)	-1	syz			4	1536d	1537d	3/3	1530d	1e8b246aa870 KERNEL_LOCK(9): Need kpreempt_disable to ipi_send, oops.
assert failed: curcpu() != ci	-1	syz, C			1	1536d	1536d	3/3	1535d	e94ab9ad30fc KERNEL_LOCK(9): Record kernel lock holder in fast path too.
assert failed: lktype != LK_NONE	-1	syz, C			8	1658d	1658d	3/3	1537d	Fix mistake in error branch locking caused by previous changes. vput(vp) also unlocks vp, thus unlocking happens twice in error flow causing kernel to panic with failed assertion lktype != LK_NONE in vfs_vnode.c#778. Thanks riastradh with finding the issue.
assert failed: sn->sn_opencnt	-1				18	1545d	1643d	3/3	1540d	5f6126977284 specfs: Refuse to open a closing-in-progress block device.
MSan: Uninitialized Memory in rum_attach	-1	syz			2	1540d	1540d	3/3	1540d	940a6b14a9f7 rum(4): Avoid uninitialized garbage in failed register read.
assert failed: sd->sd_closing	-1	syz, C			20	1572d	1659d	3/3	1540d	5f6126977284 specfs: Refuse to open a closing-in-progress block device.
assert failed: !fmi->fmi_gone	-1	syz, C			3	1563d	1563d	3/3	1542d	6f3bdef36d97 Finish previous, evaluate the lowest mount on first access to "struct mount_info" and store it here so we no longer derefence the "struct mount" from fstrans_alloc_lwp_info().
page fault in vrefcnt	-1	syz			2	1546d	1546d	3/3	1542d	b683789d109b raidframe: reject invalid values for numCol and numSpares
MSan: Uninitialized Memory in rf_UnconfigureVnodes	-1	syz			5	1546d	1547d	3/3	1542d	b683789d109b raidframe: reject invalid values for numCol and numSpares
ASan: Unauthorized Access in rf_UnconfigureVnodes	-1	syz			8	1546d	1547d	3/3	1542d	b683789d109b raidframe: reject invalid values for numCol and numSpares
panic: kmem_free(ADDR, NUM) != allocated size NUM; overwrote?	2	syz, C			3	1551d	1551d	3/3	1542d	d8c1cd5fc0b1 ptyfs: Don't copy out cookies past end of buffer.
UBSan: Undefined Behavior in vrefcnt	-1	syz			5	1546d	1547d	3/3	1542d	b683789d109b raidframe: reject invalid values for numCol and numSpares
UBSan: Undefined Behavior in sys_rasctl (2)	-1	syz, C			4	1544d	1545d	3/3	1544d	21780199e5b9 rasctl(2): Avoid arithmetic overflow.
panic: mutex_destroy,NUM: uninitialized lock (lock=ADDR, from=ADDR) (4)	2	syz, C			4	1546d	1546d	3/3	1545d	84b1e299c3e2 uirda(4): Unconditionally initializes mutexes and selq on attach.
netbsd boot error: panic: pmap_get_physpage: out of memory	-1				51	1547d	1550d	3/3	1547d	785175e6ae3e allow KMSAN to work again by restoring the limiting of kva even with NKMEMPAGES_MAX_UNLIMITED. we used to limit kva to 1/8 of physmem but limiting to 1/4 should be enough, and 1/4 still gives the kernel enough kva to map all of the RAM that KMSAN has not stolen.
UBSan: Undefined Behavior in sys_rasctl	-1	syz, C			10	1547d	1550d	3/3	1547d	d0d3275611d2 rasctl(2): Avoid overflow in address range arithmetic.
ASan: Unauthorized Access in _prop_object_internalize_context_alloc	-1	syz, C			6	1549d	1549d	3/3	1547d	c9637813f932 proplib: Don't run off end of buffer with memcmp.
panic: ASan: Unauthorized Access In ADDR: Addr ADDR [NUM bytes, write, MallocRedZone]	2	syz, C			1	1551d	1551d	3/3	1547d	d8c1cd5fc0b1 ptyfs: Don't copy out cookies past end of buffer.
UBSan: Undefined Behavior in lf_advlock (2)	-1	syz, C			2	1550d	1550d	3/3	1547d	10f34aa31546 kern/vfs_lockf.c: Fix overflow in overflow detection.
UBSan: Undefined Behavior in physio.cold	-1	syz, C			2	2065d	2065d	3/3	1573d	c0577626b1c5 physio(9): Avoid left shift of negative in alignment check.
assert failed: l->l_lid == pls->pl_lwpid	-1	syz, C			133	1573d	2353d	3/3	1573d	3f5ac2f440aa ptrace(PT_LWPSTATUS): Fix lid=0 case.
UBSan: Undefined Behavior in compat_43_ttioctl.cold (2)	-1	syz, C			119	1575d	2164d	3/3	1573d	7a20d166be3d tty_43: Do unsigned arithmetic to avoid shift into sign bits.
UBSan: Undefined Behavior in cpuctl_ioctl.cold	-1	syz, C			44	1576d	2046d	3/3	1574d	3b13b0053ea7 cpuio.h: Use uint8_t, not bool.
UBSan: Undefined Behavior in tty_get_qsize.cold.5	-1	syz, C			63	2241d	2255d	3/3	1574d	ad11505eeb84 tty: Avoid undefined behaviour (left shift of 1 by 31 places overflows int)
UBSan: Undefined Behavior in compat_43_ttioctl.cold.0	-1	syz, C			122	2240d	2302d	3/3	1574d	c32467e14928 tty_43: Check a bitset from userspace is valid before shifting it
assert failed: fli != NULL && !fli->fli_mountinfo->fmi_gone	-1	syz, C			4	2060d	2060d	3/3	1575d	1d440e92c8c7 While one thread runs vgone() it is possible for another thread to grab a "v_mount" that will be freed before it uses this mount for fstrans_start().
panic: dead fs operation used	2	syz, C			109	1577d	2169d	3/3	1575d	acc01a1ad2eb Make dead vfs ops "vfs_statvfs" and "vfs_vptofh" return EOPNOTSUPP. Both operations may originate from (possible dead) vnodes.
page fault in __asan_load8 (5)	-1	syz, C			2	1577d	1577d	3/3	1576d	72412fe0bfca ifioctl(9): Don't touch ifconf or ifreq until command is validated.
page fault in compat_ifconf	-1	syz, C			1	1577d	1577d	3/3	1576d	72412fe0bfca ifioctl(9): Don't touch ifconf or ifreq until command is validated.
UBSan: Undefined Behavior in compat_ifconf	-1	syz, C			37	1577d	1782d	3/3	1576d	72412fe0bfca ifioctl(9): Don't touch ifconf or ifreq until command is validated.
UBSan: Undefined Behavior in udv_attach	-1	syz, C			2	1578d	1578d	3/3	1577d	a881a55ee8ab mmap(2): Prohibit overflowing offsets for non-D_NEGOFFSAFE devices.
MSan: Uninitialized Memory in pppioctl	-1	syz, C			3	1618d	1640d	3/3	1577d	4bf2966bec75 net/if_ppp.c: Avoid user-controlled overrun in PPPIOCSCOMPRESS.
MSan: Uninitialized Memory in ifq_enqueue (2)	-1	syz, C			6	1609d	1780d	3/3	1582d	8349f7b2392f sendto(2), recvfrom(2): Scrub internal struct msghdr on stack.
UBSan: Undefined Behavior in settime1.constprop.5	-1	syz, C			6	2240d	2340d	3/3	1582d	d5c20c2f7d03 kern_time: prevent the system clock from being set too low or high
page fault in __asan_store1	-1	syz, C			23	1948d	1949d	3/3	1582d	6cfadad833d3 Improve Christos's vn_open fix.
