last executing test programs: 757.373582ms ago: executing program 0 (id=1): sysctl$hw(&(0x7f00000000c0)={0x6, 0x1c}, 0x18, &(0x7f00000002c0)="bd0f196a43d7b3fdaed18c89d5563a312b7f7ac574abf61c76b3fc75c748957326aa62bbd8078b03e9adca856cc453edf3aaf9f7b9dec6d2a74c932830d6864269ae94534660b597f7fc3f4b36222aa322a8327a428177799542a62bed27b101e1642bad53afe620f6a3607f86aefbeeb4935097834924c17390bb4799959e488ab7d2f9f67fb9f6e33fdf44871b66a84c14594a6704f532a483ee5f8a51c1f130c89a5ea27004e38a6ce35eafe8c8c3bcc9c5a2b4fece96bb6c53bd08c6630b957878b1eec26d365cbe95384ff729f3f23b0c163df3d80824a103f4fd5242e45923ff4503fc2bde1180b809e0524a648238895661c9", &(0x7f0000000000)=0x3, 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000000a40)=[{0x0}, {&(0x7f0000000600)=""/251, 0xfb}], 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs={0xce, 0x0, 0x0, 0x3}, 0x8) clock_getres(0x0, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000140)={0x2, &(0x7f0000000080)=[{0x0, 0xfe, 0x0, 0x8573}, {0x4, 0x0, 0x0, 0x3}]}) sysctl$kern(&(0x7f0000000080)={0x1, 0x31}, 0x4000000000000004, 0x0, 0x0, 0x0, 0x0) write(r0, &(0x7f0000000080)="ed", 0x1) recvmmsg(r1, &(0x7f0000000880)={{0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffd}, 0x38, 0x1042, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)=""/9, 0x9}], 0x1, 0x0}, 0x42) setrlimit(0x8, &(0x7f0000000980)={0xb, 0x54}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xe8, 0x0) r3 = fcntl$dupfd(r2, 0x3, 0xffffffffffffffff) r4 = dup(r3) kqueue() syz_open_pts() getsockopt$sock_int(0xffffffffffffffff, 0xffff, 0x200, 0x0, 0x0) ioctl$BIOCGFILDROP(r4, 0x40044278, &(0x7f0000000100)) writev(0xffffffffffffffff, 0x0, 0x0) syz_open_pts() ioctl$TIOCFLUSH(0xffffffffffffffff, 0x80047410, 0x0) syz_open_pts() sysctl$kern(&(0x7f00000000c0)={0x1, 0x2c}, 0x4, &(0x7f0000000200)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec370823f4dc9562c038a6eee77ead68ec80199fea385f35c62aa35fd51a36189858bfa1bb9b6ca1308137ef5196c1231deee9976ba6f2e990a5f38f2ecf849e21304d396fac7be44476859df2d7a77a10ac3ef7e62c0d0e7f74c28b51a6218c1f23a99dc99d71d6e6e913636d6ff46b613556215d090a4fc998400c1c0eb7e845c8b95", &(0x7f0000000080)=0x3, 0x0, 0x84) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) unveil(0x0, &(0x7f0000000040)='x\x00') 615.611709ms ago: executing program 1 (id=2): mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) r0 = syz_open_pts() r1 = socket(0x18, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x5, "00000000000000000000000000000001", 0xc}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0x1c, 0x18, 0x1, 0xfffffffe, "000000000000000000001000", 0x8}, 0x1c) closefrom(r1) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f00000000c0)={0xf609, 0x1, 0xfffdff82, 0x160350a, "42ffe00000000000e600", 0x283, 0x46}) r2 = socket(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0xffff, 0x8, 0x0, 0x0) mquery(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x10, r0, 0x4) r3 = socket(0x11, 0x3, 0x0) sendto$unix(r3, 0x0, 0x0, 0xa, 0x0, 0x0) setrlimit(0x8, &(0x7f0000000980)={0xb, 0x54}) r4 = syz_open_pts() close(r4) r5 = syz_open_pts() writev(r4, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000100)={0x401, 