last executing test programs: 1.488221482s ago: executing program 1 (id=2): r0 = syz_open_pts() setsid() r1 = socket(0x18, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000080)={0x1c, 0x18, 0x3, 0xfffd, '\x00', 0x400a}, 0x1c) close(0x3) r2 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$WSMUXIO_REMOVE_DEVICE(r2, 0x80085762, &(0x7f0000000340)={0x3, 0x1}) ioctl$TIOCSCTTY(r0, 0x20007461) ioctl$TIOCCBRK(r0, 0x2000747a) 1.472919211s ago: executing program 6 (id=7): bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x3, "ff010100", 0x3}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = socket(0x18, 0xc003, 0x3a) setsockopt(r0, 0x29, 0x68, &(0x7f00000000c0), 0x0) setuid(0xee01) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffe}, {0x2, 0x0, 0x0, 0xffffffff}, {0x7f, 0x0, 0x0, 0xbbf}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x49}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0xff0a, 0x0, 0x37) r1 = socket(0x18, 0x3, 0x80) setsockopt(r1, 0x1000000029, 0x2e, 0x0, 0x0) r2 = openat$dri(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/dri/card0\x00', 0x10000, 0x0) writev(r2, &(0x7f0000001a40)=[{&(0x7f0000001180)="32ba99e7df18c47900f908c51417f5f63c268d28c52f6047ca0a2c511990733ad38a861bffd2ce5ea78c4c26807244cc47d282f2be62eaf86f8c2f8fed781dc52fd12ff2c7131409678aa43a0fdc3a845253c5f601c1ae18b5f8211ea37c637bfb08878f37cdc528b00a43f3ea6cb5f1be2c2ebe98216b6d360e0129551240df40673309c5cd507c8815a452df64d53b4b7ddc955bb9e4f4084ca8b04a219fe324386e6b43b6d06418d73991cedeca1e17b8efe67b8a67c79a865394ab05eb731acd494e9a5fe64f70313010e25ac4671e96481d530efa408d1b4895f20ffcd8fed1b36486b8d31723b3fd0bda8fe1ad99e61935e1541f3c1e2c77a9e0043531a3f6a19b12f5afc384803639e3ecb1da27e08f265163c743868de799d748a32327b99baeec24b41910ef6b2309e76e431e1fdbae5842fb405839e63e3c205c67bc1b194796d710dbce6562c56390fd5a85997f02413a7eaa41bbd92c1c19bb69835c560cb2bfd5a2a1fa187837cc1d966f958da934b94daa92809d3b7327230ef65680c1fb5d3b34017da0294086a29d7c0988eb19eeb25a8a9dbc944b37a89a069456ed4c8ee22079630dcb1839505a36a2e1e33c63f19427f3adf3d7196916a5f99123397f346de8469c96219936db8efbfe04c5d3d8f60bc03eace34cbc47ba6b8db9d4830928d2c5e6a7b0e2bafcd6065226f37690f7ab18348ce06199d634131e47711ef818aa42863bc9fa94d9f2316e4b8ac9b1123e8ae14208dcc8d1c56df5d1465ac725b50cbf6b3da2adb850c0e4bde035c234a8088f8ae0a602285e8d90d7690dd2d5832d3f6c3dccb35861b2496fae7f9fe4f34cc0c8e4152930141f805f1b06b47ea44980ee431110f78f11851c3c13069facce4b3109ab06f120f5b08d7b0318f436dea61daeb8f46be079493f24e556aac1310c8ea25d4cd26eabfb50ff2ef71ae52ed8cc7185bcfaedcc8a57aefba797199a81b0477cb54c75bd3118b0028ba19e6ae6985f8c0b2842d4b82944a4ed6a7be970f2a961797743c204c4d2164f600baf121d10b98708c49700e973b87811747b7530c94fc6df34457296ddc4dba8cfe4a9026aaa80b1", 0x310}], 0x1) ioctl$DIOCRDELTABLES(0xffffffffffffffff, 0xc450443e, &(0x7f0000000d00)={{'./file0\x00', './file0\x00', 0xa, 0x8}, &(0x7f0000000300)=[{'./file0aaaaaaaaaaaaaaaaaaaaaaaaa\x00', './file0aaaaaaaaaaaaaaaaaaaaaaaaa', 0x2a, 0x3}, {'./file0\x00', './file1\x00', 0xa, 0x7}], 0x2, 0x2, 0x2, 0x6, 0x8, 0xe20e, 0x50, 0x8001}) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSETA(r3, 0xcd604404, &(0x7f0000000080)={0x1, 0x2, 0xa, 0x2f, "201800000000e6622581d2717b11160000001000", 0x6, 0x80b}) setitimer(0x2, &(0x7f0000000380)={{0x0, 0x3}, {0x0, 0x8}}, 0x0) r4 = socket$inet6(0x18, 0x2, 0x3) recvfrom$inet6(r4, &(0x7f0000000180)=""/188, 0xbc, 0x3840, &(0x7f0000000140)={0x1c, 0x18, 0x1, 0x1, "3fe390ed272b239f810e6b061a416c3c"}, 0x1c) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000080)="4dbc4aa422eb059753bd3d81044058111f2599989f800b8a7e4ee3cd2bdd13716dfd44287575d8a49d891da01d137414c84890add39fda18f7ade5b63afbea28cac6a260407038dfb98157d12facbf65a3ccfc0877ca80c243e4038f1dc4d0eaa637e57f86e0edfdc78d6c4826a5c91cfa3c7b112494", 0x76}, {&(0x7f0000000240)="d5a336c034b3038fffa32291c9ea7a4ebf5ad73c3349bc8752cd63695b1827a75500cf050554d2618cccdeae3ec376d4c828f12a5002d0a34897431c9b242bbb328fe33a8151b7591f864d0475e04f1a2afaa23f27d1a28ae7157164fa0a8d879a2374ca947610484ea33f52a1d856310caba39c32323ba7fa9d910a548c5efab1edf178df9e986b40b348", 0x8b}, {&(0x7f0000000300)="512192863ba56f5ce9e53185c182b9446b0a5d28b09c13565747938767cdec4a5703d6d1828566ebfe04e4ec60ef60ab453b595cbe3d836b72272b80cba27b9aca59df6e420901dbffa04c70f6c37b1d62ae4f09f8ac0b9646da8386d39791464bbd2ffda19875b95845baf29b586dd426c55e7055ea42f44eada13f774c5566c1b1ff1d5e7a69fbc647e6817335a1ba611c6f859605e8f82b294c5e4fde453368ea03732a7dbe7eeaf2fae03730da30b838eb2f5d9f", 