last executing test programs: 744.662273ms ago: executing program 0 (id=1): ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f00000086c0)=0x8) r0 = socket$inet6(0x18, 0x1, 0x6) r1 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) fchflags(r1, 0x10001) r2 = syz_open_pts() ioctl$TIOCSETD(r2, 0x8004741b, &(0x7f0000000180)=0x29dd) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0x69, &(0x7f0000000040)={{0x1c, 0x18, 0x2, 0x81, "33b12d98f02f5f2b49596312e9d87582", 0xd0ea}, {0x1c, 0x18, 0x2, 0x4, "6c77a70e24d48e1fc540ea439c55513c", 0x1}, 0x3, [0x80000001, 0x3, 0x5, 0x0, 0x0, 0x8, 0x800, 0x5]}, 0x5c) closefrom(r0) 612.714028ms ago: executing program 7 (id=8): open(&(0x7f0000000180)='./file0\x00', 0xa60, 0xcf) ktrace(&(0x7f0000000040)='./file0\x00', 0x0, 0x814, 0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x4828a, 0x80) pwritev(r0, &(0x7f0000000580)=[{0x0, 0xe}], 0x1, 0x53) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0) sysctl$net_inet_ip(&(0x7f0000002ac0)={0x4, 0x2, 0x0, 0x1d}, 0x4, &(0x7f0000000000)="0ac2", &(0x7f0000002c00)=0x2, 0x0, 0x0) (async) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x10, 0x8f) ioctl$VMM_IOC_CREATE(r1, 0xca605601, &(0x7f0000000080)={0x10, 0xc8e, [{&(0x7f0000000000/0x2000)=nil, &(0x7f0000000000/0x1000)=nil, 0x6}, {&(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x4000)=nil, 0x7}, {&(0x7f0000001000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x81}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, 0xfffffffffffffff7}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x2}, {&(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x1000)=nil, 0x5}, {&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000002000/0x3000)=nil, 0x11ceed97}, {&(0x7f0000004000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x5}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0xc}, {&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x1a6}, {&(0x7f0000006000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000006000/0x1000)=nil, 0xc8}, {&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000006000/0x4000)=nil, 0x7}, {&(0x7f0000000000/0x2000)=nil, &(0x7f0000008000/0x4000)=nil, 0x1}, {&(0x7f0000000000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x5}, {&(0x7f0000ffa000/0x3000)=nil, &(0x7f000000a000/0x1000)=nil, 0x1000}], './file0\x00', 0xd2, 0x8, 0xfffff52f, 0x1, [0x4, 0x7, 0x3, 0xea, 0x7, 0xfffffffc, 0x5, 0x0, 0x4, 0xe0, 0xfff, 0x1ff, 0x1, 0x6, 0x8, 0x0, 0xcd15, 0x25, 0xc4, 0xb, 0x1, 0x6, 0x0, 0x5, 0x1, 0x6, 0x9, 0x0, 0x200, 0x800, 0x4, 0x0, 0xfffffff8, 0x3, 0xa, 0xf, 0x7ff, 0x5, 0xecf4, 0xffff3d94, 0x80000001, 0x3, 0x6, 0x9, 0x7, 0x9, 0xa527, 0x3, 0x7fff, 0x4, 0x6, 0xe19, 0x9, 0x4, 0x2, 0x0, 0x4, 0x8, 0xb, 0x7, 0x7, 0x80, 0x1c000000, 0x80, 0x6, 0x9, 0x40, 0xbc, 0xc, 0x1, 0x10, 0x5, 0xfffffffc, 0x10, 0x54, 0xc, 0xd7c, 0x7fffffff, 0xfffffff7, 0x9, 0x1, 0x6, 0x10, 0x3ff, 0x0, 0x3, 0x80000001, 0x2, 0x134c, 0x800, 0x5, 0x9, 0x6, 0x7fffffff, 0x8, 0x1, 0x8, 0x3, 0xfffffeff, 0xc859, 0xa, 0x0, 0xffff, 0x0, 0x3, 0x3b, 0x5, 0x0, 0x80, 0x2, 0xfffffffe, 0xacaa, 0xf, 0x100, 0x2, 0x5, 0x5, 0x80000000, 0x6, 0x7f, 0x2, 0xf322, 0x6, 0x8001, 0x4, 0x4, 0x7, 0x6, 0x7, 0x664, 0xc7c8, 0x7, 0x5, 0x1, 0x3, 0x0, 0x3, 0x9, 0x6, 0x48, 0x4, 0x4, 0x6, 0x40, 0x5, 0x9, 0xffffffff, 0xffff, 0x3, 0x3, 0x6, 0x4, 0xffffffff, 0xd, 0x3, 0x0, 0x7, 0x4, 0x8, 0x40000, 0xfffffffd, 0x0, 0x4, 0x2, 0x8, 0x5, 0x6, 0x4, 0x5, 0x9, 0x1d6f, 0x8, 0x3, 0x1, 0x6, 0x64e, 0x7, 0x4, 0x6, 0xa, 0x5, 0x2, 0x3, 0x10001, 0x8, 0x0, 0x4, 0x80000000, 0x4, 0xffff, 0xd3, 0x8, 0x9, 0x9, 0x3, 0x9, 0x11ea, 0x0, 0x1, 0x7e2, 0x8, 0xecc, 0x1, 0x7fff, 0x75, 0x2, 0xcc6220b, 0x6, 0x5, 0xd66b, 0x17, 0x7, 0xb, 0x9, 0x0, 0x9, 0x2, 0x9, 0x0, 0x0, 0x81, 0x2, 0x2, 0x0, 0x919, 0xfffffffa, 0x3, 0x80, 0x0, 0xa3d, 0x5, 0x0, 0x1, 0x8, 0x8640, 0xfffffffe, 0xe3, 0x7fffffff, 0x8, 0x2, 0x2, 0x3, 0x7, 0xfff, 0x7, 0x6, 0x5, 0x9, 0x5, 0x5, 0x6, 0x1, 0xfff, 0xed, 0x2, 0xfffffffd, 0x0, 0xcdb, 0x1, 0x2, 0x1, 0x7, 0xbf0, 0x101, 0x17, 0x0, 0x7, 0xb, 0x7, 0x4, 0x2, 0x221f, 0xfff, 0x9, 0x4, 0x9, 0x9, 0x80000001, 0x1, 0x9, 0x2, 0x74ba1f43, 0x6f, 0x9, 0x81, 0xa0, 0x8, 0xffff8001, 0x7f, 0xd, 0x2, 0x7fff, 0x2, 0x1, 0x2e55, 0x5, 0x6, 0x6, 0x4, 0x1, 0x35, 0x5, 0x7, 0x6, 0x6, 0x2a, 0x4, 0x826, 0x6, 