0x5724, r5}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000001800)={{0x0, 0x0, 0x0, 0x0, 0x0}, 0x8}, 0x38, 0x4800, 0x0) ioctl$DIOCRTSTADDRS(r6, 0xc4504449, &(0x7f0000000480)={{'./file0\x00', './file0\x00', 0x2, 0x3c}, &(0x7f0000000240)=[{@broadcast, '\x00', './file0\x00', 0x7, 0x1, 0x0, 0x7, 0x2, 0x4, 0x1}, {@remote={0xac, 0x14, 0x0}, '\x00', './file0\x00', 0x10001, 0xd1, 0x1e, 0xf5, 0x4, 0x4, 0x4}, {@remote={0xac, 0x14, 0x0}, '\x00', './file0\x00', 0x0, 0x5, 0x0, 0x2, 0x2, 0x7}, {@empty, '\x00', './file0\x00', 0x3, 0x6cd, 0x18, 0x3, 0x3, 0x7, 0x2}, {@multicast2, '\x00', './file0\x00', 0x0, 0x1, 0x1a, 0x6, 0x5, 0x62, 0x9}, {@rand_addr=0x86, '\x00', './file0\x00', 0x4, 0x8, 0x1a, 0x4, 0x2, 0xff, 0x4}, {@local={0xac, 0x14, 0x0}, '\x00', './file0\x00', 0x7fff, 0x10, 0x0, 0x0, 0x3, 0x5, 0xba}, {@empty, '\x00', '.\x00', 0x0, 0x4, 0x18, 0x5, 0x9, 0x5, 0x7}], 0x3, 0x8, 0x5, 0x5, 0x1, 0xd7, 0x18e77b6ffe398391, 0x2}) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x1, 0xffff63de, 0x2, 0x2, 0x8, 0x100003, 0x40, 0x10, [{0x5, 0x6, 0x80000000, 0x80000201}, {0x2, 0xfffffffb, 0x6, 0xfff}, {0x7, 0xfffffffe, 0x2006, 0x10000}, {0x4000002, 0x7, 0xf, 0x6}, {0xfffffffc, 0x5757, 0xf11, 0x7}, {0x800003, 0xffff, 0x80d2}, {0x2024, 0x1000001, 0x85, 0x5}, {0x0, 0x40009, 0xfffffffb, 0xfbffe2e9}, {0x8, 0xffa, 0x6, 0x7fff}, {0x0, 0x4, 0x400005, 0x8bfb}, {0xfffff0d1, 0x8000000, 0x8, 0x7}, {0x4, 0xc7cb, 0x3, 0x2}, {0x9, 0x106, 0x9, 0x40}, {0x200003, 0xee6, 0x2, 0x6f5fc48b}, {0x7e, 0xfffffffc, 0x1, 0x5}, {0x101, 0x6, 0xc, 0x69}]}) fcntl$lock(0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x3, 0x2, 0x1, 0x100000000000000}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x3e}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$kern(&(0x7f00000000c0)={0x1, 0x33}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x18, 0x0, 0x37) r7 = syz_open_pts() shmget$private(0x0, 0x1000, 0x2, &(0x7f000055b000/0x1000)=nil) futimens(r7, &(0x7f0000000b00)=[{0x1000, 0x4000000009}, {0x2, 0xfffffffffffffffe}]) 257.725799ms ago: executing program 1 (id=9): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') unveil(&(0x7f0000000140)='./file0/file0/..\x00', &(0x7f00000004c0)='w\x00') open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) setitimer(0x2, &(0x7f00000000c0)={{0x5, 0x9c13}, {0x2, 0x4}}, 0x0) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xffff, 0xffff63df, 0x3, 0x2, 0x0, 0x3, 0x41, 0x10, [{0x5, 0x3, 0x6, 0x80000201}, {0x4, 0x8, 0xffffffff, 0xfff}, {0x1, 0xfffffffe, 0x2, 0x1}, {0x2, 0x80df, 0xf, 0x40}, {0x2, 0x7, 0xf11, 0x7}, {0x803, 0x10002, 0x80cf}, {0x80, 0x4, 0x20000000, 0x2}, {0x7, 0x8, 0xfffffff8, 0xfbffe2eb}, {0x8, 0xffe, 0x6, 0x20}, {0x3, 0x0, 0x5, 0x8bfd}, {0x8, 0x8000100, 0x8, 0x6}, {0x14, 0xc7cb, 0x800000, 0xa66}, {0x401, 0x10a, 0x6, 0x5}, {0x200003, 0xee2, 0x2, 0x6f5fc48f}, {0x81, 0x101, 0x3, 0x5}, {0xffffffff, 0x8003, 0x6, 0x69}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mkdir(&(0x7f0000000080)='./file0/file0\x00', 0x97) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 257.458125ms ago: executing program 1 (id=10): r0 