0xb6}, {&(0x7f00000003c0)="c06f3e712fa56784a5c4d77f32b8e997b8082d955c0476948b338b11f640fe23401ea68dae96a16e26f42e28cbdc3d7e5538394f7415a4db96159c99cac755d2bdb666a4ab4cc0c9d436cb47443e0a173e6c4bc83577724edcc6962b360de101f3413d22a93d9812cbc2994ec3a27fa5fb0f", 0x72}], 0x4) open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0xd6) ktrace(&(0x7f0000000180)='./file0\x00', 0x4, 0x51d73188af82c397, 0xffffffffffffffff) ktrace(&(0x7f0000000080)='./file0\x00', 0x0, 0x8, 0xffffffffffffffff) sendto(0xffffffffffffffff, 0x0, 0x0, 0x409, &(0x7f0000000000)=@in6={0x1c, 0x18, 0x3, 0x69f2, "073b8b803a78988ff72fcf2e00", 0x7}, 0x1c) 1.467549177s ago: executing program 3 (id=4): r0 = socket(0x2, 0x4001, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1, &(0x7f0000000080)=0x1fc, 0x4) shutdown(r0, 0x2) (async) chdir(&(0x7f0000000000)='.\x00') sysctl$hw(&(0x7f0000000000)={0x6, 0x2}, 0x2, 0x0, 0x0, &(0x7f0000000040), 0x0) (async) syz_emit_ethernet(0xce, &(0x7f00000001c0)={@broadcast, @random, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x17, 0xc0, 0x64, 0x0, 0x0, 0x1, 0x0, @broadcast, @multicast1}, @icmp=@time_exceeded={0xb, 0x1, 0x0, 0x0, 0x6, 0x0, {0x29, 0x4, 0x1, 0x1c, 0x2, 0x66, 0x0, 0xdc, 0x2f, 0x4, @local={0xac, 0x14, 0x0}, @broadcast, {[@ssrr={0x89, 0x2b, 0x0, [@multicast2, @loopback, @loopback, @broadcast, @local={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}, @remote={0xac, 0x14, 0x0}, @loopback, @multicast2, @broadcast]}, @rr={0x7, 0x13, 0x6, [@rand_addr=0x2, @broadcast, @local={0xac, 0x14, 0x0}, @rand_addr]}, @lsrr={0x83, 0x2b, 0x25, [@multicast1, @empty, @broadcast, @remote={0xac, 0x14, 0x0}, @remote={0xac, 0x14, 0x0}, @rand_addr=0x7, @multicast2, @broadcast, @remote={0xac, 0x14, 0x0}, @remote={0xac, 0x14, 0x0}]}, @rr={0x7, 0x13, 0xc4, [@rand_addr, @multicast1, @broadcast, @local={0xac, 0x14, 0x0}]}, @generic={0x82, 0x11, "a7e00294a35054e0004408d13d3a00"}]}}}}}}}) 1.454564777s ago: executing program 7 (id=8): ioctl$DIOCRCLRTSTATS(0xffffffffffffffff, 0xc4504441, &(0x7f0000000040)={{'./file0\x00', './file0\x00', 0x55, 0x13}, 0x0, 0x428, 0x0, 0x8c, 0xb, 0x40003fc, 0x200005, 0x0, 0xf}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x8, 0x0) r1 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f00000004c0), 0x80, 0x0) setsockopt$inet_opts(r1, 0x0, 0x1, &(0x7f0000000500)="27b95c2606637ad01e06334987b9749671ee3483fa69da52cea7d08194414b4abbd97a67ce366242a5ef3dd8ede88b0dccee2a4ce8cf", 0x36) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r3 = getpgrp() fcntl$setown(r2, 0x6, r3) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000000)={'tap', 0x0}) ioctl$TIOCSETA(r0, 0xc450443f, &(0x7f0000000040)={0x102f, 0x2, 0xfffffffe, 0x4, "21bec3177000", 0x6, 0x3}) syz_emit_ethernet(0x102, &(0x7f0000000540)={@broadcast, @empty, [{}], {@ipv6={0x86dd, {0x2, 0x6, '\r(d', 0xc8, 0x2, 0xd, @mcast2, @rand_addr="15e3acb316ac8c54fb67cf543fcd5846", {[@fragment={0x1d, 0x0, 0xb7, 0x1, 0x0, 0x1f, 0x66}], @udp={{0x2, 0x1, 0x8}, {"0da62867fdd42424738d181ffc76b90bd55052af6db91921ae39a33c923dec04cab4eecaab9e137c78d23a47c96a05b88f19ed7584f7f8f98bc4bcd56fb31e622ac42504978f57baf30f8fe96d7c17578e8bc2fdccd42075c0fe9415673d04df92a96e44a305bcdd758e8504d3c392006e9d5813fb13c913c98654accb00b6d38dd3213e0859a29c005ee873e58a8cef79622a15ca6aac85ca6b9cc3e4cb060f57fe2e114f2a140f39f3aab1cd7f66177dcb53fef6fde7fa"}}}}}}}) 327.100477ms ago: executing program 6 (id=9): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000740), 0x40, 0x0) ioctl$DIOCRCLRADDRS(r0, 0xc4504442, &(0x7f0000001080)={{'./file0\x00', './file0\x00', 0x0, 0x2}, 0x0, 0x0, 0x0, 0x3, 0x1, 0x6, 0x0, 0x2, 0x4}) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) msync(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0x2, 0x0, 0x0, 0x0, 0xc4, 0x9a43, 0x10}, 0x10, 0x3, 0x8, 0xff, 0x2, 0x2, 0xfffffffffffffffe, 0x6, 0x0, 0xfffffffffffffff9}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0xd02) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$BIOCSETIF(r1, 0x80086d01, &(0x7f0000000400)={'tap', 0x0}) semget(0x0, 0x1, 0x601) 326.500962ms ago: executing program 6 (id=10): mknod(&(0x7f0000000100)='./file0\x00', 0x2000, 0x1e5f) r0 = open(&(0x7f0000000040)='./file0\x00', 0x80, 0x95) sysctl$kern(&(0x7f0000000000)={0x1, 0x10}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$WSKBDIO_SETMAP(r1, 0x8010570e, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x7, 0xff10, 0x8, 0xcd2, 0x80}]}) ioctl$BIOCSETWF(r0, 0x80184404, &(0x7f0000000000)={0xffffffffffffffa0, 0x0}) r2 = open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x0) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x1, 0x2010, r2, 0x0) madvise(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x2) sendsyslog(&(0x7f0000004240)="3c2b3c7be607", 0x6, 0x26) chmod(&(0x7f0000000040)='.\x00', 0x34b) setuid(0xee01) r3 = open(&(0x7f0000000100)='./file0\x00', 0x400, 0x40) openat(r3, &(0x7f00000001c0)='./file0\x00', 0x0, 0x63) socketpair(0x20, 0x5, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000001e00)=0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000240), 0x20, 0x0) setresgid(r8, r8, r8) semctl$IPC_SET(r5, 0x0, 0x1, &(0x7f0000000780)={{0x0, r8, r7, r8, 0x8f, 0x6}, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x200000000005}) getsockopt$SO_PEERCRED(0xffffffffffffff9c, 0xffff, 0x1022, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0xc) setsockopt$sock_cred(r4, 0xffff, 0x1022, &(0x7f00000000c0)={0x0, r7, r9}, 0xc) unveil(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='x\x00') 326.338149ms ago: executing program 4 (id=5): syz_emit_ethernet(0x2a, &(0x7f00000000c0)={@empty, @random="d480d5968f29", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x17, 0x1c, 0x66, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x0}, @multicast1}, @icmp=@generic={0x24, 0x4, 0x0, "4eba15b4"}}}}}) syz_extract_tcp_res(&(0x7f0000000000), 0xe6e37000, 0x1) r0 = open(&(0x7f0000000300)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7815) r1 = getpid() fcntl$setown(r0, 0x6, r1) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) sysctl$net_inet_tcp(&(0x7f0000000140)={0x4, 0x2, 0x6, 0x17}, 0x4, 0x0, 0x0, &(0x7f00000011c0)="7869d10b", 0x4) kill(r1, 0x13) select(0x40, &(0x7f00000003c0)={0x0, 0x2000000000000000, 0x2, 0xe, 0x0, 0xfffffffffffffffd, 0x0, 0x40000000}, &(0x7f0000000080)={0x800000000000003, 0x8, 0x0, 0xffffffffffffdfff}, 0x0, 0x0) 326.039517ms ago: executing program 6 (id=11): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) ioctl$TIOCSETA(0xffffffffffffffff, 0xc0084463, &(0x7f00000000c0)={0xb, 0xffeffffc, 0x2, 0x2, "c9f7550000000bca9853a4956b47c0d100", 0xc5, 0x200}) (async) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f00000000c0), &(0x7f0000000240)=0xffffffffffffffde) (async) sysctl$kern(&(0x7f00000000c0)={0x1, 0x37}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) sysctl$kern(&(0x7f00000000c0)={0x1, 0x2c}, 0xf, &(0x7f0000000000)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000140)=0x1c, 0x0, 0x0) 325.736724ms ago: executing program 4 (id=12): ioctl$DIOCGETSTATE(0xffffffffffffffff, 0xc1084413, &(0x7f0000000040)={{0x4, './file0\x00', [{[@v4=@multicast2, @v4=@remote={0xac, 0x14, 0x0}], [0xd, 0x4], 0x1c, 0x2}, {[@v4=@multicast2, @v6=@loopback], [0x34], 0x4005, 0x14}], {{0x1, 0x48, 0xba, 0x7}, 0x6546, 0x409, 0xffeffff8, 0x3, 0x4008, 0x9}, {{0x0, 0x9, 0xfd, 0x5}, 0x53, 0x100c88, 0x10007, 0x0, 0x3ff, 0xf0}, @v4=@loopback, 0x2, 0x1000000a, 0x1000, 0x3, 0x5, [[0xd7, 0x146], [0x3, 0x408000]], [[0xfc000002, 0x4], [0xfffffff7, 0x9]], 0xb, [0x1d2, 0x4000807a], 0x2, 0x18, 0x7f, 0x0, 0x10, 0x3, 0x7, 0x83, 0x5, 0xff, 0x1, 0xce57}}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) (async, rerun: 32) r1 = kqueue() (async, rerun: 32) r2 = socket$inet(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) (async) listen(r2, 0x7fff) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa0800451000300067002000069078e0000002ac1400aa4e234e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="7002820090780001050204020b020000"]) (async) kevent(r1, &(0x7f0000000040), 0x96, &(0x7f0000000340), 0xb4bd, 0x0) ioctl$TIOCSETA(r0, 0xcd604404, &(0x7f00000001c0)={0x1, 0x2, 0x7, 0x2f, "201800", 0xfffffff9, 0x40000002}) ioctl$BIOCSRTIMEOUT(r0, 0x8010426d, &(0x7f0000000000)={0x0, 0x4}) 250.25493ms ago: executing program 1 (id=13): pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$VT_WAITACTIVE(r0, 