last executing test programs: 1.839496468s ago: executing program 1 (id=2): ioctl$DIOCADDRULE(0xffffffffffffffff, 0xcd604404, &(0x7f0000000f80)={0x4, 0x7, 0x2, './file0\x00', './file0\x00', 0x0, "ea7832fbdd4a2801794fc25559fc35d236a7b9a63f59de21b0aa2e0bebf8ef5d47eef0fcd742a34539993c88db8c951274691ccb14a662a8d90933c547e0d507689be5203e16f346a7fb25c3df9275e493638929b34bb9a9ea3141bf4d31ad2eef83d83dbb969113b6c1b5f8d80169ea051b13930468a911c91974aa7123d55b692b6ecf2b09db45b71b7221802fd137e055f88250cc1e7f7f761910ea500ac7a825197b6da6cb214557ef47c884a6b2972a1c48170cf19e02f0be10d0326c1eb1be44fde0b29d6057588b5ca153ea8ac10216a9955ba398104c191721b0c95de73d4cdf2d76bc782d374a6dab7a86b6b842deaa6d4ebbd8b96aa3f9a804fb75308205d2f071209b2850655c1bf52525d417a4ffd63309870123954c8860e04165561d0af2573a2c962e4a2e6d8487665bd738d281faafaa2ec2a6f025401bd4ee702721bedcbe190c2631352da52fc3c761f8ac240a2a3817f8de73c3dfa545d3f32d369d289e60c11509fcfd9286a788f6bee6461e57a7b58b4afe6d074597c16a260f68a2e8b80071bc21b70b310fc708c1e51b0eb6f3d1d7f13a1963e8db3e2eee12fe3505f9e8b2b4cce694c053e5774a4474beb24106635626572a647c1e4d479d03d399eff1c28b37bf2d7d039540eb4605383e426422fbd9b1c1f58be84c1e3bddbb3ed10226922866fa1ca4a25bacc24ae28e9f2f3264f081be6ceb2f3f6b52cbdf7721cf29e3e899255d99ea86b9d3e53bd8fee333191564b9840bd9385c063e05149a4eb27d33a4f5816b5c7e8cf2475c588838819dc253015c5125cb28068bcf89e707cd527d905775276c42bf9bcf4c5c569778f06cc99f561a3bf95dd5f74d0ba488da4d386ff9b1dcec8c996c907c4a4f0af020f4f5ecefcd9579f39528e9639041f214258a0319b901de363ab5ca4ac2c1343703018d1399abad28fffc0f555eeff79ad0cc8f487c3ec757a15eb7deef2b297102fd94c2afd6beb506db05d26803bb5b2e28c015699731e14c06ace56209666cfc5a9589e62e030f1750e17df55ed6437b0983f8d5e0e1ce6f08fb3bbe471c367d7971c1c5cabbd719681503d3f71f792c75287103164b88825ebd7d7a128d39b31a05440e582f849986839b2f566f8fbb684e43460defe1f161e29d24e667ca9fe36d5368a8a95eba6803d585bf82ef483cdab714940375965546a84351aac6fa818ccda5aa7115af0cefe884a6fdd40b62eec52a31e0f9340801d50dc81d26d5984f3b17320a978bc4caa9e07e551e8d797c524ba5ce4b7490d8939253e7e23966a6d7082a29fff41773e356e9f36965a83151dafba3594d0a26486c56cd6a5eb072d41b6f6bfef5cafd18a00534266f94833b4ba694a5fc2432ac87f34db9c9356e58d6d4bd4149eeee64e6d4c58724078ca550efefe92b2507d44fcd4f105ddff15e3703cff4cca40df52470fce81d1139c4a73d14004bd71a5609374d45d056d9a48f505de98b56f7ac6f3c9dc4f9e19808d94f44768ad1c4c600525248417c5dd92c922c2bbeada0b3a04a789031990011f5c4546ba89cf7a304b723737106a9c5e653ff554175cc68776d34935f20de26b82c6344faeae4eecbb7c01238c5e6fa9e628de638391d9b23bf4550cacb1abb9795bffddee81c52e1621b17728fd6ce7817ced4d6441abf9b5fa5657391dbcd434ae9c4cf4173c97aced95f3204fe4b8dd45879519a16cad046a405da57624ec1a808d88e72154c239025291b5b8451d1c4992acee587c3ed79087343cc4e275ab40af7f61339b1261a0cc889b21b2551fe17efe53b7b65c4466820ddec276d9dfe5b71528483fc204de2ffe6b1d4e99b66f21adb50a98259c5927c6e916b423bc131aaef373b5ab5d5a9991f8f6a7e37dd5f5bc66b4fba24d796ce51c47533ba"}) madvise(&(0x7f0000001000/0x9000)=nil, 0x9000, 0x2) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x672) r0 = openat$vnd(0xffffffffffffff9c, &(0x7f0000002a80), 0x80, 0x0) ioctl$VNDIOCSET(r0, 0xc0384600, &(0x7f0000002b00)={&(0x7f0000002ac0)='./file0\x00', 0x5, 0x0}) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x1, 0x6) connect$inet(r1, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) unveil(0x0, 0x0) pipe(0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2008, 0x1ea8) open(0x0, 0x8000, 0x49) r2 = open(&(0x7f0000000200)='./file0\x00', 0x9da, 0xc9) ioctl$DIOCGETQUEUES(r2, 0x80184404, 0x0) sysctl$net_inet6_ip6(&(0x7f0000000040)={0x4, 0x18, 0x29, 0x14}, 0x4, &(0x7f0000000080)="b6754afd229ce0e0c4974a759fbbaca219b636fc77dd02cea0fba3f0d59f077a373167a76f18b2ff34", &(0x7f0000000180)=0x29, 0x0, 0x0) close(r1) read(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000004200)) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x672) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x7c6, 0xea) read(r3, &(0x7f0000000100)=""/69, 0x45) sysctl$net_inet_tcp(&(0x7f0000000040)={0x4, 0x2, 0x6, 0x12}, 0x4, &(0x7f00000023c0), &(0x7f0000000000)=0x19, 0x0, 0xfffffffffffffe99) 1.672769038s ago: executing program 2 (id=3): sysctl$kern(&(0x7f0000000000)={0x1, 0x3e}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) sysctl$kern(&(0x7f0000000000)={0x1, 