last executing test programs: 67.01728ms ago: executing program 1 (id=2): unveil(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='c\x00') writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000080)="76e5eac907f9ccf7a251ceddcec7d6aa45cffe2c63a56077123a276d3ba4e9d17eb3eb5db12a3783a8e0620d357de1fe04fa9465b5bd1286e9624dec06a00c222f", 0x41}, {&(0x7f00000001c0)="14354c0221ba81159b364f22330da4927b0c18ce40818a744364d8220814a8fea7c1278846aaf179e56de467fcac19f95d97fdf27cf4b6fbb29db7e43ba7cfd807774b9c84b3b3120e63e4f298b0e5d6f3d5673fd5ff452d582eaf5ea2afc74ce9f037afa4862b0d7d63570c2bd6471d004a4dc2e5ff5402f49ebabe2a86839b6bd47d8efba2f5b16c03296489c3d2bdb68897330c31457c8f26d7d5ba2a960d8776ec8b9ca1afe35a449c1d0a719c2895902305880f81819d2c5574e76f3f490f2a5e2b8e4fc87a2d0bc3e1e852720453c27d142ef7c3f8e4d3dfb318d8701adbac617c7dccadf32ac020c6", 0xec}], 0x2) (async) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000080)="76e5eac907f9ccf7a251ceddcec7d6aa45cffe2c63a56077123a276d3ba4e9d17eb3eb5db12a3783a8e0620d357de1fe04fa9465b5bd1286e9624dec06a00c222f", 0x41}, {&(0x7f00000001c0)="14354c0221ba81159b364f22330da4927b0c18ce40818a744364d8220814a8fea7c1278846aaf179e56de467fcac19f95d97fdf27cf4b6fbb29db7e43ba7cfd807774b9c84b3b3120e63e4f298b0e5d6f3d5673fd5ff452d582eaf5ea2afc74ce9f037afa4862b0d7d63570c2bd6471d004a4dc2e5ff5402f49ebabe2a86839b6bd47d8efba2f5b16c03296489c3d2bdb68897330c31457c8f26d7d5ba2a960d8776ec8b9ca1afe35a449c1d0a719c2895902305880f81819d2c5574e76f3f490f2a5e2b8e4fc87a2d0bc3e1e852720453c27d142ef7c3f8e4d3dfb318d8701adbac617c7dccadf32ac020c6", 0xec}], 0x2) r0 = socket(0x2, 0x1, 0x0) getsockopt(r0, 0x6, 0x4, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = openat$pf(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TIOCSETA(r1, 0x20004101, 0x0) openat$bpf(0xffffffffffffff9c, &(0x7f0000000140), 0x80, 0x0) (async) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000140), 0x80, 0x0) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000040)={'tap', 0x0}) ioctl$BIOCSETF(r2, 0x80104267, &(0x7f0000000340)={0x3, &(0x7f0000000000)=[{0x1c, 0xb, 0x1a, 0x802}, {0x1, 0x2, 0x8, 0x5}, {0x4e, 0xfd, 0xf6, 0x6ac}]}) open(&(0x7f0000000000)='./file0\x00', 0x615, 0x166) ktrace(&(0x7f0000000080)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0xc8) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xa, 0x6}, 0x80000000, 0xfffffffffffffffd, 0x0, 0xffffffff, 0xfffffffffffffffa, 0x1, 0x200023, 0x0, 0x0, 0xfffffffffffffffe}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket(0x18, 0x1, 0x0) (async) r4 = socket(0x18, 0x1, 0x0) setuid(0xee01) setsockopt(r4, 0x1000000029, 0xc, &(0x7f0000000040)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) (async) setsockopt(r4, 0x1000000029, 0xc, &(0x7f0000000040)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r4, 0x1000000029, 0xd, &(0x7f0000000100)="ebffcbff13b9fdc12eaa4e713048e69931929648", 