0x20007606, &(0x7f0000000040)=0x4) syz_emit_ethernet(0x16, &(0x7f0000000300)={@random="25963ee813de", @empty, [], {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @local, @loopback, @random="777a96e1efbb", @multicast2}}}}) ioctl$VMM_IOC_READREGS(r0, 0xc2485607, &(0x7f0000000080)={0x7, 0x9, {[0x2, 0x4, 0x3a, 0x8, 0x1a, 0x7, 0x7ff, 0x1, 0x2, 0x7, 0x7, 0xffab000000000, 0x4, 0x761, 0x8, 0x3, 0x9, 0x7], [0x401, 0xd2a, 0x1, 0x9, 0x5, 0x10, 0x6, 0x5, 0x0, 0x1000], [0x7, 0x3, 0x1, 0x1, 0x6, 0xf3, 0x1], [0x100, 0x8, 0xce, 0x9, 0x200, 0x3], [{0x5, 0x19a0, 0x3, 0x5}, {0x8, 0xfffffeff, 0x0, 0x5a7b}, {0x2, 0xb, 0xfffffffd, 0xfffffffffffffff9}, {0x4926, 0x9, 0x5, 0x200}, {0x40, 0x8000, 0x4, 0x3fff800000}, {0x0, 0xb, 0x4, 0xffffffffffffff57}, {0x3, 0xfffffff9, 0x2, 0x73e}, {0x3, 0x3e, 0x81}], {0xfc00, 0x5, 0x2, 0xff}, {0x1ff, 0x1, 0x3ff, 0xffffffff}}}) 249.821083ms ago: executing program 2 (id=3): sysctl$hw(&(0x7f0000000000)={0x4, 0x18}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) socket(0x18, 0x2, 0x0) ioctl$WSMUXIO_LIST_DEVICES(0xffffffffffffffff, 0x80047476, &(0x7f0000000080)={0x401, [{0x2, 0x101}, {0x1, 0x5}, {0x2, 0x800}, {0x3, 0x5}, {0x3, 0xd98}, {0x2, 0x4}, {0x2}, {0x2, 0x7}, {0x1, 0x5}, {0x2, 0x80000000}, {0x1, 0x7f}, {0x1, 0x6}, {0x3, 0x3}, {0x3}, {0x2, 0x200}, {0x1, 0xa224}, {0x3, 0xf1}, {0x3, 0xb4}, {0x2, 0xdc}, {0x3, 0x8}, {0x3, 0x7}, {0x2, 0x1}, {0x3, 0x9f5}, {0x3, 0x40}, {0x1, 0x10000}, {0x2, 0xaec}, {0x2, 0xffff}, {0x3, 0x5}, {0x1, 0x3e33}, {0x3, 0x372002ea}, {0x1, 0x83ff}, {0x1, 0x4}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000ffff000001"], 0x28}, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x0) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) sendsyslog(&(0x7f0000004240)="3c2b3c7be607", 0x6, 0x26) sysctl$net_inet6_icmp6(&(0x7f0000000000)={0x4, 0x18, 0x3a, 0x1}, 0x4, 0x0, 0x0, 0x0, 0x4e) 249.549773ms ago: executing program 6 (id=14): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x8, 0x8) r1 = kqueue() ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0x3200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000240)='./file0\x00', 0x2000, 0x5900) r3 = open(&(0x7f0000000000)='./file0\x00', 0x200, 0x3b3) ioctl$BIOCSETIF(r3, 0x80084904, &(0x7f0000000040)={'tap', 0x0}) ioctl$BIOCSETIF(r3, 0x40384900, 0x0) ioctl$WSDISPLAYIO_GETEMULTYPE(r3, 0x80184901, &(0x7f0000000180)={0x0, './file1\x00'}) preadv(r2, 0x0, 0x0, 0x6) setuid(0x0) r4 = syz_open_pts() ioctl$TIOCSETD(r4, 0x8004741b, &(0x7f0000000000)=0x5) setitimer(0x2, &(0x7f0000000000)={{0xffffffffffffffff, 0xa}, {0x3, 0x7fff}}, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0xc8) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000000)={0x0, 0x7, r5}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r5, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x0, 0x0}) setgid(0xffffffffffffffff) setgroups(0x0, 0x0) setuid(0xffffffffffffffff) syz_open_pts() r6 = socket(0x2, 0x3, 0x2f) r7 = dup(r6) mknod(&(0x7f00000003c0)='./bus\x00', 0x2000, 0x9) r8 = open(&(0x7f0000000080)='./bus\x00', 0x2, 0x139) ioctl$TIOCOUTQ(r8, 0x40047473, &(0x7f0000000040)) setsockopt$inet_opts(r7, 0x0, 0x22, &(0x7f0000000300), 0x0) kevent(r1, &(0x7f0000000000), 0x3ff, 0x0, 0x8000800, 0x0) 249.231586ms ago: executing program 4 (id=15): bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0x1c, 0x18, 0x0, 0xff, "00000000000000000000000000000200", 0x9}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) recvmsg(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) read$audio(r1, &(0x7f0000001b80)=""/20, 0x14) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0x1c, 0x18, 0x1, 0x11, "0000000000000000000000fd98000100", 0x7}, 0x1c) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) open$dir(&(0x7f00000000c0)='.