0xcf0a, 0x9, 0x0, 0x9, 0x4c, 0x2, 0x80000000, 0x4, 0x603a, 0x6, 0x8f, 0x6, 0x101, 0xa97c, 0xf9, 0x0, 0x3, 0x551, 0x0, 0x4, 0xfffffe00, 0xfffffffd, 0x9, 0x8, 0x6, 0x1, 0x1, 0x732, 0x5, 0xfffffffa, 0x5, 0x6, 0x4, 0x1690, 0x6, 0xc91, 0x8, 0x7, 0x55, 0xcfe, 0xa838, 0x7, 0x80000000, 0x9, 0x3d32, 0x7, 0x3, 0x80, 0x20, 0x5, 0xc, 0x6, 0x37, 0x5, 0x0, 0x4, 0x800, 0x6, 0x3, 0x2, 0x3, 0x0, 0x7ff, 0x1, 0xc, 0xa, 0xfff, 0x1, 0x9, 0x1ff, 0x9, 0x8, 0xf, 0x10001, 0x3, 0x4, 0x8, 0x10000, 0x3e, 0xb3, 0x800000, 0x7fffffff, 0x3, 0x800, 0x8b78, 0x8, 0x2, 0x80000001, 0x0, 0xa8a3, 0x5, 0x3, 0x5, 0x3, 0x0, 0x8, 0x7, 0x5, 0xe4, 0x10000, 0x80000001, 0x4, 0xffff, 0x3, 0x3eaaeb7d, 0x0, 0x9, 0x37d9, 0x6800, 0x0, 0xd3, 0x0, 0x6, 0x7, 0x8001, 0x6, 0x2, 0x7, 0x4, 0x1f, 0xfffffff9, 0xffff, 0x2e28711d, 0x3, 0x10, 0x4, 0x4, 0x8001, 0x226, 0x10001, 0x7, 0x3, 0x5, 0x9, 0x6, 0x5, 0xc, 0x2, 0x16f6, 0x0, 0x8000, 0x1000, 0x2, 0x9, 0x180000, 0x8081, 0x24e4, 0x8, 0x1, 0x200, 0x3fff8, 0x3ef, 0x5, 0x85e, 0x9, 0x32, 0x7f, 0x1, 0x101, 0x4, 0x8, 0x40, 0x800, 0x7, 0x800, 0x3a28, 0x7, 0x2ce, 0x1d838baa, 0x0, 0xd41d, 0xe2, 0x1, 0x2, 0x5, 0x4, 0x7, 0x80, 0x2, 0x0, 0x0, 0x7, 0xd, 0x0, 0xa213, 0xffff, 0x80000001, 0x8, 0x9, 0x3, 0x7, 0x5, 0x3, 0x3, 0x5, 0x5, 0xa932, 0x8001, 0x202cd1e0, 0x8001, 0x80, 0x9]}) 346.833787ms ago: executing program 7 (id=9): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000080)={0x3, &(0x7f00000000c0)=[{0x2, 0x5, 0xf9}, {0x4, 0x4, 0x1, 0x1}, {0xd9e6, 0x9, 0x3, 0x400007}]}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc050756a, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000580)={'tap', 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000480)={@local, @local, [], {@ipv6={0x86dd, {0x8, 0x6, "595b81", 0x30, 0x2c, 0x4, @empty, @mcast2, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0xa, {0x4, 0x6, '\x00\x00\b', 0xf000, 0x62, 0x1, @ipv4={'\x00', '\xff\xff', @empty=0xfeff}, @mcast2}}}}}}}) setrlimit(0x3, &(0x7f0000000040)) 344.848581ms ago: executing program 7 (id=10): openat$wsdisplay(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mknod(&(0x7f0000000080)='./file0\x00', 0x80, 0x800) (async, rerun: 64) ioctl$WSMOUSEIO_SETPARAMS(0xffffffffffffffff, 0x80105728, &(0x7f00000000c0)={&(0x7f0000000000)=[{0x7, 0x6}], 0x1}) (rerun: 64) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) sysctl$vfs_nfs(&(0x7f0000000000)={0xa, 0x2, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x0) (async) socket$inet6(0x18, 0x3, 0x3a) (async, rerun: 64) mknod(&(0x7f0000000040)='./file0\x00', 0x2000, 0x33a5) (async, rerun: 64) r0 = open(&(0x7f0000001980)='./file0\x00', 0x80, 0xc3) (async) setresgid(0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) chown(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) seteuid(0xffffffffffffffff) semget(0x1, 0x1, 0x5fb) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x4) ioctl$TIOCCONS(r0, 0xc0a86b03, &(0x7f0000000140)=0x1) (async) open$dir(&(0x7f00000000c0)='./file0\x00', 0x80, 0x85) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) closefrom(r1) (async) pselect(0x40, &(0x7f0000001740)={0x8, 0x5, 0x80000000, 0x0, 0xedda, 0x7, 0x2, 0xb71}, 0x0, 0x0, 0x0, 0x0) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async, rerun: 64) r3 = syz_open_pts() (async, rerun: 64) openat$bpf(0xffffffffffffff9c, &(0x7f0000001ec0), 0x20, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) closefrom(r4) (async) setrlimit(0x8, &(0x7f0000001ec0)={0x9, 0x37e1790c}) (async) syz_open_pts() write(r3, &(0x7f0000000680)="57f5e6cdd20bab423018b49c2ef68488500b02d440000a2f18b7c3a34e6b19c4677949a7ed76105b8e715ea01a0f41", 0x2f) (async) ioctl$BIOCSETF(r2, 0x80104267, &(0x7f0000000140)={0x3, &(0x7f0000000180)=[{0x61, 0x38, 0xff, 0x6}, {0x54, 0xa, 0x5, 0x9000}, {0x6, 0xe, 0x6, 0x101}]}) (async, rerun: 64) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) (rerun: 64) openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) 344.581113ms ago: executing program 6 (id=7): openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x9) r0 = open(&(0x7f0000000180)='./file0\x00', 0x200, 0xef) ioctl$TIOCMSET(r0, 0x8004746d, &(0x7f00000001c0)=0x6) 328.588113ms ago: executing program 0 (id=11): mkdir(&(0x7f0000000400)='./file0\x00', 