UBSan: Undefined Behavior in route_filter	-1	syz, C			3	1583d	1583d	3/3	1582d	9140f660c6fc route(4): Use m_copydata, not misaligned mtod struct access.
UBSan: Undefined Behavior in lf_advlock	-1	syz, C			138	1585d	2345d	3/3	1583d	b4a75906960e vfs(9): Avoid arithmetic overflow in lf_advlock.
assert failed: p != NULL (2)	-1	syz, C			5	1603d	1603d	3/3	1583d	fad5a7fdd1ff uvideo(4): Make alloc logic match free logic.
MSan: Uninitialized Memory in comintr (2)	-1	syz			3	1622d	1625d	3/3	1583d	18a0da752d44 ktrace(9): Zero-initialize padding for ktr_psig records.
panic: mutex_destroy,NUM: uninitialized lock (lock=ADDR, from=ADDR) (3)	2	syz, C			4	1584d	1584d	3/3	1583d	8a733328a1e6 upgt(4): Make upgt_free_cmd match upgt_alloc_cmd.
panic: LOCKDEBUG: Mutex error: mi_userret,116: sleep lock held	2	syz, C			704	1583d	2222d	3/3	1583d	def1e7b831c7 sequencer(4): Fix lock leak in ioctl(FIOASYNC).
assert failed: (!cpu_intr_p() && !cpu_softintr_p()) || (pc->pc_pool.pr_ipl != IPL_NONE || cold || panicstr != NULL)	-1	syz, C			5398	1584d	1832d	3/3	1584d	663332e33fad ktrace(9): Fix mutex detection in ktrcsw. 16f1641497a4 sleepq(9): Pass syncobj through to sleepq_block.
panic: vfs load failed for `compat_12', error NUM (2)	2				1	1658d	1658d	3/3	1584d	663332e33fad ktrace(9): Fix mutex detection in ktrcsw.
UBSan: Undefined Behavior in compat_50_route_output (2)	-1	syz, C			3	1584d	1584d	3/3	1584d	fea551d11726 route(4): Avoid unaligned access to struct rt_msghdr, take two.
assert failed: usp->tv_nsec >= NUM	-1	syz, C			31	1584d	1585d	3/3	1584d	aedc6df2fcba recvmmsg(2): More timespec validation.
assert failed: usp->tv_nsec < ADDRL	-1	syz, C			79	1584d	1585d	3/3	1584d	aedc6df2fcba recvmmsg(2): More timespec validation.
panic: ernel diagnostic assertion "(!cpu_intr_p() && !cpu_softintr_p()) || (pc->pc_pool.pr_ipl != IPL_NONE || cold || pa	2				1	1658d	1658d	3/3	1584d	663332e33fad ktrace(9): Fix mutex detection in ktrcsw.
page fault in rf_fail_disk	-1	syz, C			1	1587d	1587d	3/3	1585d	c3db04994218 RAIDframe must be initialized for the RAIDFRAME_FAIL_DISK80 ioctl.
page fault in uaudio_attach	-1	syz, C			3	1773d	1774d	3/3	1585d	217df124906d Fix a null-deref
assert failed: pipe != NULL	-1	syz, C			5	1778d	2138d	3/3	1585d	4f71c0ceaaeb umidi(4): Fix fencepost in error branch.
panic: tcp_output: no template	2	syz, C			5612	1587d	2804d	3/3	1585d	abfa6438367c tcp(4): Bail early on sendoob if not connected.
assert failed: tp->t_oproc != NULL	-1	syz, C			3	1600d	1600d	3/3	1585d	869f6ce4e7c0 remove KASSERT() checking for t_oproc at open since assigning this line discipline to a pty may not have that set. Instead do a runtime check to ensure that the function exists before calling it, as ttstart() handles it.
UBSan: Undefined Behavior in rf_fail_disk	-1	syz, C			2	1587d	1587d	3/3	1585d	c3db04994218 RAIDframe must be initialized for the RAIDFRAME_FAIL_DISK80 ioctl.
UBSan: Undefined Behavior in gettimeleft	-1	syz, C			20	1592d	2055d	3/3	1585d	bb260a3b0b8b kern: Avoid arithmetic overflow in gettimeleft.
UBSan: Undefined Behavior in sys_recvmmsg	-1	syz, C			491	1586d	2275d	3/3	1585d	8e66f4be029b recvmmsg(2): Avoid arithmetic overflow in timeout calculations.
ASan: Unauthorized Access in ktr_kuser	-1	syz, C			23	1594d	1831d	3/3	1586d	37e3b6d69aff sendmsg(2): Avoid buffer overrun in ktrace of invalid cmsghdr.
UBSan: Undefined Behavior in ts2timo (3)	-1	syz, C			16	1587d	1688d	3/3	1587d	f283286a7e41 kern: Use timespecsubok in ts2timo.
assert failed: requested_size > NUM	-1	syz, C			7	1589d	1612d	3/3	1587d	503bc9b44ec6 umcs(4): Reject invalid interrupt endpoints.
UBSan: Undefined Behavior in dosetitimer.part.NUM	-1	syz, C			147	1588d	1710d	3/3	1587d	5d334e4f13e3 setitimer(2): Guard against overflow in arithmetic.
UBSan: Undefined behavior (5)	-1				1	1604d	1604d	3/3	1587d	2d711168d1f6 route(4): Avoid unaligned access to struct rt_msghdr.
assert failed: ci != NULL	-1	syz, C			4	1617d	1617d	3/3	1587d	bfb356306710 opencrypto(9): Fix missing initialization in error branch.
panic: mutex_destroy,NUM: uninitialized lock (lock=ADDR, from=ADDR) (2)	2	syz, C			8	1587d	1623d	3/3	1587d	69ae1015704b emdtv(4): More attach/detach bugs.
UBSan: Undefined Behavior in itimer_callout	-1	syz, C			6	1595d	1650d	3/3	1587d	7152269db67f setitimer(2): Avoid arithmetic overflow in periodic bookkeeping.
UBSan: Undefined Behavior in uao_detach	-1				2	1656d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
ASan: Unauthorized Access in uvm_unmap_detach	-1	syz, C			7	1655d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
page fault in udv_detach	-1				1	1656d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
panic: vrelel: bad ref count	2	syz, C			2	1655d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
ASan: Unauthorized Access in uao_reference	-1				1	1656d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
assert failed: (use & VUSECOUNT_MASK) > NUM	-1	syz, C			22	1655d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
page fault in uvm_mmap	-1				1	1655d	1655d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
panic: [ NUM.ADDR] vpanic() at netbsd:vpanic+0x2f2	2				1	1656d	1656d	3/3	1655d	96ce6406fe3c Revert "mmap(2): If we fail with a hint, try again without it."
ASan: Unauthorized Access in audio_track_set_format	-1				1	1659d	1659d	3/3	1655d	fd486f88f37d audio(4): Wait for opens to drain in detach.
assert failed: VOP_ISLOCKED(vp) == LK_EXCLUSIVE	-1	syz, C			73	1658d	1659d	3/3	1656d	f5e648f9554a sequencer(4): VOP_CLOSE requires vnode lock.
UBSan: Undefined Behavior in rnd_detach_source	-1	syz, C			9	1756d	1756d	3/3	1656d	dafad59dab33 ucom(4): Make sure rndsource is attached before use and detach.
panic: spkr1 at audio1kernel diagnostic assertion "(target->prt_class == class)" failed: file "/syzkaller/managers/ci2-n	2				1	1675d	1675d	3/3	1656d	65a628cc3991 audio(4): Use d_cfdriver/devtounit to avoid open/detach races.