\x00', 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/236, 0xec}], 0x1, 0x0}, 0x473aca9c51e0e662) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r2 = syz_open_pts() sysctl$hw(&(0x7f0000000080)={0x6, 0x16}, 0x2, 0x0, 0x0, 0x0, 0x0) close(r2) r3 = syz_open_pts() ioctl$TIOCSETA(r3, 0x802c7414, &(0x7f0000000340)={0x8000006, 0x8, 0xfffffffe, 0xffffff8f, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x8}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r3, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) r4 = socket$inet(0x2, 0x8003, 0xfc) ioctl$FIONREAD(r4, 0x80206979, &(0x7f0000000000)) dup2(r1, r0) 249.087696ms ago: executing program 1 (id=16): r0 = socket(0x16, 0x2, 0x0) fcntl$setstatus(r0, 0x4, 0x80) socket(0x16, 0x2, 0x0) (async) fcntl$setstatus(r0, 0x4, 0x80) (async) 248.906826ms ago: executing program 3 (id=17): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = socket$inet(0x2, 0x8003, 0xfc) ioctl$FIONREAD(r1, 0x80206979, &(0x7f0000000000)) ioctl$WSDISPLAYIO_LINEBYTES(r0, 0x4004575f, &(0x7f0000000040)) r2 = openat$pf(0xffffffffffffff9c, &(0x7f0000000300), 0x8000, 0x0) ioctl$DIOCNATLOOK(r2, 0xc0504417, &(0x7f0000000080)={@v6=@loopback, @v4=@remote={0xac, 0x14, 0x0}, @v4, @v6=@ipv4={'\x00', '\xff\xff', @remote={0xac, 0x14, 0x0}}, 0x4, 0x2, 0x7, 0x1, 0xc, 0x5, 0x18, 0x7, 0x3}) 248.416704ms ago: executing program 7 (id=18): r0 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$BIOCSETIF(0xffffffffffffff9c, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) sysctl$hw(&(0x7f0000000080)={0x6, 0x18}, 0x2, &(0x7f00000000c0)="99c5069e7aab2155751fcf107818533afc9ff01a68a4b1baa30a07f4c4b66ce08d59af7e54a8341f3be673a174c3a12223a171ff2ab99d0e0d43f0a6c3948f11658e876ac2126614dcd00fdfe76f1ace1f77da0c0af828b5c508585fd9df9ae729f85999a053e2c9872fbdd4e491010010791840000000000000000081131a6f0b680f72f2b0d9a19e570400"/151, &(0x7f0000000180)=0x97, &(0x7f00000001c0), 0x4) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x0, 0xfe, 0x0, 0x10001}, {0x2}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x33}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$kern(&(0x7f00000000c0)={0x1, 0x45}, 0x3, &(0x7f0000002480)="71f91eca6e530c79e2f8e2a2ce3471ac0058bc5a91501d94a34bfec38a820600000000000000dc0225f0e4cf52b7d99d15d923", &(0x7f0000000080)=0x1232, 0x0, 0xfffffffffffffe4d) setresuid(0x0, 0x0, 0xee00) flock(r0, 0x8) sysctl$net_inet6_ip6(&(0x7f0000000040)={0x4, 0x18, 0x29, 0x10}, 0x4, &(0x7f00000000c0)="7627ae4adc8fa559879c8ff6a67aae55645884c7bb74fd09607907844ff0f162f20ce63608d0a1876ed78519c38ddfca186cfcb8721933ca321f1e8b27da0e9313cb64f83c85228dd435c19c3fc74e358540c8a9ac0cc566258c2f9b36b59af95bb2bc039354c746f773f882d4bdbec4295a534d64dc0ba1e748f8f2a26ce88e2168ec9a9f78e751cd37443aab7845a95decb97d4934dbd4f4bb1e096f72528b3f15a06f0a57f7f88599c3ce0bb8702f39f25953b6e1bcc7f0a0880681b82f2055", &(0x7f00000001c0)=0xc1, &(0x7f0000000200)="2efbef5647b82a155336965dbe135ba643fa4adcbf742f7d708c010ff96caae998fb218ef076aeb7de050dc18c10bb41d982fc", 0x33) ioctl$WSKBDIO_SETENCODING(r0, 0x80045710, &(0x7f0000000000)=0x200) 393.223µs ago: executing program 6 (id=19): mknod(&(0x7f0000000000)='./bus\x00', 0x2000, 0x2e00) r0 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) syz_emit_ethernet(0x0, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x0) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x1, 0x2010, r1, 0x0) madvise(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x2) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, 0x0) syz_emit_ethernet(0x0, 0x0) ktrace(0x0, 0x2, 0x100, 0x0) ppoll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x40}], 0x1, 0x0, 0x0) unveil(0x0, &(0x7f0000000d40)='x\x00') sysctl$vm_swapencrypt(&(0x7f0000000000)={0x2, 0x5, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) setuid(0xee01) open$dir(&(0x7f0000000b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0x0) mknod(&(0x7f0000000080)='./file0\x00', 0x2000, 0x204) open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) rename(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000440)='./file0\x00') ioctl$VMM_IOC_CREATE(r0, 0x8004630a, &(0x7f0000000000)={0x10, 0x0, [{&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil}, {}, {0x0, &(0x7f0000ffb000/0x3000)=nil}, {&(0x7f0000fff000/0x1000)=nil}, {0x0, &(0x7f0000ffb000/0x1000)=nil}, {&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil}, {&(0x7f0000ffe000/0x1000)=nil}, {0x0, &(0x7f0000002000/0x1000)=nil}, {0x0, &(0x7f0000ffa000/0x4000)=nil}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil}, {&(0x7f0000002000/0x1000)=nil, &(0x7f0000ff9000/0x6000)=nil}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil}, {0x0, &(0x7f0000ffd000/0x3000)=nil}, {0x0, &(0x7f0000ff9000/0x2000)=nil}, {&(0x7f0000ff9000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x7}, {0x0, &(0x7f0000ffc000/0x1000)=nil}], './file0\x00'}) faccessat(0xffffffffffffffff, 