0x148) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x120) unveil(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000340)='w\x00') unveil(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='r\x00') r0 = open$dir(&(0x7f00000000c0)='./file0/file0\x00', 0x8000, 0x184) mknodat(r0, &(0x7f0000000100)='./file0\x00', 0xc000, 0x0) unveil(&(0x7f0000001d00)='./file1\x00', &(0x7f0000001d40)='w\x00') chroot(&(0x7f0000000080)='./file1\x00') 325.107867ms ago: executing program 4 (id=5): mkdir(&(0x7f0000000080)='./file0\x00', 0x204) chroot(&(0x7f0000000000)='./file0\x00') chroot(&(0x7f0000000000)='./file0\x00') munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) sysctl$net_inet_tcp(&(0x7f0000000240)={0x4, 0x2, 0x6, 0x9}, 0x4, &(0x7f00000023c0), &(0x7f0000000000)=0xffffffffffffff77, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x120) syz_emit_ethernet(0x243, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa03aaaaaaaa86dd6f75184a020d3a7c39bc48e57db8883fa6958273532df404fe8000000000000000000000000000aa02009078000000086a0e1d10ffff0281fe80000000020000ff010000000000aa"]) syz_open_pts() unveil(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='c\x00') unlink(&(0x7f00000000c0)='./file0\x00') mkdir(&(0x7f0000000080)='./file0\x00', 0x204) (async) chroot(&(0x7f0000000000)='./file0\x00') (async) chroot(&(0x7f0000000000)='./file0\x00') (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) sysctl$net_inet_tcp(&(0x7f0000000240)={0x4, 0x2, 0x6, 0x9}, 0x4, &(0x7f00000023c0), &(0x7f0000000000)=0xffffffffffffff77, 0x0, 0x0) (async) mkdir(&(0x7f0000000400)='./file0\x00', 0x120) (async) syz_emit_ethernet(0x243, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa03aaaaaaaa86dd6f75184a020d3a7c39bc48e57db8883fa6958273532df404fe8000000000000000000000000000aa02009078000000086a0e1d10ffff0281fe80000000020000ff010000000000aa"]) (async) syz_open_pts() (async) unveil(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='c\x00') (async) unlink(&(0x7f00000000c0)='./file0\x00') (async) 304.378445ms ago: executing program 5 (id=6): pselect(0x40, &(0x7f0000000080)={0x1000000000000, 0x3ff, 0x400005, 0x6, 0xaed, 0x1e, 0x40008000000000, 0xfffffffffffffc00}, 0x0, 0x0, 0x0, 0x0) sysctl$vfs_nfs(&(0x7f0000000000)={0xa, 0x2, 0x2}, 0x3, 0x0, 0x0, 0x0, 0x0) sysctl$kern(&(0x7f0000000000)={0x1, 0x33}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x4) sysctl$kern(&(0x7f0000000000)={0x1, 0x59}, 0x3, &(0x7f0000000180)="ee8f409198157e3b0d482cd811439e57ce10400116e4853368b7858dd5313a55267eae31dfdeb4695f32fe7b7ad86f86b9026db90f9b45d9c0dfe6f336cdbed0b1e9503fb71d22c07e97988cb677f6e039bda806b77d270400"/104, &(0x7f0000000080)=0x5b, 0x0, 0xfffa) 302.03096ms ago: executing program 4 (id=12): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) fchown(r0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$KDMKTONE(r0, 0x20004b08, &(0x7f0000000280)=0x3) syz_open_pts() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r1, 0xffff, 0x8, 0x0, 0x0) setsockopt$sock_int(r1, 0xffff, 0x2000, &(0x7f0000000180)=0x3bf6, 0x4) syz_emit_ethernet(0x4a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd64483ad700143b06fe8000000000000000000000000000aafe8000000000000000000000000000aa4e224e21", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="8eb3662e0b16c71a1179769c862875409702fba1b54d438127a46098f3632b99e0c19f1c70a9a89e89a9c0921e0aeba95f8b3ea12fd974924954314811cabe1be3006e0aee8c38a5ca4f7964712081b3b97e2a414851a2f45f4027f53f69a707eb1c4cc91bb81afaf10cb6eb84daf5d93b2c0800"]) sysctl$machdep(&(0x7f0000000040), 0x2, &(0x7f0000000080)="79a8c0eb4ca9dad8b72a7136c9119b6a50084274aa4e9fca3e0c832b3e9b6a658bf383e16e69a33d27b0162fd82c9f308d4c6e4e745a10f245a781c0efe7a3f30cbe72151d", &(0x7f0000000100)=0x45, &(0x7f0000000140)="6860e0b36a43e69fdbcdc7df844659", 0xf) 285.251645ms ago: executing program 0 (id=13): mkfifo(&(0x7f0000001380)='./file0\x00', 0x8) acct(&(0x7f0000001780)='./file0\x00') r0 = open(&(0x7f00000000c0)='./file0\x00', 0x200, 0x112) ioctl$DIOCRADDADDRS(r0, 0xc4504443, &(0x7f0000000480)={{'./file0\x00', './file0\x00', 0x0, 0x4}, 0x0, 0x1dd16d6, 0x0, 0x6, 0xef8, 0x76e1, 0x10001, 0x2, 0x10001}) open$dir(&(0x7f0000000000)='./file0/file0\x00', 0x80, 0x30) 281.765799ms ago: executing program 3 (id=4): r0 = syz_open_pts() syz_open_pts() (async) syz_open_pts() syz_open_pts() (async) r1 = syz_open_pts() flock(r0, 0x5) syz_open_pts() fcntl$setown(r1, 0x6, 0x0) 83.27971ms ago: executing program 4 (id=14): mkdir(&(0x7f0000000140)='./file0\x00', 0x25) r0 = open$dir(&(0x7f00000009c0)='./file0\x00', 0x8, 0x70) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000000)={0x0, 0x1, 0x3, 0x38384752, 0x2, [], [0x400, 0x0, 0x2, 0x5], [0x8, 0x1, 0x7, 0x6], [0xfffffffffffffff8, 0x1, 0x7fff, 0x9]}) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) pselect(0x2b, 0x0, &(0x7f0000000040)={0x81, 0x100000000000cb, 0x7fd, 0x5f1, 0x3, 0xf, 0x3, 0x10000}, 0x0, 0x0, 0x0) setsid() r3 = syz_open_pts() r4 = dup2(r3, r3) ioctl$TIOCSCTTY(r4, 0x20007461) syz_open_pts() r5 = openat$tty(0xffffffffffffff9c, &(0x7f0000000040), 0x1c, 0x0) syz_open_pts() ioctl$TIOCSETD(r5, 0x8004741b, &(0x7f00000000c0)=0xd47c) sendmsg$unix(r1, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={0x1c, 0xffff, 0x1, [0xffffffffffffffff, r0, r2, r2]}], 0x1c, 0x8}, 0x0) recvmsg(r2, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001200)=""/27, 0x1b}, 0x2000) mkdir(&(0x7f0000000140)='./file0\x00', 0x25) (async) open$dir(&(0x7f00000009c0)='./file0\x00', 0x8, 0x70) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000000)={0x0, 0x1, 0x3, 0x38384752, 0x2, [], [0x400, 0x0, 0x2, 0x5], [0x8, 0x1, 0x7, 0x6], [0xfffffffffffffff8, 0x1, 0x7fff, 0x9]}) (async) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) pselect(0x2b, 0x0, &(0x7f0000000040)={0x81, 0x100000000000cb, 0x7fd, 0x5f1, 0x3, 0xf, 0x3, 0x10000}, 0x0, 0x0, 0x0) (async) setsid() (async) syz_open_pts() (async) dup2(r3, r3) (async) ioctl$TIOCSCTTY(r4, 0x20007461) (async) syz_open_pts() (async) openat$tty(0xffffffffffffff9c, &(0x7f0000000040), 0x1c, 0x0) (async) syz_open_pts() (async) ioctl$TIOCSETD(r5, 0x8004741b, &(0x7f00000000c0)=0xd47c) (async) sendmsg$unix(r1, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={0x1c, 0xffff, 0x1, [0xffffffffffffffff, r0, r2, r2]}], 0x1c, 0x8}, 0x0) (async) recvmsg(r2, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001200)=""/27, 0x1b}, 0x2000) (async) 82.305728ms ago: executing program 1 (id=2): syz_emit_ethernet(0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="aa"]) (async) syz_emit_ethernet(0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="aa"]) r0 = open$dir(&(0x7f0000000500)='./file0\x00', 0x40, 0xc8) faccessat(r0, &(0x7f0000000540)='./file0\x00', 0x10a, 0x2) msgget$private(0x0, 0x102) (async) r1 = msgget$private(0x0, 0x102) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000580)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsid() (async) r6 = setsid() mknod(&(0x7f0000000080)='./file0\x00', 0x2000, 0x5be7) r7 = open(&(0x7f0000001980)='./file0\x00', 0x80, 0xc3) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) (async) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1) ioctl$WSDISPLAYIO_SVIDEO(r7, 0x82907003, &(0x7f0000001bc0)=0x1) r8 = getpgrp() msgctl$IPC_SET(r1, 0x1, &(0x7f0000000440)={{r2, r3, r4, r5, 0x100, 0x3, 0x0, 0x0, 0xdf}, 0x0, 0x0, 0x7, 0x5, 0xffffffffffffffff, r6, r8, 0x7, 0x0, 0x101, 0x0, 0x8000}) (async) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000440)={{r2, r3, r4, r5, 0x100, 0x3, 0x0, 0x0, 0xdf}, 0x0, 0x0, 0x7, 0x5, 0xffffffffffffffff, r6, r8, 0x7, 0x0, 0x101, 0x0, 0x8000}) sysctl$net_pipex(&(0x7f0000000000)={0x4, 0x1f, 0x2}, 0x3, 0x0, 0x0, 0x0, 0x0) syz_extract_tcp_res(&(0x7f0000000040), 0xb70, 0xfffffffa) shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1ff}, 0xd, 0x0, 0x0, 0x7, 0x0, 0x4, 0x5, 0xa52, 0x200, 0x2, 0x401}) (async) shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1ff}, 0xd, 0x0, 0x0, 0x7, 0x0, 0x4, 0x5, 0xa52, 0x200, 0x2, 0x401}) sysctl$kern(&(0x7f0000000000)={0x1, 0x45}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x4) sysctl$kern(&(0x7f0000000000)={0x1, 0x59}, 0x3, &(0x7f0000000180)="ee8f409198157e3b0d482cd811439e57ce10400116e4853368b7858dd5313a55267eae31dfdeb4695f32fe7b7ad86f86b9026db90f9b45d9c0dfe6f336cdbed0b1e9503fb71d22c07e97988cb677f6e039bda806b77d270400"/104, &(0x7f0000000080)=0x5b, 0x0, 0xfffa) sysctl$kern(&(0x7f0000000000)={0x1, 0x59}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) sysctl$kern(&(0x7f0000000000)={0x1, 0x59}, 0x2, 0x0, 0x0, 