ASan: Unauthorized Access in uvideo_attach	-1				1	1737d	1737d	3/3	1656d	df8a105e9437 uvideo(4): Parse descriptors more robustly.
netbsd boot error: fault in supervisor mode	-1				9	1673d	1673d	3/3	1656d	e86caeaead15 cgd(4): Omit technically-correct-but-broken adiantum dependency again.
netbsd boot error: assert failed: locks == curcpu()->ci_biglock_count	-1				2	1675d	1676d	3/3	1656d	a2bbd8e60824 Revert "kern: Sprinkle biglock-slippage assertions."
netbsd boot error: UBSan: Undefined Behavior in node_insert	-1				1	1675d	1675d	3/3	1656d	8d4ad4784038 thmap(9): Handle memory allocation failure in root_try_put.
netbsd boot error: assert failed: ci->ci_ilevel <= IPL_VM	-1				18	1674d	1674d	3/3	1656d	437c9c4e0b76 cgd(4): Remove recently added dependency on adiantum.
MSan: Uninitialized Memory in umcs7840_attach	-1	syz, C			5	1656d	1658d	3/3	1656d	36d5987e481d umcs(4): Avoid using uninitialized data if register read fails.
netbsd boot error: assert failed: curlwp->l_pflag & LP_BOUND	-1				36	1681d	1682d	3/3	1656d	517fa18875c3 entropy(9): Call entropy_softintr while bound to CPU.
netbsd boot error: MSan: Uninitialized Memory in bus_dmamap_sync	-1				177	1728d	1737d	3/3	1673d	9fdc83c65c2c Initialize "replun" -- found with KMSAN.
ASan: Unauthorized Access in umidi_attach	-1	syz, C			69	1688d	2315d	3/3	1685d	9f7e8016feb4 umidi(4): Parse descriptors a little more robustly.
ASan: Unauthorized Access in usbd_get_no_alts	-1	syz, C			4	1773d	2049d	3/3	1686d	4fc17b686835 usbdi(9): Fix usbd_get_no_alts.
assert failed: filter->bf_insn != NULL	-1	syz, C			114	1692d	2270d	3/3	1690d	f9a07bf7167b bpf(4): Handle null bf_insn on free.
UBSan: Undefined Behavior in do_posix_fadvise	-1				1	1691d	1691d	3/3	1690d	0a3e258bc394 posix_fadvise(2): Detect arithmetic overflow without UB.
assert failed: fvp != tvp	-1	syz, C			11	1837d	1837d	3/3	1690d	Don't use genfs_rename_knote() in the "rename foo over hard-link to itself" case, which simply results in removing the "from" name; there are assertions in genfs_rename_knote() that are too strong for that case.
assert failed: !(timo == NUM && intr == false)	-1	syz, C			4	1840d	1840d	3/3	1690d	- microtime -> microuptime - avoid kpause with timeo=0
assert failed: kpreempt_disabled()	-1	syz, C			12	1691d	1691d	3/3	1691d	ae4ad17c1747 tun(4): Fix bug introduced in previous locking change.
assert failed: requested_size > 0 (2)	-1	syz, C			20	1772d	2136d	3/3	1691d	d56fa848ee30 umidi(4): Bail early if no endpoints.
panic: ugen0 at uhub3kernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/kernel/	2				1	1698d	1698d	3/3	1691d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
assert failed: pb->pb_pathcopyuses == NUM	-1	syz, C			3	1761d	1761d	3/3	1691d	848da1ee2abf ccd(4): Only pathbuf_destroy if pathbuf_copyin succeeded.
assert failed: maxblksize > NUM	-1	syz, C			4	1742d	1758d	3/3	1691d	6103caa238dd pad(4): Do harmless, not harmful, integer truncation.
panic: pad3: outputs: 44100Hz, NUM-bit, stereo	2	syz, C			1	1758d	1758d	3/3	1691d	6103caa238dd pad(4): Do harmless, not harmful, integer truncation.
panic: audio0: detached	2				1	1742d	1742d	3/3	1691d	6103caa238dd pad(4): Do harmless, not harmful, integer truncation.
UBSan: Undefined Behavior in vn_open	-1	syz, C			34	1948d	1949d	3/3	1691d	PR/56286: Martin Husemann: Fix NULL deref on kmod load. - No need to set ret_domove and ret_fd in the regular case, they are meaningless - KASSERT instead of setting errno and then doing the NULL deref.
UBSan: Undefined Behavior in sys_lseek	-1	syz, C			2	2230d	2230d	3/3	1691d	d1730a577782 vfs(9): Avoid arithmetic overflow in vn_seek.
assert failed: pb->pb_pathcopy == NULL	-1	syz, C			2	1761d	1761d	3/3	1691d	848da1ee2abf ccd(4): Only pathbuf_destroy if pathbuf_copyin succeeded.
panic: cdce0: could not find data bulk in	2	syz			2	1776d	1777d	3/3	1691d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
assert failed: KERNEL_LOCKED_P()	-1	syz, C			32	1966d	1966d	3/3	1691d	ea2ec439285b autoconf(9): Take kernel lock in a few entry points.
panic: uhidev0: no report descriptor	2	syz			18	1702d	2301d	3/3	1691d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
assert failed: ret == 0	-1	syz, C			6950	1693d	2311d	3/3	1691d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: _bpfattach: out of memory (2)	2				3	1753d	1756d	3/3	1691d	6583daf00fe7 bpf(4): Nix KM_NOSLEEP and prune dead branch.
panic: vfs load failed for `compat_12', error NUM	2				1	1724d	1724d	3/3	1691d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
assert failed: un->un_ops->uno_init	-1	syz, C			72	1701d	1703d	3/3	1691d	ee8fc1216476 usbnet(9): uno_init is now optional.
panic: port NUM (addr NUM) disconnected	2				2	1730d	1758d	3/3	1691d	a977a2e5ca55 tun(4): Reduce lock from IPL_NET to IPL_SOFTNET.
panic: LOCKDEBUG: Mutex error: mutex_vector_enter,517: spin lock held	2	syz, C			3	1936d	1936d	3/3	1691d	a977a2e5ca55 tun(4): Reduce lock from IPL_NET to IPL_SOFTNET.
panic: LOCKDEBUG: Mutex error: mutex_vector_enter,516: spin lock held (2)	2	syz, C			1221	1692d	2319d	3/3	1691d	a977a2e5ca55 tun(4): Reduce lock from IPL_NET to IPL_SOFTNET.
UBSan: Undefined Behavior in ntp_adjtime1.cold	-1	syz			17	1708d	1742d	3/3	1692d	deeafa20c413 ntp(9): Avoid left shift of negative.
panic: mutex_destroy,NUM: uninitialized lock (lock=ADDR, from=ADDR)	2	syz, C			16	1728d	1780d	3/3	1692d	c541dc45f013 auvitek(4): Fix i2c detach if attach failed.
ASan: Unauthorized Access in usbd_fill_iface_data (2)	-1	syz, C			44	1694d	2148d	3/3	1692d	76003ab85971 usb: Parse descriptors a little more robustly.
UBSan: Undefined Behavior in nanosleep1	-1	syz, C			2	1694d	1694d	3/3	1692d	9b26ef97d982 kern: Handle clock winding back in nanosleep1 without overflow.
UBSan: Undefined Behavior in ts2timo (2)	-1	syz, C			9	1696d	1788d	3/3	1692d	4a85d208135c kern: Fix fencepost error in ts2timo overflow checks.
panic: kernel debugging assertion "pserialize_not_in_read_section()" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/ (2)	2				1	1708d	1708d	3/3	1692d	c3efd236bb39 kern: Fix ordering of loads for pid_table and pid_tbl_mask.
panic: todo(ADDR) > MAXPHYS; minphys broken	2	syz, C			98	1696d	2307d	3/3	1692d	e8535b94fbff kern: Use harmless, not harmful, integer truncation in physio.
MSan: Uninitialized Memory in proc_find_lwp_unlocked (3)	-1				2	1780d	1861d	3/3	1692d	c3efd236bb39 kern: Fix ordering of loads for pid_table and pid_tbl_mask.