0x0, 0x20, 0x1) 0s ago: executing program 4 (id=20): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x7, 0xffff63db, 0x800005, 0x56, 0x8, 0x8007f, 0x6, 0x10, [{0x8, 0x10001, 0x7, 0x1}, {0x0, 0xffffffff, 0x200103, 0x6}, {0xcd4, 0x3, 0x200006, 0x4}, {0xfffffffb, 0x80, 0x11, 0x20000fe}, {0x6, 0x2000004, 0x7, 0x7}, {0x3996, 0xfffa, 0x8, 0x2000040a}, {0x10004, 0x0, 0x8000, 0xffffffff}, {0x207, 0x9, 0x228002, 0xffffe2e1}, {0x2000009, 0xfffffffe, 0x6, 0x8006}, {0x7, 0x1, 0x7, 0x40}, {0x10086, 0xfffffffe, 0x8a3a000a, 0x9}, {0x2, 0x6, 0x9, 0xa6e}, {0x9, 0x49, 0x3, 0xa}, {0x4, 0x401, 0xfffdfffd, 0xbac}, {0x8, 0x3ffdffd, 0x7, 0x4}, {0x9be9, 0x0, 0xfffffffe, 0xb}]}) (async) sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="b10005010000009f0500070107000000211c13fecea70500fef96ecfc72fd3007ae30200fdef3044d2d236acf20bf404be01000000f7c8cf5f8823297be1aa0504000051e2f0ad3ebbc257699a1f139b672f335c22db830c032bfa896443c32118210000720fd38bfb0000fd54c125191b1257aea8c500001602", 0x7a, 0x404, 0x0, 0x0) (async) socket(0x1, 0x5, 0x2) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) munlock(&(0x7f0000623000/0x1000)=nil, 0x1000) r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) sysctl$net_inet_udp(&(0x7f0000000040)={0x4, 0x2, 0x11, 0x2}, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0xfffffdb3) (async) ioctl$WSMUXIO_ADD_DEVICE(r0, 0x40047477, 0x0) (async) r1 = socket(0x11, 0x3, 0x0) sendto$unix(r1, &(0x7f0000000000)="b1000504000004000000000001000000331c13fecea10500fef16ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139bf82f4d335c223e7d0c032bfa896443a42102000000720fd18bfbb6a998df192f9781ea6e2ec58904007b6400008000361b4cc702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900000008e371a3f8343712051eea040000000000", 0xb1, 0x40c, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.104' (ED25519) to the list of known hosts. panic: free: size too large 80 > 16 (0xffff800000c40be0) type rtable Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x25 panic(ffffffff8350d9f2) at panic+0x1e5 free(ffff800000c40be0,5,50) at free+0x690 rtfree(fffff6006c7f20c0) at rtfree+0x347 rt_ifa_purge(ffff80000160e400) at rt_ifa_purge+0x1a0 in_purgeaddr(ffff80000160e400) at in_purgeaddr+0x1d6 in_ifdetach(ffff800001608000) at in_ifdetach+0x7e if_detach(ffff800001608000) at if_detach+0x2fe tun_clone_destroy(ffff800001608000) at tun_clone_destroy+0x2ce if_clone_destroy(ffff80002a329fd0) at if_clone_destroy+0x205 tun_dev_close(5d04,7) at tun_dev_close+0x1d9 spec_close(ffff80002a32a090) at spec_close+0x417 VOP_CLOSE(fffff60077221618,7,fffff600097fd270,ffff80002a22b770) at VOP_CLOSE+0x132 vn_closefile(fffff6006ca8a4a0,ffff80002a22b770) at vn_closefile+0x12b end trace frame: 0xffff80002a32a1b0, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: free: size too large 80 > 16 (0xffff800000c40be0) type rtable ddb{0}> show kasan No such command ddb{0}> trace db_enter() at db_enter+0x25 panic(ffffffff8350d9f2) at panic+0x1e5 free(ffff800000c40be0,5,50) at free+0x690 rtfree(fffff6006c7f20c0) at rtfree+0x347 rt_ifa_purge(ffff80000160e400) at rt_ifa_purge+0x1a0 in_purgeaddr(ffff80000160e400) at in_purgeaddr+0x1d6 in_ifdetach(ffff800001608000) at in_ifdetach+0x7e if_detach(ffff800001608000) at if_detach+0x2fe tun_clone_destroy(ffff800001608000) at tun_clone_destroy+0x2ce if_clone_destroy(ffff80002a329fd0) at if_clone_destroy+0x205 tun_dev_close(5d04,7) at tun_dev_close+0x1d9 spec_close(ffff80002a32a090) at spec_close+0x417 VOP_CLOSE(fffff60077221618,7,fffff600097fd270,ffff80002a22b770) at VOP_CLOSE+0x132 vn_closefile(fffff6006ca8a4a0,ffff80002a22b770) at vn_closefile+0x12b fdrop(fffff6006ca8a4a0,ffff80002a22b770) at fdrop+0x121 closef(fffff6006ca8a4a0,ffff80002a22b770) at closef+0x192 fdfree(ffff80002a22b770) at fdfree+0x116 exit1(ffff80002a22b770,43,0,1) at exit1+0x595 sys_exit(ffff80002a22b770,ffff80002a32a400,ffff80002a32a350) at sys_exit+0x1a syscall(ffff80002a32a400) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x716db4887a80, count: -21 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80002a329c30 rbx 0xffffffff8399be0f cpu_info_full_primary+0x2e0f rdx 0 rcx 0xffff80002a22b770 rax 0xffffffff8399aff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x42d9da4b9a535a44 r11 