0x0, 0x0) 81.172967ms ago: executing program 4 (id=15): poll(0x0, 0x0, 0xfffffffc) r0 = open(&(0x7f0000000180)='./file0\x00', 0x19083084ca9cf73d, 0x2) writev(r0, &(0x7f0000000300)=[{&(0x7f00000000c0)="410946ec", 0x4}], 0x1) syz_emit_ethernet(0x117, &(0x7f0000000100)={@local, @local, [], {@ipv6={0x86dd, {0xf, 0x6, '\x00', 0xe1, 0x6, 0x0, @remote={0xfe, 0x80, '\x00', 0x0}, @local={0xfe, 0x80, '\x00', 0x0}, {[], @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x10, 0x7, 0x0, 0x80, {[@nop]}}, {"efd764e1d42339723f4a77038760f45af5359f29f96b67cc6701763fc68cacca5bc8d0cc5ee9dd064c64a6ad8394a5f61962ec20586027714974172f4a031305e506b234ca85a2edf6804223d1df9f71647c656abca3f6ac1fe4f4c4f45ace2d98cfb39d1aebec315801fc041048b883939c6924f3228b79aa151dbb5397356f9930449f63cb0e5627145a9f5abae3eaea94427b7a8ecceab2fa96ecdc9988bb007e3b09827575a42f03d9d014b495476e019bf73c08f5f650f35c5f8ed9009114b6d3f8a7145b5971"}}}}}}}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="fffffffffffaaaaaaaaaaaaa86dd6f75184a00083a062a3b1ae57db8883fa6958273532df404fe800000cd87000000000000000000aa81009078009b5307"]) r1 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@in, &(0x7f0000000040)=0x10) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x203a8, 0x80) r3 = openat$speaker(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r4 = open(&(0x7f0000000180)='./file0\x00', 0x201, 0xcf) read(r4, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD(0xffffffffffffffff, 0xc01864c1, &(0x7f0000000200)={0x0, 0x0, 0xffffffffffffffff, 0x0, 0x2}) r6 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000240), 0x20000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat$pci(0xffffffffffffff9c, &(0x7f0000000600), 0x8000, 0x0) r10 = dup(r9) sendmsg$unix(r7, &(0x7f0000002640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@rights={0x18, 0xffff, 0x1, [r8, r9, r10]}], 0x18, 0x40a}, 0x404) mkdir(&(0x7f0000000440)='./file0\x00', 0x21) chroot(&(0x7f0000000000)='./file0\x00') recvmmsg(r8, &(0x7f0000002ac0)={{0x0, 0x0, 0x0, 0x0, &(0x7f00000029c0)=""/253, 0xfd}, 0x4}, 0x38, 0x1c00, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r4, 0xc00864c0, &(0x7f00000003c0)) sysctl$net_inet6_ip6(&(0x7f00000001c0)={0x4, 0x18, 0x29, 0x2b}, 0x4, &(0x7f00000000c0), 0x0, 0x0, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) pipe2(&(0x7f0000000280)={0xffffffffffffffff}, 0x10000) r13 = openat$pf(0xffffffffffffff9c, &(0x7f0000002c40), 0x80, 0x0) ioctl$DIOCRSETADDRS(r13, 0xc4504445, &(0x7f0000002dc0)={{'./file0\x00', './file0\x00', 0x8099fd28f25b7b0a, 0xa}, 0x0, 0x1, 0x0, 0x7, 0x3, 0x6, 0x1, 0x4, 0x3}) ioctl$TIOCSFLAGS(r0, 0x8004745c, &(0x7f0000000400)=0xfff) kevent(r0, &(0x7f0000000100)=[{{r1}, 0xffffffffffffffff, 0x40, 0x10, 0x2, 0x6}, {{0xffffffffffffff9c}, 0xffffffffffffffff, 0x8, 0x80000000, 0xfffffffffffffff9}, {{r2}, 0xfffffffffffffffa, 0x10, 0x10, 0xbb, 0x2}, {{}, 0xfffffffffffffffb, 0x32, 0x20000000, 0x0, 0xfff}, {{}, 0xfffffffffffffffc, 0x0, 0x1c, 0x91, 0x80000001}, {{r3}, 0xfffffffffffffffd, 0x80, 0x2, 0xf9, 0x9}, {{r4}, 0xfffffffffffffffd, 0x62, 0x20000000, 0x3, 0xfffffffffffffffb}], 0x1, &(0x7f00000002c0)=[{{r5}, 0xfffffffffffffff8, 0x0, 0x80000000, 0x8, 0x4}, {{r6}, 0xfffffffffffffff8, 0x8, 0x4, 0x6, 0xfffffffffffffffb}, {{r11}, 0xfffffffffffffffb, 0x10, 0x80000009, 0xb, 0x6}, {{r12}, 0xfffffffffffffff7, 0xc, 0x0, 0x7fff, 0x5}, {{r13}, 0xfffffffffffffffc, 0x81, 0x80, 0xb, 0x100000000008}], 0x7, &(0x7f0000000380)={0xccb, 0x1}) 7.586038ms ago: executing program 4 (id=16): r0 = syz_open_pts() r1 = shmget$private(0x0, 0x4000, 0x480, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_RMID(r1, 0x0) fsync(r0) 0s ago: executing program 4 (id=17): r0 = socket$inet(0x2, 0x3, 0x14) pselect(0x40, &(0x7f0000000000)={0x49f, 0x1, 0xb, 0x1, 0x9, 0x6, 0x8, 0x8}, 0x0, 0x0, 0x0, 0x0) fchmod(r0, 0x10) sysctl$net_inet_icmp(&(0x7f0000000000)={0x4, 0x2, 0x1, 0x1}, 0x4, 0x0, 0x0, 0x0, 0x0) sysctl$kern(&(0x7f0000000000)={0x1, 0x49}, 0x6, 0x0, 0x0, 0x0, 0x0) ioctl$FIOASYNC(r0, 0xc0206981, &(0x7f0000000080)=0x3005) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.62' (ED25519) to the list of known hosts. KASAN: invalid write of 36 bytes at 0xffff8000018dbb50 from pc 0xffffffff8204b68e KASAN: first bad byte at 0xffff8000018dbb50 (+0); shadow 0xfb: malloc redzone (out-of-bounds) KASAN: 0xffff8000018dbb50 is 0 bytes inside the 16-byte malloc slot [0xffff8000018dbb50..0xffff8000018dbb60) KASAN: allocated at: #0 malloc+0xda0 #1 sysctl_sysvipc+0x3cb #2 kern_sysctl_dirs+0x30f #3 kern_sysctl+0x1ce #4 sys_sysctl+0x54f #5 syscall+0x1089 #6 Xsyscall+0x128 KASAN: pc: sysctl_sysvipc+0x3ee KASAN: call trace: #0 kasan_memcpy+0x1ca #1 sysctl_sysvipc+0x3ee #2 kern_sysctl_dirs+0x30f #3 kern_sysctl+0x1ce #4 sys_sysctl+0x54f #5 syscall+0x1089 #6 Xsyscall+0x128 KASAN: shadow of 0xffff8000018dba00..0xffff8000018dbc80 (1 cell = 8 bytes): 0xffff8000018dba00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 0xffff8000018dba80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 >0xffff8000018dbb00: fc 08 fc 08 fc 08 fc 08 fc 08[fb]08 fc 08 fc 08 0xffff8000018dbb80: 08 fb 08 08 08 08 08 08 08 08 08 08 08 08 08 08 0xffff8000018dbc00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope panic: Caught invalid memory access at ffff8000018dbb50 size 36 op 1 Stopped at db_enter+0x17: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *488553 96370 0 0 0x4000000 0 syz-executor 313024 86808 0 0x2 0 1 syz-executor db_enter() at db_enter+0x17 panic(ffffffff846330ad) at panic+0x270 kasan_memcpy(ffff8000018dbb50,ffff80003a734380,24) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80003a734a48,1,200000000180,ffff80003a734a20) at sysctl_sysvipc+0x3ee kern_sysctl_dirs(33,ffff80003a734a48,1,200000000180,ffff80003a734a20,0,1,1ffff000074e68c0) at kern_sysctl_dirs+0x30f kern_sysctl(ffff80003a734a44,2,200000000180,ffff80003a734a20,0,fffa,ffff80003a734c90) at kern_sysctl+0x1ce sys_sysctl(ffff800045ffca78,ffff80003a734c90,ffff80003a734c00) at sys_sysctl+0x54f syscall(ffff80003a734c90) at syscall+0x1089 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xcb15a9425a0, count: 6 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: Caught invalid memory access at ffff8000018dbb50 size 36 op 1 ddb{0}> show kasan KASAN: invalid write of 36 bytes at 0xffff8000018dbb50 from pc 0xffffffff8204b68e KASAN: first bad byte at 0xffff8000018dbb50 (+0); shadow 0xfb: malloc redzone (out-of-bounds) KASAN: 0xffff8000018dbb50 is 0 bytes inside the 16-byte malloc slot [0xffff8000018dbb50..0xffff8000018dbb60) KASAN: allocated at: #0 malloc+0xda0 #1 sysctl_sysvipc+0x3cb #2 kern_sysctl_dirs+0x30f #3 kern_sysctl+0x1ce #4 sys_sysctl+0x54f #5 syscall+0x1089 #6 Xsyscall+0x128 KASAN: pc: sysctl_sysvipc+0x3ee KASAN: call trace: #0 kasan_memcpy+0x1ca #1 sysctl_sysvipc+0x3ee #2 kern_sysctl_dirs+0x30f #3 kern_sysctl+0x1ce #4 sys_sysctl+0x54f #5 syscall+0x1089 #6 Xsyscall+0x128 KASAN: shadow of 0xffff8000018dba00..0xffff8000018dbc80 (1 cell = 8 bytes): 0xffff8000018dba00: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 0xffff8000018dba80: fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 fc 08 >0xffff8000018dbb00: fc 08 fc 08 fc 08 fc 08 fc 08[fb]08 fc 08 fc 08 0xffff8000018dbb80: 08 fb 08 08 08 08 08 08 08 08 08 08 08 08 08 08 0xffff8000018dbc00: 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 KASAN: legend: 00 valid; 01..07 partial; fb malloc redzone; fc malloc freed; fd pool freed; fe kmem; fa global; f1..f4/f8 stack/scope ddb{0}> trace db_enter() at db_enter+0x17 panic(ffffffff846330ad) at panic+0x270 kasan_memcpy(ffff8000018dbb50,ffff80003a734380,24) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80003a734a48,1,200000000180,ffff80003a734a20) at sysctl_sysvipc+0x3ee kern_sysctl_dirs(33,ffff80003a734a48,1,200000000180,ffff80003a734a20,0,1,1ffff000074e68c0) at kern_sysctl_dirs+0x30f kern_sysctl(ffff80003a734a44,2,200000000180,ffff80003a734a20,0,fffa,ffff80003a734c90) at kern_sysctl+0x1ce sys_sysctl(ffff800045ffca78,ffff80003a734c90,ffff80003a734c00) at sys_sysctl+0x54f syscall(ffff80003a734c90) at syscall+0x1089 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xcb15a9425a0, count: -9 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003a734170 rbx 0xffff80003a7341e0 rdx 0 rcx 0xffffffff84f02ff0 cpu_info_full_primary+0x1ff0 rax 0xffff80000016f880 r8 0x101010101010101 r9 0x8080808080808080 r10 0xffff80003a733f58 r11 0xffffffff82b69490 x86_bus_space_io_read_1 r12 0xffffffff846330ad .str.16+0x9a5ad r13 0xffffffff84f03c08 