UBSan: Undefined Behavior in ntp_adjtime1 (2)	-1	syz			4	1701d	1711d	3/3	1692d	1037494fc94a ntp(9): Clamp ntv->offset to avoid arithmetic overflow on adjtime.
UBSan: Undefined Behavior in vn_seek	-1	syz, C			3	1694d	1752d	3/3	1692d	d1730a577782 vfs(9): Avoid arithmetic overflow in vn_seek.
panic: kernel debugging assertion "pserialize_not_in_read_section()" failed: file "/syzkaller/managers/ci2-netbsd-kubsan	2				1	1707d	1707d	3/3	1692d	c3efd236bb39 kern: Fix ordering of loads for pid_table and pid_tbl_mask.
UBSan: Undefined Behavior in ktrace_thread	-1	syz, C			74	1694d	1831d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
netbsd boot error: panic: kmem_intr_free: zero size with pointer ADDR	-1				12	1736d	1736d	3/3	1692d	3d5b3d401fe6 scsi(9): Handle bogus number of LUNs in SCSI_REPORT_LUNS.
UBSan: Undefined Behavior in config_devalloc	-1	syz, C			149	2167d	2285d	3/3	1692d	1c141a083828 autoconf(9): Refuse to consider negative unit numbers in cfdata.
panic: TAILQ_* forw ADDR /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/kern_ktrace.c:LINE	2	syz, C			5	1749d	1784d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
ASan: Unauthorized Access in cryptodev_mop	-1				1	1749d	1749d	3/3	1692d	6bc42b34d483 crypto(4): Refuse count>1 for old CIOCNCRYPTM.
panic: TAILQ_* forw ADDR /syzkaller/managers/ci2-netbsd/kernel/sys/kern/kern_ktrace.c:LINE	2	syz, C			22	1695d	1781d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
ASan: Unauthorized Access in ktrace_thread	-1				1	1768d	1768d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
MSan: Uninitialized Memory in pathbuf_destroy	-1	syz, C			3	1761d	1761d	3/3	1692d	848da1ee2abf ccd(4): Only pathbuf_destroy if pathbuf_copyin succeeded.
panic: genfs: bad op (2)	2	syz, C			6	1693d	1766d	3/3	1692d	292edadd0bae kernfs: Just fail with EOPNOTSUPP, don't panic, on VOP_BMAP.
page fault in ktrace_thread	-1	syz			82	1693d	1788d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
panic: : playback	2	syz, C			1	1742d	1742d	3/3	1692d	6103caa238dd pad(4): Do harmless, not harmful, integer truncation.
panic: TAILQ_PREREMOVE head ADDR elm ADDR /syzkaller/managers/ci2-netbsd/kernel/sys/kern/kern_ktrace.c:LINE	2	syz, C			56	1693d	1831d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
panic: TAILQ_PREREMOVE head ADDR elm ADDR /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/kern_ktrace.c:LINE	2	syz			16	1694d	1825d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
UBSan: Undefined Behavior in adjtime1	-1	syz, C			16	1694d	1737d	3/3	1692d	c7190692f73e kern: Clamp time_adjtime to avoid overflow.
panic: TAILQ_PREREMOVE head ADDR elm ADDR /syzkaller/managers/ci2-netbsd/kernel/sys/kern/kern_ktrace.c:LINEuhub5: device	2				1	1764d	1764d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
MSan: Uninitialized Memory in emdtv_i2c_exec	-1	syz, C			5	2143d	2144d	3/3	1692d	7c75d5789d19 emdtv(4): If register read fails, read as all zero.
MSan: Uninitialized Memory in ktrace_thread	-1	syz, C			450	1693d	1831d	3/3	1692d	e44acb383603 ktrace(9): Avoid stomping over colliding KTROP_SET.
panic: uhidev0: (0x0000) syz (0x0000), rev NUM.NUM/NUM.NUM, addr NUM, iclass NUM/NUM	2				1	1737d	1737d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: l diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/vhci.c	2				1	1768d	1768d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: ugen0: setting configuration index NUM failed	2				2	1742d	1784d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: urtwn0: failed to set configuration, err=IOERROR	2				1	1740d	1740d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhidev0: detached	2				3	1704d	1767d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhub5: device problem, disabling port NUM	2				6	1695d	1779d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: cdce0: faking address	2				1	1713d	1713d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
UBSan: Undefined Behavior in compat_30_sys_getdents	-1	syz, C			3	1697d	1697d	3/3	1693d	11f34addeca0 compat_30: Avoid what might be technically undefined behaviour.
panic: port NUM configuration NUM interface 0kernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers	2	syz			1	1756d	1756d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: device problem, disabling port NUM	2				1	1761d	1761d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: cdce0: detached	2				1	1704d	1704d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhidev0: no input interrupt endpoint	2	syz, C			6	1749d	1782d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhub4: device problem, disabling port NUM	2				7	1712d	1781d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/usb/vhci.c", line NUM	2				1	1765d	1765d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhub3: device problem, disabling port NUM	2				6	1703d	1770d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: (addr NUM) disconnected	2				1	1706d	1706d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhub0: device problem, disabling port NUM	2				8	1694d	1766d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: urtwn0: failed to set configuration, err=TIMEOUT	2				1	1774d	1774d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: [ NUM.ADDR] vpanic() at netbsd:vpanic+0x2d0	2				6	1698d	1853d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: ernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/vh	2				4	1705d	1816d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhub1: device problem, disabling port NUM	2				1	1724d	1724d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
UBSan: Undefined Behavior in bpf_ioctl	-1	syz, C			2	1726d	1726d	3/3	1693d	0c325362987e bpf(4): Clamp read timeout to INT_MAX ticks to avoid overflow.
panic: ernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/usb/vhci.c",	2				1	1756d	1756d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: [ NUM.ADDR] kernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/kernel/sy	2				1	1715d	1715d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: [ NUM.ADDR] vpanic() at netbsd:vpanic+0x9ec	2				2	1703d	1763d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
UBSan: Undefined Behavior in ffs_init_vnode.cold	-1	syz, C			2	1697d	1697d	3/3	1693d	8fa88ee7afc4 ffs: Fix 64-bit inode integer truncation.
UBSan: Undefined Behavior in soreceive (2)	-1				1	1702d	1702d	3/3	1693d	68d507c1cf2c kern: m_copym(M_DONTWAIT) can fail; handle that case gracefully.
panic: ugen0 at uhub4 port 1kernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd/kernel	2				1	1754d	1754d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: [ NUM.ADDR] kernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev	2				2	1768d	1781d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: uhub2: device problem, disabling port NUM	2				2	1696d	1747d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: nostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/vhci.c", lin	2				1	1708d	1708d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
panic: [ NUM.ADDR] kernel diagnostic assertion "ret == NUM" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/	2				1	1749d	1749d	3/3	1693d	b633b22cc948 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
ASan: Unauthorized Access in psignal (2)	-1	syz, C			7	1736d	2097d	3/3	1699d	156c65eb54de usb(4): Use atomics for usb_async_proc.
panic: kernel diagnostic assertion "searchdir != foundobj" failed: file "/syzkaller/managers/ci2-netbsd-	2				1	1751d	1751d	3/3	1723d	feba92b89b21 Remove the assertion "searchdir != foundobj" from lookup_crossmount().
assert failed: searchdir != foundobj	-1	syz, C			2326	1723d	2281d	3/3	1723d	feba92b89b21 Remove the assertion "searchdir != foundobj" from lookup_crossmount().
panic: [ NUM.ADDR] kernel diagnostic assertion "searchdir != foundobj" failed: file "/syzkaller/managers/ci2-netbsd-kms	2				1	1750d	1750d	3/3	1723d	feba92b89b21 Remove the assertion "searchdir != foundobj" from lookup_crossmount().
panic: spkr1 at audio1kernel diagnostic assertion "searchdir != foundobj" failed: file "/syzkaller/managers/ci2-netbsd/k	2				1	1746d	1746d	3/3	1723d	feba92b89b21 Remove the assertion "searchdir != foundobj" from lookup_crossmount().
panic: vfs load failed for `udf', error 2kernel diagnostic assertion "searchdir != foundobj" failed: file "/syzkaller/ma	2				1	1744d	1744d	3/3	1723d	feba92b89b21 Remove the assertion "searchdir != foundobj" from lookup_crossmount().