0x14) (async) setsockopt(r4, 0x1000000029, 0xd, &(0x7f0000000100)="ebffcbff13b9fdc12eaa4e713048e69931929648", 0x14) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r3, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r3, 0x0) poll(&(0x7f0000000ac0)=[{0xffffffffffffff9c}], 0x20000000000000d7, 0x887e) (async) poll(&(0x7f0000000ac0)=[{0xffffffffffffff9c}], 0x20000000000000d7, 0x887e) r5 = open(&(0x7f0000000180)='./bus\x00', 0x8000, 0xc8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r5, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r5, 0x0) sysctl$net_inet_icmp(&(0x7f0000000040)={0x4, 0x2, 0x1, 0x5}, 0x4, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$net_inet_carp(&(0x7f0000000040)={0x4, 0x2, 0x6, 0x2}, 0x4, 0x0, 0x0, &(0x7f00000010c0)="e5000000", 0x4) syz_emit_ethernet(0x6e, &(0x7f00000001c0)=ANY=[]) openat(0xffffffffffffffff, &(0x7f00000000c0)='./bus\x00', 0x8, 0x1a0) (async) openat(0xffffffffffffffff, &(0x7f00000000c0)='./bus\x00', 0x8, 0x1a0) syz_open_pts() (async) syz_open_pts() socket$inet(0x2, 0x1, 0x0) 29.137056ms ago: executing program 5 (id=6): ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) r0 = socket(0x18, 0xc003, 0x3a) setsockopt(r0, 0x29, 0x6c, &(0x7f0000000040), 0x4) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x33b9) r1 = open(&(0x7f0000000480)='./file0\x00', 0x800, 0x4ebfac6bbaf7900) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc290560b, &(0x7f0000000100)={0x10, 0x5, [{&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x800}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil}, {&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x1}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x4000000000000000}, {&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x7}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x7}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x5}, {&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x2}, {&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, 0xeb}, {&(0x7f0000277000/0x1000)=nil, &(0x7f0000ff7000/0x3000)=nil, 0x80}, {&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x8}, {&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x101}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0xb1}, {&(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x3}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0xffffffffffff0000}], './file0\x00', 0x3, 0x4, 0xfff, 0x0, [0x7, 0x1689d41c, 0x80000001, 0x401, 0x0, 0x9, 0x9, 0x78, 0x9, 0xfffffffd, 0x7, 0x10001, 0x6, 0x6, 0x8001, 0x8, 0x3ff, 0x7, 0x1, 0x0, 0xfffffff7, 0x9, 0x7, 0x280000, 0x4, 0x1, 0x0, 0x2, 0x3, 0x7, 0x0, 0x6, 0x0, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x8, 0x100, 0xffffff80, 0x2, 0xdae, 0x7ff, 0x1, 0x7fffffff, 0x6, 0x101, 0x0, 0x3, 0x10000000, 0x8, 0x2, 0x5, 0x1, 0x6, 0x6, 0x46af0a69, 0x4a9, 0x80000000, 0x10001, 0x1ff, 0x9, 0x2, 0x7ff, 0xff, 0x3, 0x2, 0x6, 