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7959) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="7f454c4602df7a264ee4975f55011a49b70cb710aa950000000a52e92a24d18fcf8fd1f9794ffa08bb11bafcdc24ff4c5d0b5c7b1ad1a2ec434c500191", 0x3d}, {&(0x7f0000000340)="1551e6", 0x3}], 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000ffff000001"], 0x28}, 0x0) (async) writev(r2, &(0x7f0000000580)=[{0x0}], 0x1) recvmsg(r1, &(0x7f0000000000)={0x0, 0xff76, 0x0, 0x0, &(0x7f0000002680)=""/242, 0xf2}, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 257.180798ms ago: executing program 5 (id=6): poll(&(0x7f0000000ac0)=[{0xffffffffffffff9c}], 0x20000000000000d7, 0x887e) sysctl$kern(&(0x7f00000000c0)={0x1, 0x30}, 0x2, &(0x7f0000000140), 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x4001, 0x0) r1 = socket(0x2, 0x4001, 0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) close(r2) r3 = socket(0x2, 0x4001, 0x0) r4 = fcntl$dupfd(r3, 0x2, 0xffffffffffffffff) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) r5 = socket(0x2, 0x4001, 0x0) r6 = fcntl$dupfd(r5, 0x2, 0xffffffffffffffff) closefrom(r6) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r7 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffd000/0x3000)=nil) shmctl$IPC_SET(r7, 0x1, &(0x7f0000000340)={{0x4, 0x0, 0x0, 0x0, 0xffffffffffffffdf, 0x3, 0x7}, 0x4, 0xfffc, 0x0, 0x0, 0x1, 0x5, 0x800000800000000, 0x0, 0x5, 0xffffffffe154f620}) shmat(r7, &(0x7f0000001000/0x3000)=nil, 0x0) shmctl$IPC_RMID(r7, 0x0) r8 = socket(0x18, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000000)={0x1c, 0x18, 0x3, 0x800, "fe80000800fdff000000000200"}, 0x1c) setsockopt$sock_int(r6, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) close(r4) socket(0x18, 0x2, 0x0) fcntl$getown(r0, 0x5) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x18, 0x1, 0x800, "fe80000400000000fdff00", 0x1}, 0xffffff67) r9 = socket(0x2, 0x2, 0x0) r10 = socket(0x2, 0x4001, 0x0) r11 = fcntl$dupfd(r9, 0xa, r10) setsockopt$sock_int(r11, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) select(0x40, &(0x7f0000000940)={0x9, 0xffffffeffffffff7, 0x8b, 0x7f, 0x2638, 0xe6fc, 0x4, 0xffff}, 0x0, &(0x7f00000009c0)={0xff, 0x0, 0x7, 0x7fffffffffffffff, 0xfffffffffffffffe, 0x9, 0x3, 0x8}, 0x0) 256.826975ms ago: executing program 7 (id=8): r0 = syz_open_pts() ioctl$TIOCSDTR(r0, 0x20007479) close(r0) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000000)={0x8, 0x5, 0x8, 0x7, "1c8ddb17f03c15bb3237d5c4e517f4ccba8140da", 0x2, 0x1}) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000040)={0x9, 0x1, 0x2, 0x8, "76664e98ba0bd9d5a8939c553e282215565f08a9", 0x10001, 0x66}) ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x67e, 0xf, 0x6, 0x35b9686, "507adaaa19b3b89060459ab071b3667fde86ff72", 0x9, 0x8}) (async) ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x67e, 0xf, 0x6, 0x35b9686, "507adaaa19b3b89060459ab071b3667fde86ff72", 0x9, 0x8}) syz_open_pts() (async) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f00000000c0)={0x9, 0x0, 0x81, 0x9, "f83deed83971903152593892fee7a8164fb3da21", 0x8, 0x400}) openat$dri(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dri/renderD128\x00', 0x0, 