UBSan: Undefined Behavior in ntp_adjtime1	-1				1	1730d	1730d	3/3	1728d	af0d3919a307 kernel: Avoid arithmetic overflow in ntp_adjtime.
UBSan: Undefined behavior (3)	-1				1	1784d	1784d	3/3	1783d	fafcdc38d472 Use unsigned to avoid undefined behavior. Found by kUBSan.
UBSan: Undefined Behavior in usb_free_device	-1	syz			1	1845d	1845d	3/3	1841d	d021b7463a20 Revert "usb: uhub: remove unnecessary delays when powering on ports"
page fault in __asan_load1	-1				1	1845d	1845d	3/3	1841d	d021b7463a20 Revert "usb: uhub: remove unnecessary delays when powering on ports"
UBSan: Undefined Behavior in pppasyncstart.cold	-1				18	1868d	1890d	3/3	1859d	daf713f1d819 Use unsigned to avoid undefined behavior in pppasyncstart().
panic: _uvm_mapent_check: bad entry ADDR, line 2299	2	syz, C			2	1953d	1953d	3/3	1947d	388be8fd3b90 in uvm_mapent_forkzero(), if the old entry was an object mapping, appease a debug check by setting the new entry offset to zero along with setting the new entry object pointer to NULL.
panic: _uvm_mapent_check: bad entry ADDR, line 1704	2	syz, C			2	1953d	1953d	3/3	1947d	388be8fd3b90 in uvm_mapent_forkzero(), if the old entry was an object mapping, appease a debug check by setting the new entry offset to zero along with setting the new entry object pointer to NULL.
panic: _uvm_mapent_check: bad entry ADDR, line 2306	2	syz, C			37	2021d	2294d	3/3	1947d	388be8fd3b90 in uvm_mapent_forkzero(), if the old entry was an object mapping, appease a debug check by setting the new entry offset to zero along with setting the new entry object pointer to NULL.
panic: genfs: bad op	2	syz, C			31	2025d	2241d	3/3	1950d	e3beb3764561 VOP_BMAP() may be called via ioctl(FIOGETBMAP) on any vnode that applications can open. change various pseudo-fs *_bmap methods return an error instead of panic.
netbsd boot error: UBSan: Undefined Behavior in AcpiNsRootInitialize	-1				120	1979d	1984d	3/3	1979d	d5b984e0de7e avoid dereferencing a constant string address as a UINT32 pointer, KUBSAN complains about bad alignment.
UBSan: Undefined Behavior in ts2timo	-1	syz, C			40	1989d	2346d	3/3	1979d	6f5e84c07140 ts2timo(9): refactor TIMER_ABSTIME handling
assert failed: (cnp->cn_flags & LOCKPARENT) == 0 || searchdir == NULL || VOP_ISLOCKED(searchdir) == LK_EXCLUSIVE (2)	-1	syz, C			1614	1991d	2319d	3/3	1979d	4af96c872b34 Honor LOCKPARENT for ".." of the root directory.
UBSan: Undefined Behavior in free_pipe	-1	syz, C			6	2068d	2138d	3/3	1979d	8c601f6c5ae7 fix free_all_endpoints() to not try calling free_pipe() when no endpoints are allocated; this can happen during config_detach() after attach fails
page fault in free_all_endpoints	-1	syz, C			2	2138d	2138d	3/3	1979d	8c601f6c5ae7 fix free_all_endpoints() to not try calling free_pipe() when no endpoints are allocated; this can happen during config_detach() after attach fails
UBSan: Undefined Behavior in fss_close	-1	syz, C			3	2187d	2198d	3/3	2134d	e5ad6630f80f Check the return value of device_lookup_private against NULL.
UBSan: Undefined Behavior in quota1_handle_cmd_quotaoff	-1	syz, C			22	2145d	2277d	3/3	2135d	479d6bd7aed1 Avoid potentially accessing an array with an index out of range.
UBSan: Undefined Behavior in quota1_handle_cmd_quotaon	-1	syz, C			310	2137d	2282d	3/3	2135d	479d6bd7aed1 Avoid potentially accessing an array with an index out of range.
UBSan: Undefined Behavior in fsetown	-1	syz, C			643	2136d	2320d	3/3	2136d	fe22bed11b62 Avoid negating the minimum size of pid_t (this overflows).
assert failed: semcnt >= 0	-1	syz, C			1460	2146d	2288d	3/3	2146d	d1d48122addb when updating the per-uid "semcnt", decrement the counter for the uid that created the ksem, not the uid of the process freeing the ksem. fixes PR 55509.
UBSan: Undefined Behavior in dosetitimer	-1	syz, C			62	2154d	2155d	3/3	2154d	46944f1c4d5d Fix an uninitialized pointer deref introduced in rev 1.207.
assert failed: ! (2)	-1	syz, C			4	2179d	2179d	3/3	2170d	98e71a6eeb52 When validating the mount device string make sure its length is below *data_len and below PATH_MAX.
panic: Suspending fresh file system failed	2	syz			44	2171d	2206d	3/3	2171d	0b5a6352dcf7 We have to ignore interrupts when suspending here the same way we have to do with revoke.
assert failed: fstrans_is_owner(mp)	-1	syz, C			789	2173d	2281d	3/3	2172d	d8a571076ba6 Suspend file system before unmounting in mount_domount() error path to prevent diagnostic assertions from unmount/flush.
panic: kernel diagnostic assertion "fstrans_is_owner(mp)" failed: file "/syzkaller/managers/netbsd-kmsan/kernel/s	2				1	2225d	2225d	3/3	2172d	d8a571076ba6 Suspend file system before unmounting in mount_domount() error path to prevent diagnostic assertions from unmount/flush.
panic: [ 222.ADDR] kernel diagnostic assertion "fstrans_is_owner(mp)" failed: file "/syzkaller/managers/netbsd-kmsan/ker	2				1	2237d	2237d	3/3	2172d	d8a571076ba6 Suspend file system before unmounting in mount_domount() error path to prevent diagnostic assertions from unmount/flush.
UBSan: Undefined Behavior in ttioctl	-1				1	2296d	2296d	3/3	2172d	bf7b939a1a2d tty: Negating INT_MIN will overflow int, bail out with EINVAL
assert failed: (length != 0 || extblocks || LIST_EMPTY(&ovp->v_cleanblkhd))	-1	syz, C			6	2200d	2296d	3/3	2172d	9235b59ee381 Lock the vnode while calling VOP_BMAP() for FIOGETBMAP.
UBSan: Undefined behavior	-1				8	2206d	2281d	3/3	2172d	ad11505eeb84 tty: Avoid undefined behaviour (left shift of 1 by 31 places overflows int)
panic: kernel diagnostic assertion "fstrans_is_owner(mp)" failed: file "/syzkaller/managers/netbsd-kmsan/kernel	2				1	2227d	2227d	3/3	2172d	d8a571076ba6 Suspend file system before unmounting in mount_domount() error path to prevent diagnostic assertions from unmount/flush.
panic: kernel diagnostic assertion "fstrans_is_owner(mp)" failed: file "/syzkaller/managers/netbsd-kubsan/kernel/sys/ke	2				1	2226d	2226d	3/3	2172d	d8a571076ba6 Suspend file system before unmounting in mount_domount() error path to prevent diagnostic assertions from unmount/flush.