0x6, 0x1, 0x2, 0x6, 0x3, 0x5, 0x7, 0x5, 0x7, 0xfffffffe, 0x2, 0xf8000000, 0x3, 0x4, 0xbbf, 0x6, 0x3, 0x9, 0x1000000, 0x0, 0xd, 0x4, 0xffaf, 0x6, 0x1, 0x9, 0xce, 0x8, 0x8, 0xa94a, 0x0, 0x987, 0x5, 0x6, 0xa9d4, 0xfffffff2, 0x8000, 0x1, 0x6, 0xcc6, 0x400, 0xfffffffd, 0xa19, 0x80, 0x6, 0x88, 0x80000001, 0x4, 0x1, 0x2, 0x9, 0x53f1, 0x1000, 0xfffffffd, 0xffffff25, 0x9, 0xc144, 0x7, 0x3, 0x9, 0x8, 0x470f, 0x1, 0x4, 0x6, 0xffff, 0x2, 0x5, 0x6, 0x5, 0x4, 0x5, 0x5a9c, 0x4, 0xeb6, 0x5, 0x3, 0x2, 0x2, 0x2, 0x8000, 0x8, 0xaa, 0x8c, 0x38, 0x6, 0x9, 0xb277, 0x400, 0x7, 0x7, 0xd4, 0x7, 0x4, 0x9, 0x75, 0x1ff, 0x1, 0x800, 0x800, 0x3, 0x1ff, 0x401, 0x1000, 0x4be, 0x7, 0x1, 0x100, 0x3, 0x2, 0x200008, 0x239ed050, 0x7f, 0xff, 0x7, 0x9, 0x3ff, 0x4, 0x5317ce34, 0x0, 0x101, 0x80000000, 0x2, 0x10, 0x2, 0x6, 0x5, 0xb, 0x4, 0x9, 0x40, 0x3, 0x6, 0xffff, 0x0, 0x4, 0x1ff, 0x1ff, 0x16, 0x7, 0x4, 0xffffff01, 0x6, 0x5, 0x2, 0x4, 0x4, 0xffffffff, 0x788, 0x0, 0x6, 0x9, 0x1, 0x6, 0x6, 0x6, 0x6, 0xffff, 0x5310, 0x4, 0xd, 0x9, 0x8001, 0x5, 0x5, 0xfffffff7, 0xa, 0x400, 0x4, 0x5, 0x200, 0x6, 0x5, 0x4, 0x4, 0x3, 0x6, 0x40, 0x8, 0x6, 0x80000000, 0x1d209cda, 0x7, 0x4, 0x7fffffff, 0x63439b01, 0xfffffff8, 0xfffffff8, 0x87, 0x48c, 0x9, 0x5, 0xfffff19c, 0x6, 0xed, 0x6, 0xf4d7, 0x9, 0x9, 0xffff, 0xadb, 0x16947a10, 0x3, 0x7, 0x6, 0xc, 0x1, 0x10000, 0x6, 0x9, 0xffff0000, 0x9, 0x9, 0x81, 0x7fffffff, 0x1, 0xda6, 0xf27e, 0x8001, 0xf, 0x0, 0xe7, 0x93c9, 0x3, 0x5, 0x9, 0x1, 0x2, 0x5, 0x4, 0x0, 0xb, 0x2, 0xffffffff, 0x8, 0xffff, 0xdc1c, 0x44cf, 0x6, 0xfffffff8, 0x2, 0xe877, 0x5, 0xfffffffd, 0x5, 0x1014, 0x1, 0x0, 0x3dd, 0x2, 0xffff5ad6, 0x5, 0x2, 0xc, 0x2, 0xf49, 0x65, 0x3, 0x7, 0xcb, 0x2, 0x719, 0x99bd, 0x3, 0x2d5cc7e1, 0x7fffffff, 0x2, 0x1, 0x9, 0x1ff, 0x3, 0xc263, 0xdc81, 0xda, 0x9, 0x400, 0xaed3, 0x9, 0x1, 0xffffff7f, 0x1400000, 0x3, 0xb0, 0x8001, 0x4800000, 0x5, 0xe1a, 0x5c, 0x7, 0x4, 0xffff932b, 0xb65, 0x4f, 0x9, 0x7fffffff, 0x787f, 0x8, 0x200000, 0xf, 0x6, 0x2, 0x7, 0x3a31, 0x0, 0x3, 0xc, 0x101, 0x7fffffff, 0xfffffff7, 0x3, 0x5, 0x7fffffff, 0x9, 0x2, 0x7, 0x5, 0xfffffe00, 0xa88, 0x7eec, 0x8000, 0x0, 0x100, 0x682, 0x36a5, 0x100, 0xd2, 0x81, 0x0, 0x0, 0x2, 0xde, 0xf2d, 0x4, 0x3a1, 0x87ab, 0x4, 0xe, 0x7, 0xffff, 0xc8, 0x7, 0x7, 0xfffffe00, 0x9, 0x8, 0xfffffff7, 0x6e04f75a, 0x0, 0x2, 0x4d, 0x4, 0x10000, 0x8, 0x6, 0x1, 0x8, 0x9, 0x8, 0x80, 0x1, 0x2, 0x1, 0x3, 0x7, 0xcd, 0x6, 0xc6, 0xf3, 0x10, 0x7, 0x27a, 0x7, 0xff28, 0x2, 0xdb9, 0x7, 0x0, 0x10, 0xfff, 0x3, 0x6, 0xe, 0xa6d, 0xfc46, 0x1ff, 0x10000, 0xdee, 0xfffffff9, 0x7d08, 0x4aa, 0x7fffffff, 0x10, 0x6, 0x9, 0x8, 0x4, 0x9, 0x7, 0x10, 0x8, 0x2, 0x5b3, 0x7ff, 0x9d1, 0x71f, 0x5, 0x8, 0x18, 0xff, 0x8, 0x9, 0xfffffffa, 0x1, 0x7fff, 0x6022, 0x401, 0x10000, 0x5, 0xfb3f, 0x2, 0x317b, 0x0, 0x2dd, 0x4, 0x10001, 0x3, 0xd4ef, 0x5, 0x1, 0x10001, 0x9, 0x7, 0xf, 0x1, 0x8, 0x100, 0x5, 0xff, 0x8, 0x7, 0x5, 0x4, 