0x0) (async) r2 = openat$dri(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dri/renderD128\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000140)={0x9, 0xae6, r0}) ioctl$TIOCSTAT(r3, 0x20007465) ioctl$TIOCSTART(r1, 0x2000746e) chdir(&(0x7f0000000180)='./file0\x00') ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000400)={&(0x7f00000001c0)=[0x0], &(0x7f0000000200)=[{}, {}, {}, {}, {}], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x5, 0x1, 0x0, 0x0, 0x12, 0x6, 0x1, 0x8, 0x8, 0x5686d6e9}) ioctl$DRM_IOCTL_MODE_GETENCODER(r2, 0xc01464a6, &(0x7f0000000480)={r4, 0xef, 0x0, 0xc, 0x4}) (async) ioctl$DRM_IOCTL_MODE_GETENCODER(r2, 0xc01464a6, &(0x7f0000000480)={r4, 0xef, 0x0, 0xc, 0x4}) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f00000004c0)={0x80000001, 0x2, 0x6, 0x4, 0x5, 0x1, 0x5, 0x10, [{0x3, 0x3, 0x400, 0x1}, {0x0, 0x2, 0x7, 0x5}, {0x401, 0x2, 0x2, 0x8000}, {0xa, 0xfff, 0x200, 0xfffff09c}, {0xfff, 0xfffffff8, 0x2, 0xffff}, {0x0, 0x7, 0x0, 0x7f}, {0x6, 0x7, 0x61f, 0xfffffff4}, {0x10000, 0x9, 0x527}, {0x22b, 0x5, 0x3, 0x7}, {0x5, 0x9, 0xbc, 0x9}, {0x494a, 0x6, 0x7f, 0x5}, {0x59b, 0x80000000, 0xfffffff4, 0xc}, {0xf31e8ac, 0x7, 0x7, 0x1}, {0x447, 0x5, 0x6, 0x5}, {0x2, 0x4, 0x401, 0x3ff}, {0x7e44, 0x9dbe, 0x2, 0xfffffe00}]}) pipe(&(0x7f0000000600)) (async) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCCDTR(r1, 0x20007478) ioctl$TIOCSTOP(r5, 0x2000746f) ioctl$TIOCGFLAGS(r5, 0x4004745d, &(0x7f0000000640)) (async) ioctl$TIOCGFLAGS(r5, 0x4004745d, &(0x7f0000000640)) openat$zero(0xffffffffffffff9c, &(0x7f0000000680), 0x20000, 0x0) (async) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000680), 0x20000, 0x0) fcntl$getflags(r7, 0x1) lseek(r6, 0xfcb, 0x2) ioctl$DIOCGETQUEUES(r7, 0xc148445e, &(0x7f00000006c0)={0x5, 0xb5, {'\x00', './file0\x00', './file0\x00', './file0\x00', {{0x109f, 0x55}, {0x4}, 0x3}, {{0x2, 0xf}, {0x100000001, 0x3c0}, 0x3}, {{0x8, 0x3}, {0x0, 0x6}, 0xd}, {0x6, 0x7, 0xb, 0x4}, 0x0, 0x1e0, 0x2, 0x5, 0x8}}) (async) ioctl$DIOCGETQUEUES(r7, 0xc148445e, &(0x7f00000006c0)={0x5, 0xb5, {'\x00', './file0\x00', './file0\x00', './file0\x00', {{0x109f, 0x55}, {0x4}, 0x3}, {{0x2, 0xf}, {0x100000001, 0x3c0}, 0x3}, {{0x8, 0x3}, {0x0, 0x6}, 0xd}, {0x6, 0x7, 0xb, 0x4}, 0x0, 0x1e0, 0x2, 0x5, 0x8}}) syz_open_pts() (async) r8 = syz_open_pts() r9 = socket$unix(0x1, 0x3, 0x0) getpgid(0x0) (async) r10 = getpgid(0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)=0x0) getsockopt$sock_cred(r5, 0xffff, 0x1022, &(0x7f00000009c0)={0x0, 0x0, 0x0}, &(0x7f0000000a00)=0xc) sendmsg$unix(r6, &(0x7f0000000ac0)={&(0x7f0000000840)=@file={0x5, 0x0, './file0\x00'}, 0xa, &(0x7f00000008c0)=[{&(0x7f0000000880)="85473f2abd17e2d23ba8400291c622ff3ce29bf3d0a0", 0x16}], 0x1, &(0x7f0000000a40)=[@rights={0x2c, 0xffff, 0x1, [r2, r6, r8, r7, r5, r7, r2, r1]}, @rights={0x28, 0xffff, 0x1, [r9, r3, r1, r7, r3, r1, r1]}, @cred={0x18, 0xffff, 0x0, r10, r11, r12}], 0x6c, 0x402}, 0x401) 256.488124ms ago: executing program 6 (id=7): open(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1, 0x0) (async) r0 = socket(0x18, 0x2, 0x0) r1 = dup2(r0, 0xffffffffffffffff) sendmmsg(r1, &(0x7f0000000200)={{&(0x7f00000000c0)=@in6={0x1c, 