UBSan: Undefined Behavior in compat_43_ttioctl.cold	-1	syz, C			116	2175d	2230d	3/3	2172d	c32467e14928 tty_43: Check a bitset from userspace is valid before shifting it
UBSan: Undefined Behavior in tty_get_qsize	-1	syz, C			19	2256d	2302d	3/3	2254d	699b2c0a0a86 Add a check to prevent shift by -1. Not really important in this case, but to appease KUBSAN.
assert failed: rb_tree_find_node(&ugenif.tree, &sc->sc_unit) == sc	-1	syz, C			8	2265d	2265d	3/3	2264d	257aaf9afb72 Fix ugen detach after partial attach.
ASan: Unauthorized Access in nvlist_copyin	-1	syz, C			2	2290d	2290d	3/3	2264d	17ffbcbdab9a Add missing cases, to prevent memory corruption.
assert failed: 0 <= space && space <= ifc->ifc_len	-1	syz, C			4	2299d	2299d	3/3	2297d	0be10c48cf6f Don't accept negative value.
page fault in statvfs_to_statfs12_copy	-1	syz, C			5	2317d	2317d	3/3	2316d	f2af77cb3adc Yet another idiotic compat syscall that was developed with literally zero test made. Simply invoking this syscall with _valid parameters_ triggers a fatal fault, because the kernel tries to write to userland addresses.
page fault in usbd_add_drv_event	-1	syz, C			2	2317d	2317d	3/3	2316d	6cac1dde29fb Fix NULL deref on attach failure. Found via vHCI fuzzing.
UBSan: Undefined Behavior in pipe_ioctl	-1	syz, C			1	2319d	2319d	3/3	2316d	60b6b2cd7463 Fix NULL deref. The original code before Jaromir's cleanup had an #ifndef block that wrongly contained the 'else' statement, causing the NULL check to have no effect.
ASan: Unauthorized Access in m_copydata	-1	syz, C			1	2320d	2320d	3/3	2319d	305ae8585db2 Ensure sockaddrs have valid lengths for RO_MISSFILTER.
assert failed: (cnp->cn_flags & LOCKPARENT) == 0 || searchdir == NULL || VOP_ISLOCKED(searchdir) == LK_EXCLUSIVE	-1	syz, C			2815	2319d	2368d	3/3	2319d	3e5fbb6583a3 remove special handling for symbolic links for COMPAT_43 lstat, it's not necessary; this removes the only places in kernel which did namei LOOKUP with LOCKPARENT
UBSan: Undefined Behavior in tunwrite	-1	syz, C			5	2320d	2320d	3/3	2320d	521e747162a6 Hum. Fix NULL deref triggerable with just write(0).
assert failed: p != NULL	-1				1	2419d	2419d	3/3	2336d	3c214a3d995e Fix bohr bug triggered only once by syzkaller 2,5 months ago.
UBSan: Undefined Behavior in db_read_bytes	-1				1	2339d	2339d	3/3	2338d	0f48bfb53e25 If the frame is not aligned, leave right away. This place probably needs to be revisited, because %rbp could easily contain garbage.
netbsd boot error: MSan: Uninitialized Memory in pmap_ctor	-1				60	2343d	2347d	3/3	2342d	248fe10b7a27 Reported-by: syzbot+6dd5a230d19f0cbc7814@syzkaller.appspotmail.com
panic: LOCKDEBUG: Mutex error: mutex_vector_enter,516: spin lock held	2	syz, C			95	2342d	2362d	3/3	2342d	134b16ca64ab Reported-by: syzbot+c1770938bb3fa7c085f2@syzkaller.appspotmail.com Reported-by: syzbot+ae26209c7d7f06e0b29f@syzkaller.appspotmail.com
ASan: Unauthorized Access in usbd_fill_iface_data	-1	syz, C			5	2343d	2344d	3/3	2342d	3774168381e9 If we failed because we didn't encounter an endpoint, do not attempt to read 'ed', because its value is past the end of the buffer, and we thus perform out-of-bounds accesses.
panic: kmem_intr_free: zero size with pointer ADDR	2	syz, C			1	2343d	2343d	3/3	2342d	39045d90bd43 also set ifc->ui_endpoints to NULL in usbd_free_iface_data() when the value is freed, to make it impossible to re-enter this by mistake
UBSan: Undefined Behavior in process_read_fpregs	-1	syz, C			2	2350d	2350d	3/3	2342d	4660020b03f4 Introduce PTRACE_REGS_ALIGN, and on x86, enforce a 16-byte alignment, due to fpregs having fxsave which requires 16-byte alignment.
ASan: Unauthorized Access in usb_free_device	-1	syz, C			3	2343d	2343d	3/3	2342d	869e8f7b28b0 Reset ud_ifaces and ud_cdesc to NULL, to prevent use-after-free in usb_free_device().
assert failed: pmap->pm_ncsw == lwp_pctr() (2)	-1				4	2345d	2347d	3/3	2342d	2ac4ea76ffcd Reported-by: syzbot+fd9be59aa613bbf4eba8@syzkaller.appspotmail.com Reported-by: syzbot+15dd4dbac6ed159faa4a@syzkaller.appspotmail.com Reported-by: syzbot+38fa02d3b0e46e57c156@syzkaller.appspotmail.com
assert failed: !pmap_extract(pmap, va, NULL)	-1	syz			1	2419d	2419d	3/3	2356d	4cd60295b346 Reported-by: syzbot+3e3c7cfa8093f8de047e@syzkaller.appspotmail.com
panic: LOCKDEBUG: Mutex error: mutex_vector_enter,512: locking against myself	2	syz, C			52	2356d	2362d	3/3	2356d	fbbe5c9112a1 Reported-by: syzbot+0f38e4aed17c14cf0af8@syzkaller.appspotmail.com Reported-by: syzbot+c1770938bb3fa7c085f2@syzkaller.appspotmail.com Reported-by: syzbot+92ca248f1137c4b345d7@syzkaller.appspotmail.com Reported-by: syzbot+acfd688740461f7edf2f@syzkaller.appspotmail.com
MSan: Uninitialized Memory in ifq_enqueue	-1				1	2360d	2360d	3/3	2360d	145523e8345f igmp_sendpkt() expects ip_output() to set 'imo.imo_multicast_ttl' into 'ip->ip_ttl'; but ip_output() won't if the target is not a multicast address, meaning that the uninitialized 'ip->ip_ttl' byte gets sent to the network. This leaks one byte of kernel heap.
MSan: Uninitialized Memory in nanosleep1	-1	syz, C			8	2375d	2409d	3/3	2360d	d9377f809390 Fix uninitialized memory access. Found by KMSAN.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/arch/x86/x86/intr.c:LINE, member access	-1				15	2372d	2374d	3/3	2370d	37beba86ee63 Explicitly align to 8 bytes, found by kUBSan.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/vfs_cache.c:LINE, left shift of AD	-1				36	2412d	2413d	3/3	2405d	395a577cab63 Pacify a syzbot complaint about bit shifting.
assert failed: pmap->pm_stats.resident_count == PDP_SIZE	-1	syz			22	2416d	2417d	3/3	2416d	398f36d55ce0 PR port-amd64/55083 (assertion "pmap->pm_stats.resident_count == PDP_SIZE" failed)
assert failed: ptp->wire_count == 1	-1	syz, C			16	2417d	2418d	3/3	2417d	4538c4a0a4c9 Pacify assertion in a failure path.
assert failed: (opte & (PTE_A | PTE_P)) != PTE_A	-1	syz, C			15	2418d	2420d	3/3	2418d	4f0135d6fae3 - pmap_enter(): under low memory conditions, if PTP allocation succeeded and then PV entry allocation failed, PTP pages were being freed without their struct pmap_page being reset back to the non-PTP setup, which then caused havoc with pmap_page_removed(). Fix it.
panic: pmap_check_pv: ADDR/ADDR missing on pp ADDR	2	syz			60	2418d	2418d	3/3	2418d	4f0135d6fae3 - pmap_enter(): under low memory conditions, if PTP allocation succeeded and then PV entry allocation failed, PTP pages were being freed without their struct pmap_page being reset back to the non-PTP setup, which then caused havoc with pmap_page_removed(). Fix it.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/vfs_mount.c:LINE, member access wi	-1				1446	2428d	2504d	3/3	2427d	431ed6f61bc2 - Pad kmem cache names with zeros so vmstat -m and -C are readable. - Exclude caches with size not a factor or multiple of the coherency unit. 4c7232d4a136 KMEM_SIZE: append the size_t to the allocated buffer, rather than prepending, so it doesn't screw up the alignment of the buffer.