0xba]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$DIOCRTSTADDRS(r1, 0xc0a86b05, &(0x7f00000004c0)={{'./file0\x00', './file0\x00', 0x40, 0x3}, 0x0, 0x9, 0x0, 0xd, 0x8d, 0x4, 0x1, 0xc, 0x3}) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0x68, &(0x7f0000000100)={{0x1c, 0x18, 0x3, 0xb, "c3d0ef43dbd33c8395a37ed8755a3bff", 0x1}, {0x1c, 0x18, 0x0, 0x7ff, "9c39870c8a0488baa508b04a3668c5d9", 0x6}, 0x5, [0x10000, 0xffffffff, 0x401, 0x9, 0x3, 0x3ff, 0x6, 0x3]}, 0xe) socket(0x24, 0x8000, 0x0) 12.218989ms ago: executing program 2 (id=3): sysctl$hw(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x7e, 0x0) (rerun: 32) ioctl$DIOCCHANGERULE(r0, 0xcd60441a, &(0x7f0000000300)={0x5, 0x0, 0x45, './file0\x00', './file0\x00', 0x0, "1ceb2907df73ed69460f3d7057232fc98c097d3bf89c6e22ee62f19110825e7759b40e6fc916d63d72593c3d697e4d0437fda1996f1c0ca3e70712ca79473aa4795fbf14e13f65a9d7a8a7d004fee914f6d7e191453d8cac1accf76664b33f6a7e241764dc4430a1fba22116187403f32fc0d5b43e3a1de5b3a45460dd15a3f80b1fb5656ba2690830f041605f2eb8f5e6cb78e8fd760d82c343b321d43a9b849130f01da09f76fbc6836529bdddc3719810f6b360414d8844efdf78484e272995ccafe7bf27c1a8db123760172607a14058c1cb7efdbe2ec2551a6afcc2196022b1010faa2c29744723841cc171fe8aec228a2e8083df973d2ee5a5d3b3d00342584ff6fcff454ecf2cb0b2a158edccb21d335e91136ac2f222d565acb89c29964ad031b8ff95307e6b3dd70b39980c780de0d67aec451b0589d72131d38d8d77581ac07f9e67b7e6821e7e225b0ac2bc1e6c25bfbb1e3324cc2ffcd9460a33257ea9a18511bc2974f479d6ecc682409c14d0c6efb71e52fc41fb08cadf4e3da1eb957613679470b5fc4adf6bc205bf6cde978d6e6e43ea7a99cc3922f50b7336f650303f341912d605cc65f3e3642de2d963cf30c404fbab72ac485e42eb7f135ffb0c26c2baf0609fec0ebf02963c6b8e4b918dbd7ff6ba983765df89b220e3c27bf18c4864022eea4f5dc6379113956393ea9bbab690d1992f2b93f29933b4e6703c6b0b204aed2d3a045517214b0407c3a84d0126ec56fd5338dfc647b2a8cd5f58329022ff8f089d0ae842d37a1b0c61d234a18d6227a3201f2924b94aa15ed1d207562fcaa68f47158ae92c0195ab958ce83f07a1620363eddedcbc26ade5264b98ad246443623c871f0910963ca2b9a23ef433ab8b65858a594a3ddcf4ab839addc5f491ab387f658617e3853a428405921f0a7b78c7c7c327a5667e1e2bf278ccd3181b93216ad0370b0a024b1887956ecbe033dece6c3019334de351fa3e40136166009ecc88c4bc61351a3fe914394744a86e95b400c92462faa25c21f3b633f7c6b0e7fcf99794987e98ec5baa786899ca2745e10c239861bc22448580338912b57c1337c3ed0956633143aa9ad07eb994653acda582537d40b618b4ee82cf0ea902ff8e5e6a5fe767870b6a98de56f0bee555aa7299cd01a2f52b1d1b0cfe5d16d586acc0e29127afa66c2c8c5156e6ed6cf98c341bc95aed6f5ae4a1918b2e8ed7ce12b50545cba86f43e043b75f026f168618c8e93fbc33a6e10cd472a1d424b216c93d91c4f157b6e9d481fd8622e1fa1a835ab13913a45add550204a3f9d7f0fd9745e91f3167229c8b50b134ea073de7c21d4417423e2f80f5ba0da72af4552757a558f69c73eaf722c12df832b3624299d452a30a9ed606d55f27a1dbb55d6be0946b8b29226780f4ae622576e14049b3351b8da00cb48e3c8ce9ac81aba12d1147ff06fc8f9ffca855b1f78e0d61eec0802130f4d677903fb7c19339aaf40426db6485e9baac4463457c404f05649a37f43df311074b49865