cpu_info_full_primary+0x2c08 r14 0xffffffff84f03e07 cpu_info_full_primary+0x2e07 r15 0x1 rip 0xffffffff829a9a77 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff80003a734170 ss 0x10 db_enter+0x17: popq %rbp ddb{0}> show proc PROC (syz-executor) tid=488553 pid=96370 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ffd240,0xffff800037f07788 process=0xffff800037f0a6a0 user=0xffff80003a729000, vmspace=0xffff800001c4c5d0 estcpu=36, cpticks=25, pctcpu=0.0, user=0, sys=24, intr=1 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 81288 33724 86808 0 2 0 0 syz-executor 81288 262174 86808 0 3 0 0x4000080 fsleep syz-executor 5957 84996 52545 0 2 0x2 0 ndp 16608 48948 92259 0 2 0 0 syz-executor 16608 328364 92259 0 3 0 0x4000080 fsleep syz-executor 52545 274512 6026 0 3 0x100002 0x88 sigsusp sh 89363 237999 21881 0 2 0 0 syz-executor 89363 218500 21881 0 3 0 0x4000080 fifow syz-executor 96370 42628 11146 0 2 0 0 syz-executor *96370 488553 11146 0 7 0 0x4000000 syz-executor 97146 210023 81909 0 2 0 0 syz-executor 97146 247071 81909 0 3 0 0x4000080 fsleep syz-executor 97146 401799 81909 0 3 0 0x4000080 fsleep syz-executor 81909 86680 7045 0 2 0x2 0xc80 syz-executor 97022 467949 7045 0 2 0x10000002 0xc80 syz-executor 11146 384730 7045 0 2 0x2 0xc80 syz-executor 86808 313024 7045 0 7 0x2 0 syz-executor 27197 159218 7045 0 2 0x10000002 0xc80 syz-executor 6026 444594 7045 0 3 0x2 0x80 wait syz-executor 92259 361809 7045 0 2 0x2 0xc80 syz-executor 21881 295515 7045 0 2 0x2 0xc80 syz-executor 7045 440464 22897 0 3 0x2 0x80 kqread syz-executor 22897 454579 9669 0 3 0x100002 0x88 sigsusp ksh 9669 420773 33841 0 3 0x10 0x88 kqread sshd-session 33841 136067 29733 0 3 0x12 0x80 kqread sshd-session 76409 331255 1 0 3 0x100003 0x80 ttyin getty 29733 321971 1 0 3 0 0x88 kqread sshd 174 474545 55153 74 3 0x1100012 0x80 bpf pflogd 55153 11167 1 0 3 0 0x80 sbwait pflogd 17508 470786 38433 73 2 0x1100010 0 syslogd 38433 93569 1 0 3 0x100002 0x80 sbwait syslogd 91334 131400 1 0 3 0x100000 0x80 kqread resolvd 8281 456831 2357 77 3 0x100012 0x80 kqread dhcpleased 75896 254440 2357 77 3 0x100012 0x80 kqread dhcpleased 2357 178064 1 0 3 0 0x80 kqread dhcpleased 7640 239070 0 0 2 0x14000 0x40000200 smr 7382 426531 0 0 2 0x14000 0x200 zerothread 89642 436348 0 0 3 0x14000 0x200 aiodoned aiodoned 12770 174687 0 0 3 0x14000 0x200 syncer update 15211 269959 0 0 3 0x14000 0x200 cleaner cleaner 75513 311600 0 0 3 0x14000 0x200 reaper reaper 50106 486983 0 0 3 0x14000 0x200 pgdaemon pagedaemon 50768 359250 0 0 3 0x14000 0x200 bored viomb 52540 10276 0 0 3 0x14000 0x40000200 acpi0 acpi0 59466 341223 0 0 3 0x14000 0x40000200 idle1 26573 104071 0 0 3 0x14000 0x200 bored softnet1 45012 242217 0 0 3 0x14000 0x200 bored softnet0 95612 63010 0 0 3 0x14000 0x200 smrbar systqmp 94991 275040 0 0 3 0x14000 0x200 bored systq 72093 31148 0 0 3 0x14000 0x200 tmoslp softclockmp 35004 513149 0 0 3 0x14000 0x40000200 tmoslp softclock 73732 363829 0 0 3 0x14000 0x40000200 idle0 1 19159 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 95612 (systqmp) thread 0xffff800045ffe7c8 (63010) shared rwlock systqmp r = 0 (0xffffffff8504a038) #0 witness_lock+0x632 #1 taskq_thread+0x1ba #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11054 12242K 12315K 166960K 12150 0 pcb 82 32K 33K 166960K 96 0 rtable 237 12K 12K 166960K 351 0 pf 34 22K 22K 166960K 45 0 ifaddr 43 12K 12K 166960K 45 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 13K 166960K 5 0 counters 70 42K 42K 166960K 70 0 ioctlops 0 0K 4K 166960K 1484 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 83K 83K 166960K 1369 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 2K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 292K 166960K 11964 0 file desc 17 61K 97K 166960K 146 0 proc 69 128K 177K 166960K 555 0 subproc 72 9K 9K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 4 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 43 303K 303K 166960K 43 0 exec 0 0K 2K 166960K 389 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 217 233K 249K 166960K 3155 0 UVM aobj 3 4K 4K 166960K 4 0 pinsyscall 1067 1718K 1727K 166960K 1325 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 28 2K 2K 166960K 28 0 temp 37 9162K 9172K 