ASan: Unauthorized Access in ifreq_setaddr	-1	syz, C			6	2493d	2493d	3/3	2428d	36f08dfcb97c Don't forget to initialize 'sin6_len'. With kASan, from time to time the value will be bigger than the size of the source, and we get a read overflow. With kMSan the uninitialized access is detected immediately.
MSan: Uninitialized Memory in getsockopt	-1	syz, C			37	2442d	2443d	3/3	2428d	559c53d028d6 Zero out 'tv', to prevent uninitialized bytes in its padding from leaking to userland. Found by kMSan.
assert failed: l->l_stat == LSONPROC	-1	syz, C			645	2439d	2453d	3/3	2428d	f61617cee78c exit1(): remove from the radix tree before setting zombie status, as radix_tree_remove_node() can block on locks when freeing.
ASan: Unauthorized Access in mutex_oncpu	-1	syz, C			24521	2428d	2489d	3/3	2428d	e78f9b4fde02 A final set of scheduler tweaks:
MSan: Uninitialized Memory in bus_dmamap_sync	-1	syz, C			16	2438d	2443d	3/3	2428d	b1f6fd939ed8 Zero out the padding in 'd_namlen', to prevent info leaks. Same logic as ufs_makedirentry().
assert failed: ci->ci_tlbstate != TLBSTATE_VALID	-1	syz, C			123	2511d	2512d	3/3	2444d	ea92f12b1800 uvm_pagerealloc() can now block because of radixtree manipulation, so defer freeing PTPs until pmap_unmap_ptes(), where we still have the pmap locked but can finally tolerate context switches again.
assert failed: pmap->pm_ncsw == curlwp->l_ncsw	-1	syz, C			30	2511d	2512d	3/3	2444d	ea92f12b1800 uvm_pagerealloc() can now block because of radixtree manipulation, so defer freeing PTPs until pmap_unmap_ptes(), where we still have the pmap locked but can finally tolerate context switches again.
assert failed: pmap->pm_ncsw == lwp_pctr()	-1				2	2504d	2508d	3/3	2444d	680f3a8667de pmap_get_ptp(): the uvm_pagefree() call in the failure case can block too. Pacify the assertion in pmap_unmap_ptes().
assert failed: pg->offset >= nextoff	-1	syz, C			10	2509d	2511d	3/3	2444d	3f49a1ff579b genfs_do_putpages(): add a missing call to uvm_page_array_advance().
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/init_main.c:LINE, left shift of AD	-1				9	2505d	2505d	3/3	2444d	1e5952fd4837 Fix integer overflow when printing available memory size (resulting from a cast lost during merges).
netbsd boot error: panic: LOCKDEBUG: Mutex error: _mutex_init,363: already initialized	-1				51	2509d	2510d	3/3	2444d	dc1bd2c9382b Fix LOCKDEBUG panic on mutex_init().
assert failed: lwp_locked(l, l->l_cpu->ci_schedstate.spc_lwplock)	-1	syz, C			2676	2532d	2533d	2/3	2529d	lwp_start(): don't try to change the target CPU. Fixes potential panic in setrunnable(). Oops, experimental change that escaped.
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/netinet/tcp_congctl.c:LINE, unsigned in	2	syz			28	2538d	2550d	2/3	2538d	1f03898791a3 Don't allow zero sized segments that will panic the stack. Reported-by: syzbot+5542516fa4afe7a101e6@syzkaller.appspotmail.com
ASan: Unauthorized Access in __asan_load8	-1	syz			39	2542d	2661d	2/3	2540d	9ea67c54e50f in uvm_fault_lower_io(), fetch all the map entry values that we need before we unlock everything.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:LINE, me	-1				114	2559d	2562d	2/3	2540d	41eeee0166bf Get &rsc->sc_dksc only when we know 'rsc' is not NULL. This was actually harmless because we didn't use the pointer then.
panic: m_copydata(ADDR,2,48,ADDR): m=NULL, off=0 (48), len=2 (0)	2	syz, C			3	2545d	2545d	2/3	2540d	624f3f7406ee Add more checks in ip6_pullexthdr, to prevent a panic in m_copydata. The Rip6 entry point could see a garbage Hop6 option.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/arch/x86/x86/pmap.c:LINE, member access	-1				6	2540d	2541d	2/3	2540d	4acdfa6ced5b Add a NULL check on the structure pointer, not to retrieve its first field if it is NULL. The previous code was not buggy strictly speaking. This change probably doesn't change anything, except removing assumptions in the compiler optimization passes, which too probably doesn't change anything in this case.
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_disk_mbr.c:LINE, member acces	-1				135	2551d	2555d	2/3	2540d	4e5cb50b58af Avoid unaligned pointer arithmetic in check_label_magic()
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/vfs_subr.c:LINE, member access wit	-1				99	2541d	2550d	2/3	2540d	473e202ba108 NULL-check the structure pointer, not the address of its first field. This is clearer and also appeases syzbot.
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/uipc_socket.c:LINE, null pointer p	2	syz, C			3	2578d	2586d	2/3	2573d	7b43da9e77aa Add a check before the memcpy. memcpy is defined to never take NULL as second argument, and the compiler is free to perform optimizations knowing that this argument is never NULL.
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/net/rtsock_shared.c:LINE, shift exponen	2	syz, C			91	2574d	2578d	2/3	2573d	a1bd50f5a7d5 Error out if the type is beyond the storage size. No functional change, since the shift would otherwise 'and' against zero, returning EEXIST.
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/sys_ptrace_common.c:LINE, negation	2	syz, C			2	2577d	2577d	2/3	2575d	c18c9a670f07 Avoid signed integer overflow for -lwp where lwp is INT_MIN
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/kern_time.c:LINE, signed integer o	2	syz, C			3	2582d	2583d	2/3	2582d	8e3fd5b6989c Check for valid timespec in clock_settime1()
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_time.c:LINE, signed integer o	2	syz, C			2	2584d	2584d	2/3	2583d	ffd5d3e30b5f Avoid signed integer overflow in ts2timo() for ts->tv_nsec
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/uvm/uvm_mmap.c:LINE, left shift of 1 by	2	syz, C			2	2583d	2583d	2/3	2583d	6c69d9fad1ca Avoid left shift changing the signedness flag
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/sysv_msg.c:LINE, negation of -ADDR	2	syz, C			2	2583d	2583d	2/3	2583d	fa6363e63652 Avoid -LONG_MIN msgtyp in msgrcv(2) and treat it as LONG_MAX
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/crypto/nist_hash_drbg/nist_hash_drbg.c:	-1				39	2598d	2599d	2/3	2585d	338a6d8211a1 Use an explicit run-time assertion where compile-time doesn't work.
panic: ifmedia_add: can't malloc entry	2				28	2586d	2663d	2/3	2586d	0ab44a811f8a in ifmedia_add(), use a wait-style memory allocation rather than not waiting and panic'ing if the allocation fails.
page fault in __asan_load8	-1	syz, C			4	2588d	2619d	2/3	2586d	db38f3713d52 in shmdt(), wait until shmat() completes before detaching.
page fault in shm_delete_mapping	-1	syz			17	2721d	2733d	2/3	2586d	db38f3713d52 in shmdt(), wait until shmat() completes before detaching.