c2526baf2eccfa40739d15e153859be07b7c6b4ede86fb6d754d42a5a638ddd69f85d7631db9933918a32eaa6f1761d8def93b11be5d4214b95cb8c7e513ca23976488102fe1e2323b02b13364fb343df08132e374c5636e966b67e3cf814baa68953b5ed88896299e49b66143a0672e1eb43ab9b39f4618424c5db571408c3d7e95e584e4a9f244a3d4e28d97bd23997f901dbd680baade2fea2347867957bbd9ff2edc35f9ac1fe5b6a8790d9198bdaf247ab572e2532a3bb10f2a74092726d7b363d927561b4846d2797a257cd16d2fbb48db58a6f9942603254e0e0993ae869125e8eab2e76843c82650f1660a478fe053ba73fa904efffc7808c17cd381a797306ffec6094cf89d672a9f4"}) (async) ioctl$DIOCGETSTATUS(r0, 0xc2084415, &(0x7f0000000000)) 0s ago: executing program 4 (id=5): r0 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000100), 0x782, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x1, 0x2, 0xfffffffffffffffd, 0x2000000000000006}) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x11}, 0x4000000000000007, 0x0, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x7fff) syz_emit_ethernet(0x0, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="61994f19a4a59b11b088a35a8bd8e5a3e2c3a473b8c3aac634aab703de8d5a1fcaffe704be06f16054cd57e2113b11ceeedca6da3114682b47395601f32976486c922ff3a64119a23a9ef881b66da0128dc333435630c9ccddc8ce0e27bbbe39a4dda071bb1419881b7ba52260045f9d9b2ffa703ca869296e987e388b", 0x7d}], 0x1) execve(0x0, 0x0, 0x0) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, 0x0) ioctl$BIOCIMMEDIATE(0xffffffffffffffff, 0x80044270, 0x0) syz_emit_ethernet(0x4e, 0x0) socket$inet(0x2, 0x4000, 0x0) r1 = socket(0x11, 0x3, 0x0) setsockopt(r1, 0x11, 0x3, 0x0, 0x44) r2 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$DIOCRGETASTATS(r2, 0xc4504447, &(0x7f0000000600)={{'./bus\x00', './bus\x00', 0x48, 0x2}, 0x0, 0xa0, 0x0, 0x5, 0xe, 0x7, 0x6, 0x54, 0xce6}) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DIOCXBEGIN(r3, 0xc0104451, &(0x7f0000000300)={0x0, 0x4, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.13' (ED25519) to the list of known hosts. WuvARm_NIfNaGul: t(S0PxLf NffOTff 9L0O06WEcRd3EfD 20ON8 , SY0xSC9A8L, L0 ,7 41 )- 20->2 63e7 7k2e1r6n EelXI:T p 0a gae fStopped at savectx+0xae: movl $0,%gs:0x688 TID PID UID PRFLAGS PFLAGS CPU COMMAND *451219 37274 0 0 0 0 syz-executor 8020 37274 0 0 0x4000000 1K syz-executor savectx() at savectx+0xae end of kernel end trace frame: 0x751592323630, count: 14 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu1: uvm_fault(0xfffff9006cd3f208, 0x98, 0, 1) -> e ddb{0}> show kasan No such command ddb{0}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x751592323630, count: -1 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff80003b7a92f0 rbx 0 rdx 0 rcx 0xffff80003c3b8fb0 rax 0x3c r8 0xffff80003b7a9220 r9 0 r10 0x4b5a76ddf2c9918a r11 0xd25152e6606d0716 r12 0 r13 0 r14 0xffff80003c3b8fb0 r15 0 rip 0xffffffff8140b3ee savectx+0xae cs 0x8 rflags 0x46 rsp 0xffff80003b7a9270 ss 0x10 savectx+0xae: movl $0,%gs:0x688 ddb{0}> show proc PROC (syz-executor) tid=451219 pid=37274 tcnt=4 stat=onproc flags process=0 proc=0 runpri=50, usrpri=86, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003c3b9248,0xffff80003c3b82c8 process=0xffff80002a37f9d8 user=0xffff80003b7a4000, vmspace=0xfffff9006cd3f208 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND *37274 451219 40040 0 7 0 0 syz-executor 37274 343755 40040 0 2 0 0x4000000 syz-executor 37274 8020 40040 0 7 0 0x4000000 syz-executor 37274 316399 40040 0 3 0 0x4000080 fsleep syz-executor 59369 173917 89275 0 2 0 0 syz-executor 59369 331271 89275 0 3 0 0x4000080 fsleep syz-executor 46713 440223 36061 0 2 0x100002 0 sh 88893 387773 6287 0 2 0x2 0 sh 78286 426742 29831 0 2 0 0 syz-executor 88284 121273 66089 0 2 0 0 syz-executor 88284 339075 66089 0 3 0 0x4000080 fsleep syz-executor 88284 125854 66089 0 3 0 0x4000080 fsleep syz-executor 13536 196803 31937 0 2 0 0 syz-executor 13536 335797 31937 0 3 0 0x4000080 fsleep syz-executor 13536 286302 31937 0 3 0 0x4000080 fsleep syz-executor 88657 287304 28920 0 2 0 0 syz-executor 36061 297843 48316 0 3 0x2 0x80 wait syz-executor 40040 323053 48316 0 3 0x2 0x80 nanoslp syz-executor 28920 2910 48316 0 3 0x2 0x80 nanoslp syz-executor 66089 508536 48316 0 2 0x2 0 syz-executor 6287 177242 48316 0 3 0x2 0x80 wait syz-executor 31937 426155 48316 0 3 0x2 0x80 nanoslp syz-executor 29831 357558 48316 0 3 0x2 0x80 nanoslp syz-executor 89275 287002 48316 0 3 0x2 0x80 nanoslp syz-executor 48316 500117 10818 0 3 0x2 0x80 kqread syz-executor 10818 405908 88649 0 3 0x100002 0x88 sigsusp ksh 88649 159302 49866 0 3 0x10 0x88 kqread sshd-session 49866 140142 3710 0 3 0x12 0x80 kqread sshd-session 90648 180564 1 0 3 0x100003 0x80 ttyin getty 3710 148469 1 0 3 0 0x88 kqread sshd 76784 201170 78544 74 3 0x1100012 0x80 bpf pflogd 78544 65954 1 0 3 0 0x80 sbwait pflogd 1266 313191 21542 73 3 0x1100010 0x80 kqread syslogd 21542 414033 1 0 3 0x100002 0x80 sbwait syslogd 17433 17488 1 0 3 0x100000 0x80 kqread resolvd 49617 171214 61713 77 3 0x100012 0x80 kqread dhcpleased 7204 442228 61713 77 3 0x100012 0x80 kqread dhcpleased 61713 109051 1 0 3 0 0x80 kqread dhcpleased 81263 144247 0 0 3 0x14000 0x200 bored smr 3856 90102 0 0 2 0x14000 0x200 zerothread 72700 390558 0 0 3 0x14000 0x200 aiodoned aiodoned 64529 248350 0 0 3 0x14000 0x200 syncer update 72846 325469 0 0 3 0x14000 0x200 cleaner cleaner 95344 265965 0 0 3 0x14000 0x200 reaper reaper 71710 198434 0 0 3 0x14000 0x200 pgdaemon pagedaemon 57239 476943 0 0 3 0x14000 0x200 bored viomb 46147 511105 0 0 3 0x14000 0x40000200 acpi0 acpi0 7169 343852 0 0 3 0x14000 0x40000200 idle1 29758 456666 0 0 3 0x14000 0x200 bored softnet1 71182 423386 0 0 3 0x14000 0x200 bored softnet0 20102 195479 0 0 3 0x14000 0x200 smrbar systqmp 28594 231040 0 0 3 0x14000 0x200 bored systq 15746 239863 0 0 3 0x14000 0x200 tmoslp softclockmp 70516 