0x19d0fd0cae844d6c r12 0xffffffff8399bc10 cpu_info_full_primary+0x2c10 r13 0 r14 0 r15 0x1 rip 0xffffffff83297605 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a329c20 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=451944 pid=47986 tcnt=0 stat=onproc flags process=a proc=2000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a22c010,0xffff80002a22b4e8 process=0xffff800045ff5368 user=0xffff80002a325000, vmspace=0xfffff6000b1f71e8 estcpu=26, cpticks=3, pctcpu=0.1, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 39328 155531 48500 0 3 0x2 0x80 piperd syz-executor 92749 71338 48500 0 3 0x2 0x80 piperd syz-executor 89572 43777 48500 0 3 0x2 0x80 piperd syz-executor 24246 169068 48500 0 3 0x2 0x80 piperd syz-executor 67635 49824 48500 0 3 0x2 0x80 piperd syz-executor 81993 463626 48500 0 3 0x2 0x80 piperd syz-executor 57541 378176 48500 0 3 0x2 0x80 piperd syz-executor 48500 393137 79328 0 3 0x2 0x80 wait syz-executor 79328 410675 66754 0 3 0x100002 0x88 sigsusp ksh 66754 308494 6644 0 3 0x10 0x88 kqread sshd-session 6644 108435 12837 0 3 0x12 0x80 kqread sshd-session 82754 372379 1 0 3 0x100003 0x80 ttyin getty 12837 456957 1 0 3 0 0x88 kqread sshd 58003 55455 402 74 3 0x1100012 0x80 bpf pflogd 402 305038 1 0 3 0 0x80 sbwait pflogd 45579 496523 18303 73 3 0x1100010 0x80 kqread syslogd 18303 445217 1 0 3 0x100002 0x80 sbwait syslogd 78970 365589 1 0 3 0x100000 0x80 kqread resolvd 17013 212623 30348 77 3 0x100012 0x80 kqread dhcpleased 93380 197339 30348 77 3 0x100012 0x80 kqread dhcpleased 30348 30994 1 0 3 0 0x80 kqread dhcpleased 62714 60685 0 0 3 0x14000 0x200 bored smr 75907 111180 0 0 3 0x14000 0x200 pgzero zerothread 72916 315050 0 0 3 0x14000 0x200 aiodoned aiodoned 24481 320387 0 0 3 0x14000 0x200 syncer update 12975 291172 0 0 3 0x14000 0x200 cleaner cleaner 60686 315612 0 0 3 0x14000 0x200 reaper reaper 18126 266080 0 0 3 0x14000 0x200 pgdaemon pagedaemon 24003 310565 0 0 3 0x14000 0x200 bored viomb 78592 283455 0 0 3 0x14000 0x40000200 acpi0 acpi0 52530 48000 0 0 7 0x14000 0x40000200 idle1 56164 519072 0 0 3 0x14000 0x200 bored softnet1 66199 266474 0 0 3 0x14000 0x200 bored softnet0 52906 264952 0 0 3 0x14000 0x200 smrbar systqmp 56174 358013 0 0 3 0x14000 0x200 bored systq 9705 13411 0 0 3 0x14000 0x200 tmoslp softclockmp 46088 280003 0 0 3 0x14000 0x40000200 tmoslp softclock 23627 3383 0 0 3 0x14000 0x40000200 idle0 1 387423 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff839eb7f8) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 free+0x9f #3 rtfree+0x347 #4 rt_ifa_purge+0x1a0 #5 in_purgeaddr+0x1d6 #6 in_ifdetach+0x7e #7 if_detach+0x2fe #8 tun_clone_destroy+0x2ce #9 if_clone_destroy+0x205 #10 tun_dev_close+0x1d9 #11 spec_close+0x417 #12 VOP_CLOSE+0x132 #13 vn_closefile+0x12b #14 fdrop+0x121 #15 closef+0x192 #16 fdfree+0x116 #17 exit1+0x595 #18 sys_exit+0x1a Process 52906 (systqmp) thread 0xffff800045ffe530 (264952) shared rwlock systqmp r = 0 (0xffffffff839515a8) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11051 12080K 12221K 166960K 12158 0 pcb 17 12K 12K 166960K 18 0 rtable 236 7K 8K 166960K 358 0 pf 36 18K 21K 166960K 52 0 ifaddr 43 7K 7K 166960K 45 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 4K 166960K 1487 0 iov 0 0K 0K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1321 83K 83K 166960K 1402 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 3 0K 0K 166960K 4 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 10 33K 89K 166960K 148 0 sigio 0 0K 0K 166960K 1 0 proc 71 115K 196K 166960K 553 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 99 6K 6K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 2 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 37 175K 175K 166960K 37 0 exec 0 0K 1K 166960K 382 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 176 158K 169K 166960K 3090 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 35 70K 104K 166960K 1304 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 18 0K 1K 166960K 28 0 temp 40 9114K 9122K 166960K 4472 0 kqueue 13 20K 22K 166960K 27 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 33 0 30 1 0 1 1 0 8 0 rtentry 176 111 0 4 5 0 5 5 0 8 0 unpcb 144 45 0 28 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 10 0 6 1 0 1 1 0 8 0 arp 136 18 0 1 1 0 1 1 0 8 0 