0x3e}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) sysctl$vm_swapencrypt(&(0x7f0000000000), 0x3, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x20, 0xd01) open(&(0x7f0000001980)='./file0\x00', 0x80, 0xc3) (async) r0 = open(&(0x7f0000001980)='./file0\x00', 0x80, 0xc3) openat$tty(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) ioctl$TIOCSETD(r0, 0x44946472, &(0x7f00000000c0)=0xffffffff) 1.643396905s ago: executing program 0 (id=1): openat$vmm(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socket$unix(0x1, 0x5, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pselect(0x40, &(0x7f0000000080)={0xe3, 0x1d, 0x101, 0x6, 0x8, 0xffffffff, 0x2, 0x8}, 0x0, 0x0, 0x0, 0x0) r1 = kqueue1(0x10004) kevent(r1, &(0x7f0000000040), 0x6, 0x0, 0x4, 0x0) ioctl$WSDISPLAYIO_GETSCREENTYPE(r0, 0xc028575d, &(0x7f0000000100)={0xc, 0x5, './file0\x00', 0x4, 0x816, 0x1000000, 0xddd}) syz_emit_ethernet(0x42, &(0x7f0000000000)={@local, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x2, 0x36, 0x34, 0x68, 0x0, 0x1, 0x8, 0x0, @remote={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}}, @tcp={{0x3, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x100, {[@timestamp={0x8, 0xa, 0x7, 0x80000000}]}}}}}}}) socket$inet(0x2, 0x5004, 0x85) closefrom(r0) 1.412412614s ago: executing program 2 (id=9): sysctl$kern(&(0x7f00000013c0)={0x1, 0x77}, 0x2, 0x0, 0x0, &(0x7f0000001500), 0x0) sysctl$kern(&(0x7f00000013c0)={0x1, 0x77}, 0x2, 0x0, 0x0, &(0x7f0000001500), 0x0) (async) 1.408782741s ago: executing program 2 (id=10): r0 = syz_open_pts() ioctl$TIOCDRAIN(r0, 0x2000745e) (async) ioctl$TIOCSETD(r0, 0x8004741b, &(0x7f0000000000)=0x31cd) (async) closefrom(r0) r1 = socket$inet(0x2, 0x8000, 0x7) r2 = dup(r1) connect$inet6(r2, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x800, "55a26282d7e0f56ec336433a84a58741", 0x400}, 0x1c) (async, rerun: 32) r3 = accept$inet(r2, &(0x7f0000000080), &(0x7f00000000c0)=0x10) (async, rerun: 32) ioctl$DIOCRSETADDRS(r2, 0xc4504445, &(0x7f0000000140)={{'./file0\x00', './file0\x00', 0x2, 0xf6}, &(0x7f0000000100)=[{@local={0xac, 0x14, 0x0}, '\x00', './file0\x00', 0x6, 0x7, 0x18, 0x2, 0x6, 0x2c, 0x4}], 0x4, 0x1, 0x4, 0x7f, 0xa, 0xb8, 0x4, 0x6}) bind$inet(r1, &(0x7f00000005c0)={0x10, 0x2, 0x1, 0x1}, 0x10) getsockopt$SO_PEERCRED(r3, 0xffff, 0x1022, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0xc) seteuid(r5) (async) ioctl$TIOCSBRK(r2, 0x2000747b) (async, rerun: 32) r7 = dup2(r2, 0xffffffffffffffff) (async, rerun: 32) setsockopt(r3, 0x0, 0x9, &(0x7f0000000640)="548c8d98d0110cc358af3dc786027694fd2bc529ee02919b696c1c8d32c235c4d292f470a9bf1b706bca58cb003896c5a822af8eec3b270424b0fa0e3f28fbfdebd805bc3bea3ec2cb9a854c48776dcc2445d1b6b07b27b9d05f984955b55bb37b499f104886858c3c046027bddb594110831e243c3f591869ec9627ce9122e9c7d906799d387070b2f90fc3ad3b684ccea082e62d303b706b1efae238f0ed5e78bb08f79cbc64a423f0e132d5e32cda853c0a2638bd044a390871301021e2", 0xbf) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000700)={0x10, 0x2, 0x3, 0xf}, 0x10) (async) ioctl$WSMOUSEIO_GTYPE(r2, 0x40045720, &(0x7f0000000740)) r8 = msgget$private(0x0, 0x8) msgctl$IPC_SET(r8, 0x1, &(0x7f0000000780)={{r5, r6, r5, 0xffffffffffffffff, 0x10, 0x2}, 0x0, 0x0, 0x4, 0x390, 0xffffffffffffffff, r4, r4, 0x7f, 0x0, 0x7, 0x0, 0x100000001}) (async) openat$wskbd(0xffffffffffffff9c, &(0x7f0000000840), 0x400, 0x0) ioctl$FIOASYNC(0xffffffffffffffff, 0x8004667d, &(0x7f0000000880)=0x8) (async) ioctl$VNDIOCSET(r2, 0xc0384600, &(0x7f0000000940)={&(0x7f00000008c0)='./file1\x00', 0x3, &(0x7f0000000900)='./file0\x00', 0x8}) (async) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000980)={'tap', 0x0}) (async) ioctl$AUDIO_GETPOS_ctl(r7, 0x40104123, &(0x7f00000009c0)) (async) shmget$private(0x0, 0x2000, 0x4a7, &(0x7f0000ffd000/0x2000)=nil) (async) fstatat(r7, &(0x7f0000000a00)='./file0\x00', &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2) setuid(r9) ioctl$TIOCSTOP(r2, 0x2000746f) (async) writev(r3, &(0x7f0000000d40)=[{&(0x7f0000000ac0)="c84208bb135af8a952d59b355aef32cc93337ed4d04e236f21144b4fd0b08726638154bf3eb3ed61916eb0fecaf7f54ee515bd182a421ca8e61c7aa4433faba80f0d753b0cb18da8a9a29cdb235787fd877c014da83790331698b013437429a32e57fbe0b0a346cbf5aa9d4fbca1116425b49eae61caa2084250faf0bff1981b8359747f8bc4e9a452b06604acdc60f5b2158bc0b253e646f9c216d97bc9b21326e7fec87f64c70f77a843961db30097fcb81d7795474806207d080c0c78fd728a57ddfae1", 