9312 0 0 3 0x14000 0x40000200 tmoslp softclock 38176 53435 0 0 3 0x14000 0x40000200 idle0 1 268606 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex &map->flags_lock r = 0 (0xfffff9006cd3f380) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 vm_map_lock_ln+0x66 #3 uvm_map_protect+0xe0 #4 sys_mprotect+0x351 #5 syscall+0xbd4 #6 Xsyscall+0x128 Process 37274 (syz-executor) thread 0xffff80003c3b9ca8 (8020) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff839f8700) #0 witness_lock+0x5f1 #1 syscall+0xaf4 #2 Xsyscall+0x128 Process 20102 (systqmp) thread 0xffff800045ffe298 (195479) shared rwlock systqmp r = 0 (0xffffffff83991e98) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11051 12085K 12085K 166960K 12142 0 pcb 17 12K 12K 166960K 17 0 rtable 221 6K 6K 166960K 327 0 pf 34 17K 19K 166960K 47 0 ifaddr 41 7K 7K 166960K 43 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 4K 166960K 1485 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1322 83K 83K 166960K 1391 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 18 65K 93K 166960K 134 0 proc 70 115K 164K 166960K 546 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 4 0 in_multi 89 6K 6K 166960K 89 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 25 122K 122K 166960K 25 0 exec 0 0K 1K 166960K 378 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 218 160K 169K 166960K 3001 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 43 86K 104K 166960K 1280 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 26 1K 1K 166960K 26 0 temp 34 9114K 9120K 166960K 3839 0 kqueue 13 20K 24K 166960K 27 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 31 0 28 1 0 1 1 0 8 0 rtentry 176 103 0 1 5 0 5 5 0 8 0 unpcb 144 39 0 22 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 11 0 7 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 67 0 60 1 0 1 1 0 8 0 nd6 152 20 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 17 0 0 1 0 1 1 0 8 0 pfstkey 128 17 0 0 1 0 1 1 0 8 0 pfstate 448 17 0 0 2 0 2 2 0 8 0 pfrule 1360 21 0 15 2 0 2 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 412 0 0 26 0 26 26 0 8 0 art_table 40 413 0 0 5 0 5 5 0 8 0 art_node 32 103 0 7 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1562 0 95 92 0 92 92 0 8 0 ffsino 296 1562 0 95 113 0 113 113 0 8 0 nchpl 144 1758 0 59 63 0 63 63 0 8 0 vnodes 216 1682 0 0 94 0 94 94 0 8 0 namei 1024 5396 0 5396 2 0 2 2 0 8 2 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 6074 0 6074 4 1 3 3 1 8 3 plimitpl 152 29 0 12 1 0 1 1 0 8 0 sigapl 424 451 0 403 7 0 7 7 0 8 0 knotepl 120 480 0 0 15 0 15 15 0 8 0 kqueuepl 224 23 0 14 1 0 1 1 0 8 0 pipepl 344 126 0 99 3 0 3 3 0 8 0 fdescpl 528 435 0 403 3 0 3 3 0 8 0 filepl 160 1587 0 1344 11 0 11 11 0 8 0 lockfpl 104 39 0 4 1 0 1 1 0 8 0 lockfspl 48 37 0 2 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 32 0 15 1 0 1 1 0 8 0 ucredpl 104 83 