0x18, 0x3, 0x7, "ff02000200", 0x8}, 0x1c, 0x0, 0x0, 0x0}}, 0x38, 0x8) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async) r2 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) (async) socket(0x6, 0x5, 0x7) (async) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xe8, 0x0) r4 = fcntl$dupfd(r3, 0x3, 0xffffffffffffffff) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) (async) read(r4, &(0x7f0000000300)=""/69, 0x45) (async) shmctl$IPC_SET(r2, 0x1, &(0x7f0000000340)={{0x4, 0x0, 0x0, 0x0, 0xffffffffffffffdf, 0x3, 0x7}, 0x4, 0xfffc, 0x0, 0x0, 0x1, 0x5, 0x800000800000000, 0x0, 0x5, 0x6}) (async) shmat(r2, &(0x7f0000001000/0x3000)=nil, 0x0) (async) setsockopt(0xffffffffffffffff, 0x1000000000029, 0xb, &(0x7f0000003680)='\x00', 0x1) (async) madvise(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x80000000002) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r5, &(0x7f0000001940)={{0x0, 0x0, 0x0, 0x0, 0x0}}, 0x38, 0x404) (async) r6 = shmget$private(0x0, 0x2000, 0x7f3, &(0x7f0000587000/0x2000)=nil) open$dir(&(0x7f0000000b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0x0) (async) symlink(&(0x7f0000000300)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000d80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') symlink(&(0x7f0000000300)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000440)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') open$dir(&(0x7f0000000b00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0x4) open$dir(&(0x7f0000000080)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xf02, 0x186) (async) rename(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) shmctl$IPC_SET(r6, 0x1, &(0x7f0000000380)={{0x0, 0x0, 0x0, 0x0, 0x1c0, 0x109, 0x0, 0x0, 0x8}, 0x400, 0x0, 0x0, 0xb, 0x0, 0xfffffffffffffff8, 0x2, 0x8, 0xd, 0x8000, 0xa}) (async) shmctl$IPC_STAT(r6, 0x2, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) lstat(&(0x7f0000000200)='./file0\x00', 0xffffffffffffffff) 256.383684ms ago: executing program 1 (id=11): r0 = open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0xa011, r0, 0x0) ftruncate(r0, 0x79c8) msync(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) 255.89057ms ago: executing program 7 (id=12): ioctl$VMM_IOC_RESETCPU(0xffffffffffffff9c, 0x82405605, &(0x7f0000000100)={0x0, 0x0, {[0xfffffbfffffffffb, 0x2000001, 0x2, 0x1, 0xfffffffffffffffa, 0x0, 0xdf5e, 0x0, 0x0, 0x3, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xce5], [0xfffffffffffffffe, 0x80000002, 0x6, 0xffffffff, 0x100, 0x7b99, 0x81, 0x3, 0x10000000000001], [0x100000001, 0x2, 0x40000000, 0x0, 0x2, 0x101, 0xffff], [0x100, 0xfffffffffffffff9, 0x401, 0x3, 0xffffffffffeffffe, 0x8], [{0x0, 0x4, 0x0, 0x7d06}, {0xfffc, 0x7fff, 0x5, 0x7b4f91a6}, {0x0, 0x0, 0xfffffffe, 0x5}, {0x3, 0x7, 0x6, 0xfffffffffffffffa}, {0x0, 0x2, 0x0, 0x808}, {0xb, 0x2006, 0x3, 0x1fffffffffffffff}, {0x0, 0x0, 0x3}, {0x0, 0x962, 0x0, 0x200000000008}], {0x2000, 0x1000001, 0x5}, {0x0, 0x0, 0x8, 0x3}}}) r0 = socket(0x2, 0x8002, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) r2 = socket(0x18, 0x2, 0x0) r3 