0xc5}, {&(0x7f0000000bc0)="581bf2159b82995be4cefb99a536106eff1ec5308ad04f15feb94a21fe44babe932d67b36c9a2634501fc2ab5e0d9c02ebc5b08675fb56bd1defc2d541d7f647d3bde2ea589cfd552440fd11b2b0175c4d75c67c", 0x54}, {&(0x7f0000000c40)}, {&(0x7f0000000c80)="6f89fb090b28b95b1dbc80e0d169ecb48cb8d1d90ff2ec84", 0x18}, {&(0x7f0000000cc0)="f194ade6b55b4cd2ca133a9ec7bc4e8a53c912f2477211c8c1ea064122cc17c1fc2fc7afbf681f9488f51be5bd18bb1a06cdb09c480e1913595e9d5971ecfcebc5db4e74093a09ab5e5b5f09b26f528687916fd9af6a5d592b31ea63c3adb9889469649d1f6475fb7e61bfc321ffc503687a343d9d428fe8d2caa0150261", 0x7e}], 0x5) (async) poll(&(0x7f0000000e00)=[{r2, 0x1}, {r1, 0x100}, {0xffffffffffffffff, 0x40}, {0xffffffffffffffff, 0x40}, {0xffffffffffffffff, 0x2}, {r1, 0x2}], 0x6, 0x2) 1.407238504s ago: executing program 2 (id=11): r0 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000000), 0x109, 0x0) ioctl$WSMOUSEIO_SETMODE(r0, 0x80045726, &(0x7f0000000040)={0x1}) ioctl$WSMOUSEIO_SETPARAMS(r0, 0x80105728, &(0x7f00000000c0)={&(0x7f0000000080)=[{0x100, 0x5}, {0x8, 0x289}, {0x8c, 0x83c9}, {0x20, 0x572}, {0x87, 0x7fffffff}, {0x8d, 0x4ba}, {0x16c, 0xb}], 0x7}) r1 = socket$unix(0x1, 0x5, 0x0) r2 = setsid() getresuid(&(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) fstatat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getsid(0x0) r7 = getgid() r8 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000440), 0x800, 0x0) r9 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) sendmsg$unix(r1, &(0x7f0000000540)={&(0x7f0000000100)=@abs={0xe5, 0x1, 0x0, 0x3}, 0x8, &(0x7f00000001c0)=[{&(0x7f0000000140)="35090e2e0d34bfd87856a40ec62a02c518f29490104352d7de501ce6ed5ce73711937017aed110d652c188c9561e0820268eb357d5b1799a9b3e5e236f286428ffa2263360c965bd45172344f31a906194271b7576f40ad648aaef7c73d77e", 0x5f}], 0x1, &(0x7f00000004c0)=[@cred={0x18, 0xffff, 0x0, r2, r3}, @cred={0x18, 0xffff, 0x0, 0xffffffffffffffff, r4, r5}, @cred={0x18, 0xffff, 0x0, r6, 0x0, r7}, @rights={0x1c, 0xffff, 0x1, [r0, r0, r0, r0]}, @rights={0x18, 0xffff, 0x1, [r8, r9, r0]}], 0x7c, 0x5}, 0x400) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4) getuid() r10 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) stat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) shmctl$IPC_SET(r10, 0x1, &(0x7f0000000640)={{r11, r5, r4, r5, 0x1, 0x80, 0x0, 0x0, 0x1}, 0x4, r6, r2, 0x3, 0x0, 0x1, 0x8a, 0x7, 0xc, 0x1, 0x6}) kqueue1(0x4) ioctl$BIOCSETIF(r9, 0x8020426c, &(0x7f00000006c0)={'tap', 0x0}) setrlimit(0x1, &(0x7f0000000700)={0x4, 0x5a}) getrlimit(0x4, &(0x7f0000000740)) r12 = openat$pf(0xffffffffffffff9c, &(0x7f0000000780), 0x10000, 0x0) fcntl$lock(r12, 0x8, &(0x7f00000007c0)={0x3, 0x1, 0x2, 0x8, r2}) mkdirat(r9, &(0x7f0000000800)='./file0\x00', 0x1) r13 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000840), 0x400, 0x0) ioctl$WSMOUSEIO_GETPARAMS(r13, 0x80105727, &(0x7f00000008c0)={&(0x7f0000000880)=[{0x48, 0x2}], 0x1}) ioctl$DIOCGETSTATE(r8, 0xc1084413, &(0x7f0000000900)={{0x2, './file0\x00', [{[@v4=@remote={0xac, 0x14, 0x0}, @v6=@rand_addr="325d2767aa6f51305d74028937094994"], [0x7, 0x1], 0x10}, {[@v4, @v4=@remote={0xac, 0x14, 0x0}], [0x1, 0x5], 0x9, 0x2}], {{0x100, 0x80, 0x7f, 0x1}, 0xb1, 0x2, 0x4, 0xace6, 0x9, 0xfe, 0x3}, {{0x43, 0xfe, 0xc, 0x2}, 0x8, 0x400000, 0x1, 0x0, 0x8, 0x7, 0xe2}, @v4, 0x8, 0x9, 0x9, 0x8, 0x27, [[0x101, 0x5], [0xdd, 0x1]], [[0x1, 0x2], [0x80000001, 0xa]], 0x8df2e8c5, [0x4], 0x800, 0x0, 0x0, 0x2, 0x9, 0x9, 0x7, 0x5, 0x81, 0x9, 0x40, 0x4, "48c0"}}) getsockopt$SO_PEERCRED(r1, 0xffff, 0x1022, &(0x7f0000000a80)={0x0, 0x0}, 0xc) fchownat(0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', r14, 0x0, 0x6) 1.378379842s ago: executing program 6 (id=7): r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x200, 0x0) mknod$loop(&(0x7f0000000580)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x0) linkat(r0, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r0, &(0x7f0000000280)='./file1\x00', 0x4) mkfifo(&(0x7f0000001380)='./file0\x00', 0x8) open(&(0x7f00000000c0)='./file0\x00', 0x7c6, 0xea) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x200, 0x0) ioctl$FIOASYNC(r1, 0xc0106978, &(0x7f0000000580)=0x7) ktrace(&(0x7f0000000000)='./file0\x00', 0x4, 0x1104, 