0 70 1 0 1 1 0 8 0 zombiepl 144 403 0 403 1 0 1 1 0 8 1 processpl 1232 451 0 403 5 0 5 5 0 8 1 procpl 664 467 0 411 5 0 5 5 0 8 0 sockpl 752 137 0 110 4 0 4 4 0 8 1 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 115 0 0 15 0 15 15 0 8 0 mcl2k 2048 11 0 0 2 0 2 2 0 8 0 mextrefs 64 5 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 110 0 0 7 0 7 7 0 8 0 bufpl 272 2274 0 105 145 0 145 145 0 8 0 anonpl 32 3828 0 0 31 0 31 31 0 247 0 amapchunkpl 152 8245 0 7813 17 0 17 17 0 158 0 amappl16 200 1841 0 1827 5 0 5 5 0 8 4 amappl15 192 12 0 12 1 0 1 1 0 8 1 amappl14 184 427 0 425 1 0 1 1 0 8 0 amappl13 176 119 0 107 1 0 1 1 0 8 0 amappl12 168 681 0 651 2 0 2 2 0 8 0 amappl11 160 6 0 6 1 0 1 1 0 8 1 amappl10 152 64 0 50 1 0 1 1 0 8 0 amappl9 144 275 0 275 1 0 1 1 0 8 1 amappl8 136 95 0 94 1 0 1 1 0 8 0 amappl7 128 150 0 137 1 0 1 1 0 8 0 amappl6 120 155 0 151 1 0 1 1 0 8 0 amappl5 112 100 0 89 1 0 1 1 0 8 0 amappl4 104 285 0 266 1 0 1 1 0 8 0 amappl3 96 1404 0 1320 3 0 3 3 0 8 0 amappl2 88 552 0 476 2 0 2 2 0 8 0 amappl1 80 10457 0 9860 15 0 15 15 0 8 1 amappl 88 2291 0 2146 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 435 0 403 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 435 0 403 1 0 1 1 0 8 0 vmmpekpl 168 5632 0 5600 2 0 2 2 0 8 0 vmmpepl 168 37451 0 35614 86 0 86 86 0 357 1 vmsppl 488 434 0 403 5 0 5 5 0 8 1 rwobjpl 80 14475 0 13483 24 0 24 24 0 8 1 pdppl 4096 877 0 806 95 10 85 85 0 8 14 pvpl 32 8865 0 0 72 0 72 72 0 265 0 pmappl 256 434 0 403 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 401 0 12 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x751592323630, count: -1 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 acpitimer_delay(1) at acpitimer_delay+0x57 comcnputc(800,66) at comcnputc+0x29b cnputc(66) at cnputc+0x67 db_putchar(66) at db_putchar+0x36d kprintf() at kprintf+0x29c5 db_printf(ffffffff834b2754) at db_printf+0x9b db_ktrap(6,0,ffff80003c3c5060) at db_ktrap+0x1b6 kerntrap(ffff80003c3c5060) at kerntrap+0x243 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff80003c3b9ca8,fffff900666dd298,ffff80003c3c5240) at dovutimens+0x368 end trace frame: 0xffff80003c3c52b0, count: 0 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_4(b008,0) at x86_bus_space_io_read_4+0x37 acpitimer_delay(1) at acpitimer_delay+0x57 comcnputc(800,66) at comcnputc+0x29b cnputc(66) at cnputc+0x67 db_putchar(66) at db_putchar+0x36d kprintf() at kprintf+0x29c5 db_printf(ffffffff834b2754) at db_printf+0x9b db_ktrap(6,0,ffff80003c3c5060) at db_ktrap+0x1b6 kerntrap(ffff80003c3c5060) at kerntrap+0x243 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff80003c3b9ca8,fffff900666dd298,ffff80003c3c5240) at dovutimens+0x368 sys_futimes(ffff80003c3b9ca8,ffff80003c3c5390,ffff80003c3c52e0) at sys_futimes+0x208 syscall(ffff80003c3c5390) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xe94b0dd5750, count: -17