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x184) mmap(&(0x7f0000234000/0x3000)=nil, 0x3000, 0x5, 0x11, r3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mmap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2, 0x1011, 0xffffffffffffffff, 0x0) bind$inet6(r2, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x5, "00000000000000000000000000000001", 0xc}, 0x1c) connect$inet6(r2, &(0x7f0000000080)={0x1c, 0x18, 0x3, 0xfffffffe, "00000000000000000200", 0x4}, 0x1c) sendmsg$unix(r2, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={0x18}], 0x18, 0xc}, 0x4) r4 = kqueue() mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x1) readv(0xffffffffffffffff, &(0x7f0000000a40)=[{0x0}, {&(0x7f0000000600)=""/244, 0xf4}], 0x2) sysctl$kern(&(0x7f00000000c0)={0x1, 0x38}, 0x2, 0x0, 0x0, 0x0, 0x0) r5 = socket(0x2, 0x2, 0x0) connect$inet(r5, &(0x7f0000000a00)={0x10, 0x2, 0x2, 0xfffffffd}, 0x10) sendmmsg(r5, &(0x7f0000000500)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}, 0x38, 0x400) kevent(r4, 0x0, 0x5, &(0x7f0000000340)=[{{r1}, 0xfffffffffffffffb, 0x2, 0x2, 0x363, 0x3}], 0xacc, 0x0) kevent(r4, &(0x7f0000000080), 0xe4a, 0x0, 0xa9fa, 0x0) 253.388653ms ago: executing program 4 (id=5): msgctl$IPC_SET(0x0, 0x1, 0x0) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x8, 0x8}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket(0x18, 0x1, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000800082bfbfe8000000000000000000000000000bb00000000ca"]) pipe(&(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = getpid() fcntl$setown(r3, 0x6, r4) write(r2, &(0x7f0000000340), 0xd4e688a67930cd) closefrom(r1) setsockopt(r0, 0x1000000029, 0x2e, &(0x7f0000000040)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r0, 0x1000000029, 0x2e, &(0x7f0000000000)="ebf6cbdf13b9fd812eaa4e712e54e69931929648", 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0xa7210e10bc3c9def) rmdir(&(0x7f0000000180)='./file1\x00') 63.986238ms ago: executing program 1 (id=13): r0 = syz_open_pts() r1 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x2012, r1, 0x0) r2 = open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x100) ftruncate(r2, 0x79c8) open$dir(&(0x7f0000000040)='./file0\x00', 0x8, 0x184) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) mmap(&(0x7f0000234000/0x3000)=nil, 0x3000, 0x5, 0xba9759f598ed8c17, r3, 0x7) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlock(&(0x7f0000001000/0x2000)=nil, 0x2000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sysctl$net_inet_ip(&(0x7f0000000000)={0x4, 0x2, 0x0, 0x16}, 0x4, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_pts() sysctl$net_inet_tcp(&(0x7f00000000c0)={0x4, 0x2, 0x6, 0x19}, 0x4, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000040)={0x7, 0xa, 0xffffdfba, 0x21d8b788, "0a2c36a8f196d38dcdf21300", 0xa, 0x820003a}) syz_emit_ethernet(0x16, &(0x7f0000001800)={@broadcast, @random="109bb84d7762", [], {@ipv6={0x86dd, {0x8, 0x6, "9d507a", 0x8, 0xf0, 0x3, @empty, @loopback, {[], @udp={{0x3, 0x3, 0x8}}}}}}}) ioctl$TIOCSTAT(r0, 0x20007465) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r5, 0xc, r4) 62.922871ms ago: executing program 6 (id=14): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f0000000340)="58dedd6c29fd4cd7d63d167ee976fc5d3fb2ccc38e592b07816d8c5502b783898234605f18a1dc8b4b1cdc5c663d26c62f08412049aa6645213be805fe30a158bb6cfb55d3c15e52ad336cdd0eac7721cb8535989e60a3deacb1987ece2d63aa624114a305f1", 0x66) kqueue() kevent(0xffffffffffffffff, &(0x7f0000000080)=[{{}, 0xfffffffffffffff6, 0x0, 0xf27ff779bbbc9c09, 0xfb, 0x10000}], 0x10003, 0x0, 0x9b6c, 0x0) kevent(0xffffffffffffffff, &(0x7f0000000040)=[{{}, 0xfffffffffffffff6, 0xa7, 0x40000000, 0xfffffffffffffffd, 0x13fff}], 0x4, 0x0, 0x8, 0x0) ioctl$VMM_IOC_RESETCPU(0xffffffffffffff9c, 0x82405605, &(0x7f0000000100)={0x0, 0xb3f, {[0xfffffbfffffffffb, 0x0, 0x8, 0x100200000, 0x6, 0x7, 0x400000000000df60, 0xfffffffffffffffe, 0x0, 0x2, 0x93, 0x3, 0xffffffffffffffff, 0x200000000002, 0x12, 0x4, 0xfffffffffffffffe, 0x400000000100], [0xfffffffffffffffe, 0x80000001, 0xf800000000000000, 0x525, 0x20000000000005e, 0x200000000207b9a, 0x3, 0x0, 0x0, 0x9], [0x100000001, 0x1, 0x3ffffffe, 0x10f, 0xb, 0x11000, 0xffffffff00000000], [0x104, 0x1fffffffffb, 0x7ffffffffffffffc, 0x100000000, 0xfffffffffffffffe, 0x1], [{0x0, 0x200, 0x0, 0x7d02}, {0xfffc, 0x22, 0x5, 0xfffffffffffffff9}, {0x4, 0x0, 0xfffffffe, 0x80}, {0x3, 0x100000b7, 0x5, 0xffffffffffffffff}, {0x0, 0x2, 0x7f, 0x8}, {0x0, 0x4, 0x9, 0x2000000000000002}, {0x10, 0x0, 0xfffffff9}, {0x0, 0x101, 0x0, 0x8}], {0x1, 0x5, 0x7, 0x3}, {0xfbfe, 0x3, 0x6d5, 0x4}}}) r1 = kqueue() setrlimit(0x8, &(0x7f0000000000)={0x42, 0x62}) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') unveil(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='c\x00') unveil(&(0x7f00000000c0)='./file0/file0/..\x00', &(0x7f0000000100)='c\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) r2 = syz_open_pts() ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x80000000, 0xfffffff0, 0x7, 0x2, 0x8, 0x3, 0x40, 0x10, [{0x5, 0x2, 0x775}, {0x8, 0x8, 0x6, 0xfff}, {0x7, 0xfdfffffe, 0x7, 0x20000}, {0x5, 0xdf, 0xf}, {0x0, 0x7, 0xf11, 0xb}, {0x203, 0xffff, 0x80cf, 0x1}, {0x3, 0x800, 0x100, 0x5}, {0x0, 0x40009, 0xfffffffb, 0xfbffe2e9}, {0x9b, 0xffe, 0x9, 0x7fff}, {0x3, 0x0, 0x5, 0x8bfe}, {0x0, 0x8000000, 0x44d2, 0x2}, {0x4, 0xc7ce, 0x800000, 0x5}, {0x401, 0x106, 0x92fb, 0x40}, {0x200003, 0x80000000, 0x9, 0x6f5fc48b}, {0x81, 0x0, 0x1001, 0x5}, {0x9bde, 0x8001, 0x5, 0x69}]}) poll(&(0x7f0000000000), 0x35, 0x0) close(r2) kevent(r1, &(0x7f0000000240), 0xde0, 0x0, 0x8, 0x0) kevent(r1, &(0x7f0000000040), 0xe4a, 0x0, 0xa9fa, 0x0) r3 = socket(0x18, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000040)={0x1c, 0x18, 0x3, 0x9, "00000000000000000000000000000001", 0xc}, 0x1c) kqueue() ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x100000000000000, 0x10040000000001}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r4 = socket(0x11, 0x5, 0x0) setsockopt(r4, 0x11, 0x3, &(0x7f00000011c0), 0x0) r5 = socket(0x18, 0x2, 0x0) setsockopt(r5, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) connect(r3, &(0x7f00000002c0)=@un=@file={0x2, 0x1, './file0\x00'}, 0xa) 62.349621ms ago: executing program 4 (id=15): r0 = syz_open_pts() fcntl$lock(r0, 0x8, &(0x7f0000000000)={0x1, 0x0, 0x7fff, 0x1000300000080}) flock(r0, 