0xffffffffffffffff) pselect(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x8000000000000000, 0xffffffffffffffff}, 0x0) 177.291424ms ago: executing program 0 (id=12): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000080)={0x3, &(0x7f00000000c0)=[{0x4, 0x4, 0x1, 0x1}, {0x2, 0x5, 0xf9}, {0xd9e6, 0x9, 0x3, 0x400007}]}) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000580)={'tap', 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000480)={@local, @local, [], {@ipv6={0x86dd, {0x8, 0x6, "595b81", 0x30, 0x2c, 0x4, @empty, @mcast2, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0xa, {0x4, 0x6, '\x00\x00\b', 0xf000, 0x62, 0x1, @ipv4={'\x00', '\xff\xff', @empty=0xfeff}, @mcast2}}}}}}}) 169.755702ms ago: executing program 1 (id=13): r0 = getpgrp() syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x2, 0x36, 0x30, 0x68, 0x0, 0x5, 0x1, 0x0, @multicast1, @remote={0xac, 0x14, 0x0}}, @icmp=@redirect={0x5, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, {0x5, 0x4, 0x1, 0x14, 0x7, 0x65, 0x2, 0x7, 0x2f, 0x9, @loopback, @loopback}}}}}}) ktrace(0x0, 0xe2fc5e0623494925, 0x40000800, r0) ktrace(&(0x7f0000000240)='./file0\x00', 0x2, 0x40002810, r0) sysctl$hw(&(0x7f0000000000)={0x6, 0x13}, 0x2, &(0x7f0000000040)="a7c720461d8c3999", &(0x7f0000000100)=0x8, 0x0, 0x0) (async) r1 = msgget$private(0x0, 0x40) (async) fstat(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r4, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) setresuid(r5, 0x0, r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) chown(&(0x7f0000000040)='./file0\x00', r7, r8) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000380)={{r2, r3, r5, r8, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0x0, 0x3, 0x3, 0x8000000000000000, r0, r0, 0x2, 0x0, 0x321a, 0x0, 0x2}) (async) sysctl$hw(&(0x7f0000000080)={0x6, 0x1}, 0x2, &(0x7f00000000c0)="036e78505558f4abd9cfd43ebe1c2413b1b329a55b7f9377c0a7eb3dac737c2fa57556454c94357289d371008e694bef4599b8d4c361dde22d", &(0x7f0000000140)=0x39, &(0x7f0000000180)="181e48b70c0c1e936b19ddf96aa45358aaf65434dd38d5b096ed40e71d2cb7af04fe17eab0e900ee9d2ff4904ff55c0bfc4c78bc3f3cbf030917049b575146c4cbb4fa563481e0773cdf41dd0e0f0a4bfbdd24a0c9006d925f573136ede63bae40cef5107459bc254ce20fb6c43e8043e4c7ffe3bca43f8606141326cbe01ec1b4e4f2b5861dd0a38921be7c4ea14d19e8b8cd9880d23283c92dabb0fc1329eae65b4b", 0xa3) 161.24887ms ago: executing program 7 (id=8): r0 = socket$inet6(0x18, 0x1, 0x0) shutdown(r0, 0x0) r1 = fcntl$dupfd(r0, 0xc, r0) getdents(r1, &(0x7f0000000040)=""/5, 0x5) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x18, 0x1, 0x41, "00000000000000000000000000000001", 0xc0000}, 0x1c) 10.193013ms ago: executing program 6 (id=14): r0 = syz_open_pts() r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) ioctl$BIOCSBLEN(r1, 0xc0044266, &(0x7f0000000040)=0x8) ioctl$BIOCSETF(r1, 0x80104267, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x24, 0x0, 0xff, 0x7}, {0x0, 0x15, 0x24, 0x2}, {0xfffe, 0x40, 0xd7, 0xfffffff7}]}) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f0000000440)={'tap', 0x0}) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x20000, 0x41) r4 = kqueue() kevent(r4, &(0x7f00000009c0)=[{{}, 0xfffffffffffffffb, 0x18, 0x2, 0x401, 0x8}], 0xc, 0x0, 0x8000, &(0x7f0000000c80)={0x0, 0xafc9}) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5cc2) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x4828a, 0x80) pledge(0x0, &(0x7f0000000180)='\x00\xc9\x9f\x80\xad2\xb0],`\xf8\xe9\x81W?\x1fD\x00') pwritev(r5, &(0x7f00000000c0)=[{0x0}], 0x100000000000013f, 0xfffffffffffffffe) closefrom(r2) pwritev(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x8) sysctl$vfs_nfs(&(0x7f0000000000)={0xa, 0x2, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x0) openat(r3, &(0x7f0000000140)='./file1\x00', 0x40080, 0x19) sysctl$kern(&(0x7f00000001c0)={0x1, 0x59}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x4) sysctl$kern(&(0x7f00000002c0)={0x1, 0xa}, 0x2, &(0x7f0000000300)="08dddf2c", &(0x7f00000003c0)=0x4, &(0x7f0000000400), 0x0) sysctl$vm_swapencrypt(&(0x7f0000000000), 0x3, &(0x7f0000000040), &(0x7f0000000100), 0x0, 0x0) open$dir(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) ppoll(&(0x7f0000000180)=[{r0, 0x80}], 0x1, 0x0, 0x0) 9.45693ms ago: executing program 4 (id=5): seteuid(0xffffffffffffffff) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000780), 0x7c736ca2d3cfdd8, 0x0) socket$inet6(0x18, 0x1, 0x6) (async) r1 = socket$inet6(0x18, 0x1, 0x6) setsockopt(r1, 0x29, 0x31, 0x0, 0x0) (async) setsockopt(r1, 0x29, 0x31, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r2, 0x7, 0x0) ioctl$KDENABIO(r0, 0x20004b3c) syz_emit_ethernet(0x117, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6f00000000e10600fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e214e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="601000079078008001000000efd764e1d42339723f4a77038760f45a"]) 3.369583ms ago: executing program 0 (id=15): r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x20000, 0x90) getdents(r0, &(0x7f0000000080)=""/121, 0x79) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$DIOCXCOMMIT(r1, 0xc0104452, &(0x7f0000001380)={0x4, 0x0, &(0x7f0000000340)=[{0x1, './file0\x00', 0x6}, {0x1, './file0\x00', 0x8}, {0x1, './file0\x00'}, {0x1, './file0\x00', 0x40}]}) sysctl$vfs_nfs(&(0x7f0000000000)={0xa, 0x2, 0x4}, 0x3, 0x0, 0x0, 0x0, 0x0) socket$inet(0x2, 0x3, 0x9) sysctl$kern(&(0x7f00000002c0)={0x1, 0x27}, 0x4000004f, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x4) r2 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) ioctl$DIOCRGETTABLES(r2, 0xc450443f, &(0x7f0000000dc0)={{'./file0\x00', './file0\x00', 0x42, 0x4}, 0x0, 0xfffffff8, 0x0, 0x0, 0x81, 0x10, 0x7, 0x60}) ioctl$TIOCSTAT(0xffffffffffffffff, 0x20007465) ioctl$TIOCSETD(r2, 0x8004741b, &(0x7f00000013c0)=0x9) getsockname(r2, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0x1c, 0x18, 0x3, 0x400, "000000000000f400", 0x9}, 0x1c) sysctl$kern(&(0x7f0000000000)={0x1, 0x55}, 0x1, 0x0, 0x0, 0x0, 0x39) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) sysctl$kern(&(0x7f0000000000)={0x1, 0x59}, 0x3, &(0x7f0000000180)="ee8f409198157e3b0d482cd811439e57ce10400116e4853368b7858dd5313a55267eae31dfdeb4695f32fe7b7ad86f86b9026db90f9b45d9c0dfe6f336cdbed0b1e9503fb71d22c07e97988cb677f6e039bda806b77d270400"/104, &(0x7f0000000080)=0x5b, 0x0, 0xfffa) ioctl$WSMOUSEIO_SETPARAMS(r2, 0x80105728, &(0x7f0000001d80)={&(0x7f0000001d40)=[{0x2, 0xc560}, {0x3, 0x9}, {0x100, 0x401}], 0x3}) sysctl$vfs_nfs(&(0x7f0000000280)={0xa, 0x2, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x4}, {r0, 0x20}], 0x2, &(0x7f0000000140)={0x3c81, 0x6}, &(0x7f0000000180)={0xf4}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffff9c, 0xc01864c6, &(0x7f0000000200)={&(0x7f00000001c0)=[0x1, 0x6, 0xc0, 0xd], 0x4, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_RMFB(r3, 0xc00464af, &(0x7f0000000240)) 1.703781ms ago: executing program 2 (id=16): r0 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000000), 0x10, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000040), &(0x7f0000000080)=0xc) ioctl$WSMUXIO_REMOVE_DEVICE(r0, 0x80085762, &(0x7f0000000240)={0x2, 0x4}) 214.87µs ago: executing program 0 (id=17): r0 = syz_open_pts() ioctl$TIOCSETAW(r0, 0x802c7415, &(0x7f00000019c0)={0x8000003, 0x6, 0x611d, 0xfffd, "fe83017a550000fe02bfabb685ffffffffffea00", 0x3, 0x8}) (async) syz_emit_ethernet(0xa6, &(0x7f0000000000)=ANY=[]) 0s ago: executing program 2 (id=18): syz_emit_ethernet(0x8e, &(0x7f0000000000)=ANY=[]) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.82' (ED25519) to the list of known hosts. KASAN: invalid read of 4 bytes at 0xffffffff84ecba04 from pc 0xffffffff83a6bddd KASAN: first bad byte at 0xffffffff84ecba04 (+0); shadow 0xfa: global redzone (out-of-bounds) KASAN: 0xffffffff84ecba04 is 708 bytes to the right of the 8160-byte global 'cdevsw' (/syzkaller/managers/kasan/kernel/sys/arch/amd64/amd64/conf.c) KASAN: pc: checkalias+0x47d KASAN: call trace: #0 __asan_load4_noabort+0x82 #1 checkalias+0x47d #2 ffs_vinit+0x227 #3 ffs_vget+0x748 #4 ufs_lookup+0x15c1 #5 VOP_LOOKUP+0xda #6 vfs_lookup+0xfbd #7 namei+0xe19 #8 vn_open+0x240 #9 doopenat+0x460 #10 sys_open+0x86 #11 syscall+0x1089 #12 Xsyscall+0x128 KASAN: shadow of 0xffffffff84ecb900..0xffffffff84ecbb80 (1 cell = 8 bytes): 0xffffffff84ecb900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0xffffffff84ecb980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa >0xffffffff84ecba00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0xffffffff84ecba80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0xffffffff84ecbb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope panic: Caught invalid memory access at ffffffff84ecba04 size 4 op 0 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND 264703 32661 0 0x100002 0 1 sh *122520 28188 0 0 0x4000000 0K syz-executor db_enter() at db_enter+0x17 panic(ffffffff8463738e) at panic+0x270 __asan_load4_noabort(ffffffff84ecba04) at __asan_load4_noabort+0xa3 checkalias(ffff800001d1fdc8,6e56) at checkalias+0x47d ffs_vinit(ffff800000d80800,ffff80003bb4fd20) at ffs_vinit+0x227 ffs_vget(ffff800000d80800,6658,ffff80003bb4fee0) at ffs_vget+0x748 ufs_lookup() at ufs_lookup+0x15c1 VOP_LOOKUP(ffff800001ca4988,ffff80003bb507c0,ffff80003bb507f0) at VOP_LOOKUP+0xda vfs_lookup(ffff80003bb50790) at vfs_lookup+0xfbd namei(ffff80003bb50790) at namei+0xe19 vn_open(ffff80003bb50790,2,0) at vn_open+0x240 doopenat(ffff800045fec028,ffffff9c,200000001980,1,0,0,ffff80003bb50b00) at doopenat+0x460 sys_open(ffff800045fec028,ffff80003bb50b00,ffff80003bb50a60) at sys_open+0x86 syscall(ffff80003bb50b00) at syscall+0x1089 end trace frame: 0xffff80003bb50b80, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: Caught invalid memory access at ffffffff84ecba04 size 4 op 0 ddb{0}> show kasan KASAN: invalid read of 4 bytes at 0xffffffff84ecba04 from pc 0xffffffff83a6bddd KASAN: first bad byte at 0xffffffff84ecba04 (+0); shadow 0xfa: global redzone (out-of-bounds) KASAN: 0xffffffff84ecba04 is 708 bytes to the right of the 8160-byte global 'cdevsw' (/syzkaller/managers/kasan/kernel/sys/arch/amd64/amd64/conf.c) KASAN: pc: checkalias+0x47d KASAN: call trace: #0 __asan_load4_noabort+0x82 #1 checkalias+0x47d #2 ffs_vinit+0x227 #3 ffs_vget+0x748 #4 ufs_lookup+0x15c1 #5 VOP_LOOKUP+0xda #6 vfs_lookup+0xfbd #7 namei+0xe19 #8 vn_open+0x240 #9 doopenat+0x460 #10 sys_open+0x86 #11 syscall+0x1089 #12 Xsyscall+0x128 KASAN: shadow of 0xffffffff84ecb900..0xffffffff84ecbb80 (1 cell = 8 bytes): 0xffffffff84ecb900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0xffffffff84ecb980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa >0xffffffff84ecba00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0xffffffff84ecba80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0xffffffff84ecbb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope ddb{0}> trace db_enter() at db_enter+0x17 panic(ffffffff8463738e) at panic+0x270 __asan_load4_noabort(ffffffff84ecba04) at __asan_load4_noabort+0xa3 checkalias(ffff800001d1fdc8,6e56) at checkalias+0x47d ffs_vinit(ffff800000d80800,ffff80003bb4fd20) at ffs_vinit+0x227 ffs_vget(ffff800000d80800,6658,ffff80003bb4fee0) at ffs_vget+0x748 ufs_lookup() at ufs_lookup+0x15c1 VOP_LOOKUP(ffff800001ca4988,ffff80003bb507c0,ffff80003bb507f0) at VOP_LOOKUP+0xda vfs_lookup(ffff80003bb50790) at vfs_lookup+0xfbd namei(ffff80003bb50790) at namei+0xe19 vn_open(ffff80003bb50790,2,0) at vn_open+0x240 doopenat(ffff800045fec028,ffffff9c,200000001980,1,0,0,ffff80003bb50b00) at doopenat+0x460 sys_open(ffff800045fec028,ffff80003bb50b00,ffff80003bb50a60) at sys_open+0x86 syscall(ffff80003bb50b00) at syscall+0x1089 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x22debabe530, count: -15 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003bb4f9b0 rbx 0xffff80003bb4fa20 rdx 0 rcx 0xffffffff85221ff0 cpu_info_full_primary+0x1ff0 rax 0xffff80000015cb00 r8 0x101010101010101 r9 0x8080808080808080 r10 0xffff80003bb4f798 r11 0xffffffff81b873f0 x86_bus_space_io_read_1 r12 0xffffffff8463738e .str.28+0x9d9ae r13 0xffffffff85222c08 cpu_info_full_primary+0x2c08 r14 0xffffffff85222e07 cpu_info_full_primary+0x2e07 r15 0x1 rip 0xffffffff820d6ab7 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff80003bb4f9b0 ss 0x10 db_enter+0x17: popq %rbp ddb{0}> show proc PROC (syz-executor) tid=122520 pid=28188 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045feca88,0xffff800045fecd30 process=0xffff800045ff1358 user=0xffff80003bb45000, vmspace=0xffff800001c9b7c0 estcpu=36, cpticks=19, pctcpu=0.0, user=0, sys=19, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 32661 264703 25476 0 7 0x100002 0 sh 40903 157635 30250 0 2 0 0 syz-executor 40903 419624 30250 0 3 0 0x4000080 fsleep syz-executor 28188 267365 81017 0 2 0 0 syz-executor *28188 122520 81017 0 7 0 0x4000000 syz-executor 62703 506944 73893 0 2 0 0 