166960K 3976 0 kqueue 14 44K 44K 166960K 27 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 34 0 31 1 0 1 1 0 8 0 rtentry 176 111 0 1 5 0 5 5 0 8 0 unpcb 144 52 0 33 1 0 1 1 0 8 0 syncache 336 4 0 4 2 1 1 1 0 8 1 tcpcb 736 9 0 5 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 132 0 59 7 0 7 7 0 8 0 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 19 0 0 1 0 1 1 0 8 0 pfstkey 128 19 0 0 1 0 1 1 0 8 0 pfstate 448 19 0 0 3 0 3 3 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 454 0 0 29 0 29 29 0 8 0 art_table 40 455 0 0 5 0 5 5 0 8 0 art_node 32 111 0 9 1 0 1 1 0 8 0 shmpl 112 1 0 1 1 0 1 1 0 8 1 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1590 0 118 93 0 93 93 0 8 0 ffsino 296 1590 0 118 114 0 114 114 0 8 0 nchpl 144 1808 0 101 64 0 64 64 0 8 0 vnodes 216 1679 0 0 94 0 94 94 0 8 0 namei 1024 5723 0 5723 1 0 1 1 0 8 1 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 6726 0 6726 4 3 1 3 1 8 1 plimitpl 152 30 0 13 1 0 1 1 0 8 0 sigapl 424 470 0 421 7 0 7 7 0 8 1 knotepl 120 57 0 0 2 0 2 2 0 8 0 kqueuepl 224 24 0 13 1 0 1 1 0 8 0 pipepl 344 129 0 102 3 0 3 3 0 8 0 fdescpl 528 454 0 423 3 0 3 3 0 8 0 filepl 160 1726 0 1451 12 0 12 12 0 8 0 lockfpl 104 10 0 8 1 0 1 1 0 8 0 lockfspl 48 6 0 4 1 0 1 1 0 8 0 sessionpl 144 28 0 18 1 0 1 1 0 8 0 pgrppl 48 36 0 18 1 0 1 1 0 8 0 ucredpl 104 127 0 114 1 0 1 1 0 8 0 zombiepl 144 423 0 421 1 0 1 1 0 8 0 processpl 1232 470 0 421 5 0 5 5 0 8 0 procpl 664 492 0 437 5 0 5 5 0 8 0 sockpl 752 218 0 123 10 0 10 10 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 120 0 0 15 0 15 15 0 8 0 mcl2k 2048 19 0 0 3 0 3 3 0 8 0 mextrefs 64 24 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 120 0 0 8 0 8 8 0 8 0 bufpl 272 2319 0 105 148 0 148 148 0 8 0 anonpl 32 3854 0 0 32 0 32 32 0 222 0 amapchunkpl 152 8616 0 8207 18 0 18 18 0 158 1 amappl16 200 1902 0 1883 5 0 5 5 0 8 4 amappl15 192 10 0 10 2 1 1 1 0 8 1 amappl14 184 440 0 438 1 0 1 1 0 8 0 amappl13 176 126 0 113 1 0 1 1 0 8 0 amappl12 168 708 0 679 2 0 2 2 0 8 0 amappl11 160 64 0 64 1 1 0 1 0 8 0 amappl10 152 65 0 51 1 0 1 1 0 8 0 amappl9 144 274 0 274 1 0 1 1 0 8 1 amappl8 136 104 0 102 1 0 1 1 0 8 0 amappl7 128 153 0 138 1 0 1 1 0 8 0 amappl6 120 166 0 164 1 0 1 1 0 8 0 amappl5 112 121 0 111 1 0 1 1 0 8 0 amappl4 104 307 0 285 1 0 1 1 0 8 0 amappl3 96 1523 0 1425 3 0 3 3 0 8 0 amappl2 88 550 0 489 2 0 2 2 0 8 0 amappl1 80 10585 0 9952 15 0 15 15 0 8 1 amappl 88 2411 0 2268 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 1 1 0 1 1 0 8 0 uaddrrnd 24 454 0 423 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 454 0 423 1 0 1 1 0 8 0 vmmpekpl 168 5799 0 5765 2 0 2 2 0 8 0 vmmpepl 168 38934 0 37075 85 0 85 85 0 357 1 vmsppl 488 453 0 423 5 0 5 5 0 8 0 rwobjpl 80 14877 0 13844 24 0 24 24 0 8 1 pdppl 4096 917 0 846 105 16 89 89 0 8 18 pvpl 32 9108 0 0 74 0 74 74 0 265 0 pmappl 256 453 0 423 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 120 421 0 20 13 0 13 13 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x17 panic(ffffffff846330ad) at panic+0x270 kasan_memcpy(ffff8000018dbb50,ffff80003a734380,24) at kasan_memcpy+0x1ec sysctl_sysvipc(ffff80003a734a48,1,200000000180,ffff80003a734a20) at sysctl_sysvipc+0x3ee kern_sysctl_dirs(33,ffff80003a734a48,1,200000000180,ffff80003a734a20,0,1,1ffff000074e68c0) at kern_sysctl_dirs+0x30f kern_sysctl(ffff80003a734a44,2,200000000180,ffff80003a734a20,0,fffa,ffff80003a734c90) at kern_sysctl+0x1ce sys_sysctl(ffff800045ffca78,ffff80003a734c90,ffff80003a734c00) at sys_sysctl+0x54f syscall(ffff80003a734c90) at syscall+0x1089 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xcb15a9425a0, count: -9 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 x86_ipi_handler() at x86_ipi_handler+0x112 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85cf0000) at __mp_lock+0x272 syscall(ffff800029a681b0) at syscall+0x1048 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7de2553c7040, count: 9 ddb{1}> trace x86_ipi_db(ffff800028ff3ff0) at x86_ipi_db+0x19 x86_ipi_handler() at x86_ipi_handler+0x112 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85cf0000) at __mp_lock+0x272 syscall(ffff800029a681b0) at syscall+0x1048 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7de2553c7040, count: -6