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/kern_rndq.c:LINE, negation of -ADD	2				9	2590d	2596d	2/3	2588d	1c7f0224e7e0 Do all delta calculations strictly using uint32_t. Avoid integer overflows in calculating absolute deltas by subtracting the right way around.
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/net/rtsock_shared.c:LINE, member access	2				1	2595d	2595d	2/3	2594d	00ccc35339cc Disable __NO_STRICT_ALIGNMENT on amd64/i386 for UBSan builds
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/netinet6/scope6.c:LINE, member access w (2)	2	syz			91	2594d	2597d	2/3	2594d	00ccc35339cc Disable __NO_STRICT_ALIGNMENT on amd64/i386 for UBSan builds
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/sys_select.c:LINE, signed integer	2	syz, C			2	2597d	2597d	2/3	2597d	7049e5e68831 Validate usec ranges in sys___select50()
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/netinet6/scope6.c:LINE, member access w	2	syz			73	2597d	2598d	2/3	2597d	a5df2084c7a4 Decorate in6_clearscope() with __noubsan
panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/vfs_syscalls.c:LINE, signed intege	2	syz, C			11	2597d	2598d	2/3	2597d	43bc9355ea3c Validate usec ranges in do_sys_utimes()
netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_percpu.c:LINE, null pointer p	-1				12	2599d	2600d	2/3	2598d	360cafb4be56 Decorate percpu_cpu_swap() with __noubsan
assert failed: buflen != 0	-1	syz			18	2605d	2605d	1/3	2605d	75eea5b7359a As I suspected, the KASSERT I added yesterday can fire if we try to process zero-sized packets. Skip them to prevent a type confusion that can trigger random page faults later.
assert failed: (c->c_flags & CALLOUT_PENDING) == 0	-1	syz, C			2918	2668d	2806d	1/3	2606d	80a06cecc711 Fix race in timer destruction.
assert failed: c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c	-1	syz, C			247	2666d	2806d	1/3	2624d	80a06cecc711 Fix race in timer destruction.
assert failed: to_ticks >= 0 (2)	-1	syz, C			70	2679d	2738d	1/3	2624d	4952945bc9cb Clamp tcp timer quantities to reasonable ranges.
assert failed: pg->wire_count != 0 (2)	-1	syz, C			174	2668d	2690d	1/3	2624d	95ce9a69b407 fix two bugs reported in https://syzkaller.appspot.com/bug?id=8840dce484094a926e1ec388ffb83acb2fa291c9
assert failed: pg->wire_count > 0	-1	syz, C			6	2791d	2804d	1/3	2624d	6eb7fd2b53ce Acquire shmseg uobj reference while we hold shm_lock.
assert failed: uvm_page_locked_p(pg)	-1	syz, C			44	2668d	2678d	1/3	2668d	b5e559801c7e Add missing lock around pmap_protect. ok, chs@
panic: LOCKDEBUG: Reader / writer lock error: rw_vector_exit,449: not held by current LWP	2	syz, C			3	2682d	2683d	1/3	2680d	e4c2eafeb5ab Fix bug, don't release the reflock if we didn't take it in the first place. Looks like there are other locking issues in here.
ASan: Unauthorized Access in exec_makepathbuf	-1	syz			2	2689d	2689d	1/3	2684d	abb1684df1f5 Fix buffer overflow. It seems that some people need to go back to the basics of C programming.
page fault in uvm_fault	-1	syz, C			2	2690d	2690d	1/3	2690d	00dad9ea5158 Correct wrong type of uio_seg passed to do_sys_mknodat()
assert failed: !	-1				2	2690d	2690d	1/3	2690d	00dad9ea5158 Correct wrong type of uio_seg passed to do_sys_mknodat()
assert failed: pmap->pm_obj[i].uo_npages == 0	-1	syz, C			58	2720d	2800d	1/3	2691d	in uvm_map_protect(), do a pmap_update() before possibly switching from removing pmap entries to creating them. this fixes the problem reported in https://syzkaller.appspot.com/bug?id=cc89e47f05e4eea2fd69bcccb5e837f8d1ab4d60
assert failed: pg->wire_count != 0	-1	syz, C			45	2723d	2787d	1/3	2691d	shmctl(SHM_LOCK) does not need to mess with mappings of the shm segment, uvm_obj_wirepages() is sufficient. this fixes the problem reported in https://syzkaller.appspot.com/bug?id=71f9271d761f5b6ed517a18030dc04f0135e6179
assert failed: mutex_owned(pipe->pipe_lock)	-1				39	2744d	2804d	1/3	2736d	7abfdd368b0d Clean up pipe structure before recycling it.
assert failed: to_ticks >= 0	-1	syz, C			2547	2756d	2805d	1/3	2756d	797b68a5c224 Add more checks, if the values are negative we hit a KASSERT later in the timeout.
ASan: Unauthorized Access in vioscsi_scsipi_request	-1	syz			1841	2757d	2794d	1/3	2757d	b60093a0824f Fix use-after-free. If we're not polling, virtio_enqueue_commit() will send the transaction, and it means 'xs' can be immediately freed. So, save the value of xs_control beforehand.
panic: receive 3	2	syz, C			5	2798d	2806d	1/3	2770d	c78c83f0efb3 Also check for MT_CONTROL, and end the receive operation if we see one. It is possible to get an MT_CONTROL if we sleep in MSG_WAITALL. The other BSDs do the same.
assert failed: vp->v_usecount != 0	-1	syz, C			108	2789d	2805d	1/3	2789d	713042b84b5e Take a reference on ndp->ni_rootdir and ndp->ni_erootdir.
assert failed: vp->v_type == VREG	-1	syz, C			139	2794d	2805d	1/3	2794d	21e56f354bb4 Change vn_openchk() to fail VNON and VBAD with error ENXIO.
assert failed: vp->v_type == VREG || vp->v_type == VDIR	-1	syz, C			1085	2794d	2806d	1/3	2794d	21e56f354bb4 Change vn_openchk() to fail VNON and VBAD with error ENXIO.
assert failed: c->c_magic == CALLOUT_MAGIC	-1	syz, C			1645	2805d	2806d	1/3	2798d	The callout is used by any nonvirtual timer including CLOCK_MONOTONIC and needs to be initialized.
assert failed: so->so_lock == NULL	-1	syz, C			5	2803d	2805d	1/3	2803d	516d295318eb Fix locking: it is fine if the lock is already key_so_mtx, this can happen in socketpair. In that case don't take it.
assert failed: so->so_pcb == NULL	-1	syz, C			6	2804d	2805d	1/3	2804d	fa4f0f367829 Fix the order in udp6_attach: soreserve should be called before in6_pcballoc, otherwise if it fails there is still a PCB attached, and we hit a KASSERT in socreate. In !DIAGNOSTIC this would have caused a memory leak.
assert failed: requested_size > 0	-1	syz, C			19	2805d	2806d	1/3	2805d	09915c34c237 Reading a directory may trigger a panic when the buffer is too small. Adjust necessary checks.
ASan bug (2)	-1	syz, C			347	2805d	2805d	1/3	2805d	d020c71c0cee RIP6, CAN, SCTP and SCTP6 lack a length check in their _send() functions. Fix RIP6 and CAN, add a big XXX in the SCTP ones.
ASan bug	-1	syz, C			302	2805d	2806d	1/3	2805d	d26f60da72b3 RIP, RIP6, DDP, SCTP and SCTP6 lack a length check in their _connect() functions. Fix the first three, and add a big XXX in the SCTP ones.