syz-executor 24490 420071 33208 0 2 0 0 syz-executor 40843 457159 97184 0 2 0x400000 0 syz-executor 40843 361250 97184 0 3 0x400000 0x4000080 kqpoll syz-executor 20940 456576 94195 0 2 0x100002 0 sh 56628 201589 83395 0 2 0x10000002 0xc80 syz-executor 97184 491827 83395 0 2 0x2 0xc80 syz-executor 94195 1955 83395 0 3 0x2 0x80 wait syz-executor 73893 179878 83395 0 2 0x2 0 syz-executor 25476 244969 83395 0 3 0x2 0x80 wait syz-executor 33208 424829 83395 0 2 0x2 0xc80 syz-executor 81017 417720 83395 0 2 0x2 0xc80 syz-executor 30250 402577 83395 0 2 0x2 0xc80 syz-executor 83395 124285 31008 0 3 0x2 0x80 kqread syz-executor 31008 300517 29319 0 3 0x100002 0x88 sigsusp ksh 29319 396579 25918 0 3 0x10 0x88 kqread sshd-session 25918 150213 44750 0 3 0x12 0x80 kqread sshd-session 47907 144496 1 0 3 0x100003 0x80 ttyin getty 44750 493240 1 0 3 0 0x88 kqread sshd 4638 341920 52624 74 3 0x1100012 0x80 bpf pflogd 52624 458604 1 0 3 0 0x80 sbwait pflogd 44056 282196 93716 73 2 0x1100010 0x80 syslogd 93716 288564 1 0 3 0x100002 0x80 sbwait syslogd 44951 409814 1 0 3 0x100000 0x80 kqread resolvd 33455 302093 58188 77 3 0x100012 0x80 kqread dhcpleased 70305 399934 58188 77 3 0x100012 0x80 kqread dhcpleased 58188 103520 1 0 3 0 0x80 kqread dhcpleased 73599 471956 0 0 2 0x14000 0x200 smr 91457 327034 0 0 2 0x14000 0x200 zerothread 26508 354513 0 0 3 0x14000 0x200 aiodoned aiodoned 3250 230573 0 0 3 0x14000 0x200 syncer update 60276 474585 0 0 3 0x14000 0x200 cleaner cleaner 17120 495100 0 0 3 0x14000 0x200 reaper reaper 72294 200485 0 0 3 0x14000 0x200 pgdaemon pagedaemon 17968 302524 0 0 3 0x14000 0x200 bored viomb 3213 480759 0 0 3 0x14000 0x40000200 acpi0 acpi0 48697 408626 0 0 3 0x14000 0x40000200 idle1 65227 398016 0 0 3 0x14000 0x200 bored softnet1 22714 460625 0 0 2 0x14000 0x200 softnet0 97171 20383 0 0 3 0x14000 0x200 smrbar systqmp 73966 234858 0 0 3 0x14000 0x200 bored systq 45975 430512 0 0 2 0x14000 0x200 softclockmp 65584 142515 0 0 3 0x14000 0x40000200 tmoslp softclock 2977 109993 0 0 3 0x14000 0x40000200 idle0 1 208350 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 28188 (syz-executor) thread 0xffff800045fec028 (122520) exclusive rrwlock inode r = 0 (0xffff8000019d88b8) #0 witness_lock+0x632 #1 rw_do_enter_write+0x53e #2 rrw_enter+0xf0 #3 VOP_LOCK+0x17e #4 ufs_ihashins+0xda #5 ffs_vget+0x2e9 #6 ufs_lookup+0x15c1 #7 VOP_LOOKUP+0xda #8 vfs_lookup+0xfbd #9 namei+0xe19 #10 vn_open+0x240 #11 doopenat+0x460 #12 sys_open+0x86 #13 syscall+0x1089 #14 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xffff800001c5d468) #0 witness_lock+0x632 #1 rw_do_enter_write+0x53e #2 rrw_enter+0xf0 #3 VOP_LOCK+0x17e #4 vn_lock+0xca #5 vfs_lookup+0x1f7 #6 namei+0xe19 #7 vn_open+0x240 #8 doopenat+0x460 #9 sys_open+0x86 #10 syscall+0x1089 #11 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85d77a80) #0 witness_lock+0x632 #1 doopenat+0x445 #2 sys_open+0x86 #3 syscall+0x1089 #4 Xsyscall+0x128 Process 97171 (systqmp) thread 0xffff800045ffe298 (20383) shared rwlock systqmp r = 0 (0xffffffff852070f8) #0 witness_lock+0x632 #1 taskq_thread+0x1ba #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11058 12245K 12325K 166960K 12159 0 pcb 17 24K 24K 166960K 17 0 rtable 233 12K 12K 166960K 345 0 pf 34 22K 22K 166960K 45 0 ifaddr 43 12K 12K 166960K 45 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 13K 166960K 5 0 counters 70 42K 42K 166960K 70 0 ioctlops 0 0K 4K 166960K 1483 0 iov 0 0K 8K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1296 84K 84K 166960K 1373 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 2K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 17 61K 93K 166960K 146 0 proc 69 128K 209K 166960K 551 0 subproc 72 9K 9K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 4 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 37 263K 263K 166960K 37 0 exec 0 0K 2K 166960K 389 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 14 124K 124K 166960K 15 0 UVM amap 206 235K 250K 166960K 3254 0 UVM aobj 4 4K 4K 166960K 4 0 pinsyscall 1066 1716K 1727K 166960K 1326 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 16 0K 1K 166960K 28 0 temp 35 9162K 9172K 166960K 3928 0 kqueue 14 41K 48K 166960K 29 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 34 0 31 1 0 1 1 0 8 0 rtentry 176 109 0 1 5 0 5 5 0 8 0 