inpcb 328 72 0 65 2 0 2 2 0 8 1 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfrktable 1344 3 0 1 1 0 1 1 0 8 0 pfanchor 1288 1 0 0 1 0 1 1 0 8 0 pfstitem 24 26 0 0 1 0 1 1 0 8 0 pfstkey 128 26 0 0 1 0 1 1 0 8 0 pfstate 448 26 0 0 3 0 3 3 0 8 0 pfrule 1360 22 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 452 0 0 29 0 29 29 0 8 0 art_table 40 453 0 0 5 0 5 5 0 8 0 art_node 32 111 0 11 1 0 1 1 0 8 0 semapl 72 2 0 1 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1593 0 127 92 0 92 92 0 8 0 ffsino 296 1593 0 127 113 0 113 113 0 8 0 nchpl 144 1799 0 107 64 0 64 64 0 8 0 vnodes 216 1718 0 0 96 0 96 96 0 8 0 namei 1024 6281 0 6281 4 1 3 3 0 8 3 percpumem 16 51 0 0 1 0 1 1 0 8 0 pfiaddrpl 120 1 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 6374 0 6374 4 2 2 3 1 8 2 plimitpl 152 30 0 13 1 0 1 1 0 8 0 sigapl 424 465 0 425 7 0 7 7 0 8 2 knotepl 120 54 0 0 2 0 2 2 0 8 0 kqueuepl 224 57 0 48 3 0 3 3 0 8 2 pipepl 344 128 0 101 3 0 3 3 0 8 0 fdescpl 528 449 0 425 3 0 3 3 0 8 1 filepl 160 1689 0 1482 12 0 12 12 0 8 3 lockfpl 104 6 0 4 1 0 1 1 0 8 0 lockfspl 48 4 0 2 1 0 1 1 0 8 0 sessionpl 144 25 0 16 1 0 1 1 0 8 0 pgrppl 48 33 0 16 1 0 1 1 0 8 0 ucredpl 104 98 0 85 1 0 1 1 0 8 0 zombiepl 144 426 0 425 1 0 1 1 0 8 0 processpl 1240 465 0 425 5 0 5 5 0 8 1 procpl 664 491 0 451 5 0 5 5 0 8 1 sockpl 752 152 0 125 4 0 4 4 0 8 1 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 132 0 0 17 0 17 17 0 8 0 mcl2k 2048 17 0 0 3 0 3 3 0 8 0 mextrefs 64 10 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 158 0 0 10 0 10 10 0 8 0 bufpl 272 2310 0 105 147 0 147 147 0 8 0 anonpl 32 3744 0 0 31 0 31 31 0 247 0 amapchunkpl 152 8313 0 8025 18 0 18 18 0 158 3 amappl16 200 1721 0 1709 5 1 4 5 0 8 3 amappl15 192 9 0 8 1 0 1 1 0 8 0 amappl14 184 431 0 430 1 0 1 1 0 8 0 amappl13 176 125 0 113 1 0 1 1 0 8 0 amappl12 168 699 0 676 2 0 2 2 0 8 0 amappl11 160 8 0 8 1 1 0 1 0 8 0 amappl10 152 63 0 49 1 0 1 1 0 8 0 amappl9 144 275 0 275 1 1 0 1 0 8 0 amappl8 136 97 0 96 1 0 1 1 0 8 0 amappl7 128 213 0 200 1 0 1 1 0 8 0 amappl6 120 191 0 190 1 0 1 1 0 8 0 amappl5 112 96 0 86 1 0 1 1 0 8 0 amappl4 104 305 0 287 1 0 1 1 0 8 0 amappl3 96 1534 0 1477 3 0 3 3 0 8 1 amappl2 88 575 0 509 2 0 2 2 0 8 0 amappl1 80 10450 0 9876 15 0 15 15 0 8 0 amappl 88 2367 0 2262 4 0 4 4 0 92 0 uvmvnodes 80 101 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 254 0 254 2 1 1 1 0 8 1 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 449 0 425 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 449 0 425 1 0 1 1 0 8 0 vmmpekpl 168 5790 0 5752 2 0 2 2 0 8 0 vmmpepl 168 38410 0 36895 87 0 87 87 0 357 10 vmsppl 488 448 0 425 5 0 5 5 0 8 2 rwobjpl 80 14460 0 13525 24 0 24 24 0 8 2 pdppl 4096 905 0 850 93 14 79 83 0 8 24 pvpl 32 9258 0 0 76 1 75 76 0 265 0 pmappl 256 448 0 425 3 0 3 3 0 8 1 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 413 0 18 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 panic(ffffffff8350d9f2) at panic+0x1e5 free(ffff800000c40be0,5,50) at free+0x690 rtfree(fffff6006c7f20c0) at rtfree+0x347 rt_ifa_purge(ffff80000160e400) at rt_ifa_purge+0x1a0 in_purgeaddr(ffff80000160e400) at in_purgeaddr+0x1d6 in_ifdetach(ffff800001608000) at in_ifdetach+0x7e if_detach(ffff800001608000) at if_detach+0x2fe tun_clone_destroy(ffff800001608000) at tun_clone_destroy+0x2ce if_clone_destroy(ffff80002a329fd0) at if_clone_destroy+0x205 tun_dev_close(5d04,7) at tun_dev_close+0x1d9 spec_close(ffff80002a32a090) at spec_close+0x417 VOP_CLOSE(fffff60077221618,7,fffff600097fd270,ffff80002a22b770) at VOP_CLOSE+0x132 vn_closefile(fffff6006ca8a4a0,ffff80002a22b770) at vn_closefile+0x12b fdrop(fffff6006ca8a4a0,ffff80002a22b770) at fdrop+0x121 closef(fffff6006ca8a4a0,ffff80002a22b770) at closef+0x192 fdfree(ffff80002a22b770) at fdfree+0x116 exit1(ffff80002a22b770,43,0,1) at exit1+0x595 sys_exit(ffff80002a22b770,ffff80002a32a400,ffff80002a32a350) at sys_exit+0x1a syscall(ffff80002a32a400) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x716db4887a80, count: -21 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x457 sched_idle(ffff80002999dff0) at sched_idle+0x371 end trace frame: 0x0, count: 10 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x457 sched_idle(ffff80002999dff0) at sched_idle+0x371 end trace frame: 0x0, count: -5