unpcb 144 51 0 33 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 10 0 6 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 69 0 61 2 0 2 2 0 8 1 nd6 152 22 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 19 0 0 1 0 1 1 0 8 0 pfstkey 128 19 0 0 1 0 1 1 0 8 0 pfstate 448 19 0 0 3 0 3 3 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 451 0 0 29 0 29 29 0 8 0 art_table 40 452 0 0 5 0 5 5 0 8 0 art_node 32 109 0 10 1 0 1 1 0 8 0 shmpl 112 1 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1584 0 116 92 0 92 92 0 8 0 ffsino 296 1584 0 116 113 0 113 113 0 8 0 nchpl 144 1793 0 94 64 0 64 64 0 8 0 vnodes 216 1676 0 0 94 0 94 94 0 8 0 namei 1024 5511 0 5510 1 0 1 1 0 8 0 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 6670 0 6670 3 1 2 2 1 8 2 plimitpl 152 30 0 13 1 0 1 1 0 8 0 sigapl 424 472 0 424 7 0 7 7 0 8 1 knotepl 120 57 0 0 2 0 2 2 0 8 0 kqueuepl 224 28 0 17 1 0 1 1 0 8 0 pipepl 344 131 0 104 3 0 3 3 0 8 0 fdescpl 528 456 0 425 3 0 3 3 0 8 0 filepl 160 1631 0 1416 10 0 10 10 0 8 0 lockfpl 104 8 0 6 1 0 1 1 0 8 0 lockfspl 48 5 0 3 1 0 1 1 0 8 0 sessionpl 144 25 0 16 1 0 1 1 0 8 0 pgrppl 48 33 0 16 1 0 1 1 0 8 0 ucredpl 104 89 0 76 1 0 1 1 0 8 0 zombiepl 144 425 0 424 1 0 1 1 0 8 0 processpl 1232 472 0 424 5 0 5 5 0 8 1 procpl 664 501 0 450 6 0 6 6 0 8 1 sockpl 752 154 0 125 4 0 4 4 0 8 0 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 1 0 0 1 0 1 1 0 8 0 mcl4k 4096 119 0 0 15 0 15 15 0 8 0 mcl2k 2048 31 0 0 4 0 4 4 0 8 0 mextrefs 64 26 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 152 0 0 10 0 10 10 0 8 0 bufpl 272 2321 0 106 148 0 148 148 0 8 0 anonpl 32 3818 0 0 31 0 31 31 0 222 0 amapchunkpl 152 8749 0 8371 19 0 19 19 0 158 3 amappl16 200 1767 0 1754 5 1 4 5 0 8 3 amappl15 192 7 0 7 1 1 0 1 0 8 0 amappl14 184 438 0 435 1 0 1 1 0 8 0 amappl13 176 120 0 108 1 0 1 1 0 8 0 amappl12 168 729 0 701 2 0 2 2 0 8 0 amappl11 160 9 0 9 1 1 0 1 0 8 0 amappl10 152 64 0 50 1 0 1 1 0 8 0 amappl9 144 277 0 277 1 1 0 1 0 8 0 amappl8 136 103 0 100 1 0 1 1 0 8 0 amappl7 128 160 0 147 1 0 1 1 0 8 0 amappl6 120 161 0 157 1 0 1 1 0 8 0 amappl5 112 106 0 96 1 0 1 1 0 8 0 amappl4 104 306 0 286 1 0 1 1 0 8 0 amappl3 96 1538 0 1447 3 0 3 3 0 8 0 amappl2 88 562 0 501 2 0 2 2 0 8 0 amappl1 80 10605 0 9996 15 0 15 15 0 8 0 amappl 88 2508 0 2375 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 0 1 0 1 1 0 8 0 uaddrrnd 24 456 0 425 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 456 0 425 1 0 1 1 0 8 0 vmmpekpl 168 5812 0 5783 2 0 2 2 0 8 0 vmmpepl 168 39008 0 37203 89 0 89 89 0 357 8 vmsppl 488 455 0 425 5 0 5 5 0 8 0 rwobjpl 80 14748 0 13752 25 1 24 24 0 8 1 pdppl 4096 921 0 850 99 22 77 87 0 8 6 pvpl 32 9967 0 0 81 0 81 81 0 265 0 pmappl 256 455 0 425 3 0 3 3 0 8 0 extentpl 40 47 0 29 1 0 1 1 0 8 0 phpool 120 417 0 25 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x17 panic(ffffffff8463738e) at panic+0x270 __asan_load4_noabort(ffffffff84ecba04) at __asan_load4_noabort+0xa3 checkalias(ffff800001d1fdc8,6e56) at checkalias+0x47d ffs_vinit(ffff800000d80800,ffff80003bb4fd20) at ffs_vinit+0x227 ffs_vget(ffff800000d80800,6658,ffff80003bb4fee0) at ffs_vget+0x748 ufs_lookup() at ufs_lookup+0x15c1 VOP_LOOKUP(ffff800001ca4988,ffff80003bb507c0,ffff80003bb507f0) at VOP_LOOKUP+0xda vfs_lookup(ffff80003bb50790) at vfs_lookup+0xfbd namei(ffff80003bb50790) at namei+0xe19 vn_open(ffff80003bb50790,2,0) at vn_open+0x240 doopenat(ffff800045fec028,ffffff9c,200000001980,1,0,0,ffff80003bb50b00) at doopenat+0x460 sys_open(ffff800045fec028,ffff80003bb50b00,ffff80003bb50a60) at sys_open+0x86 syscall(ffff80003bb50b00) at syscall+0x1089 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x22debabe530, count: -15 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 x86_ipi_handler() at x86_ipi_handler+0x112 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85d77280) at __mp_lock+0x272 syscall(ffff800031ed8b50) at syscall+0x1048 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x77c0e8e3dc30, count: 9 ddb{1}> trace x86_ipi_db(ffff800028fe3ff0) at x86_ipi_db+0x19 x86_ipi_handler() at x86_ipi_handler+0x112 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85d77280) at __mp_lock+0x272 syscall(ffff800031ed8b50) at syscall+0x1048 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x77c0e8e3dc30, count: -6