0x1) (async) flock(r0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000180)="cfb849f13a8eb9d90f9021322823ddc406333cc7084eafe86e73cd9829", 0x1d}, {&(0x7f00000001c0)="d0615aa1", 0x4}, {&(0x7f0000000200)="0afb", 0x2}, {&(0x7f0000000240)="7941b450b844ea7a6a8b0874214df6518325931b4570350767c1f79fd97be9ae19acb84ac4e7becf6c94dcd0ee289ebf877bcb3952d1144a", 0x38}, {&(0x7f0000000280)="a086f1dfe1fcd610a61f68046c746bb865e6bc9e5fa12ac108e5dd7646c8b98b75458077f3c230b164dde165cc4a527807f8404d5d3813dfc37c0c797da6ff33fe3b19ea397cab8a60b1fb6fc25f637551b7fcf9658f48cac73567807ef1d23f896d8e0dd1331da017d2e1ab6beb07907135056ac863d519043d01b3e0410aac034fc5044cde54bc6657e3de41903aaa8b2f295c63c2ed4c2b868741d9c64c5a6a70cd3d5766d5cff0ce20621fec0fd48171666316b480d045ce8f33292d97d3512f7cc02b9dae65ec9df8c751a79b6cf341e453f8504c4d059f45877ab15b23038f2422a27fb30ae0fc788c840bc91855b68c7e9495a04670dd0039145c09560e95ab1fe856d955fcf8cd6db6d0471f934f5151d100", 0x116}], 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="10ff00000100000800000000", @ANYRESDEC=r2], 0x10, 0x40a}, 0x406) r3 = socket(0x18, 0x2, 0x0) getsockopt$sock_int(r3, 0xffff, 0x10, &(0x7f0000000200), &(0x7f0000000000)=0xffffffffffffff28) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) socket(0x2, 0x400000000002, 0x0) (async) r4 = socket(0x2, 0x400000000002, 0x0) setsockopt(r4, 0x0, 0x1f, &(0x7f0000000080)='?\x00\x00\x00', 0x4) ioctl$TIOCEXCL(r0, 0x2000740d) flock(r0, 0x1) mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) unveil(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)='r\x00') (async) unveil(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)='r\x00') unveil(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='w\x00') socket(0x18, 0x2, 0x0) (async) r5 = socket(0x18, 0x2, 0x0) setsockopt(r5, 0x1000000000029, 0x3f, 0x0, 0x0) open(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r6 = shmget$private(0x0, 0x4000, 0x90, &(0x7f0000ffc000/0x4000)=nil) shmctl$IPC_SET(r6, 0x1, &(0x7f0000000380)={{0x0, 0x0, 0x0, 0x0, 0x1c0, 0x109, 0x0, 0x0, 0x8}, 0x400, 0x0, 0x0, 0xb, 0x0, 0xfffffffffffffff8, 0x2, 0x8, 0xd, 0x8000, 0xa}) shmctl$IPC_STAT(r6, 0x2, 0x0) (async) shmctl$IPC_STAT(r6, 0x2, 0x0) flock(r0, 0x1) (async) flock(r0, 0x1) fcntl$lock(r0, 0x9, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x1000300000080}) 62.142217ms ago: executing program 3 (id=4): syz_emit_ethernet(0x22, &(0x7f0000000140)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x65, 0x0, 0x4, 0x29, 0x0, @multicast2, @rand_addr=0x1e}}}}}) r0 = open(&(0x7f0000000380)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7949) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000000)='#!', 0x2}], 0x1) write(r0, &(0x7f0000000040)="89602009095c2a41694200f5ffff6552b77b6a0a", 0x14) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x812, r1, 0x0) close(r1) r2 = shmget$private(0x0, 0x3000, 0x143, &(0x7f0000ffa000/0x3000)=nil) close(r0) shmctl$IPC_SET(r2, 0x1, &(0x7f0000000240)={{0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7, 0x7}, 0x5, 0xfffc, 0x0, 0x0, 0x1, 0x0, 0x800000800000000, 0x0, 0x20}) shmat(r2, &(0x7f0000001000/0x3000)=nil, 0x2000) shmat(r2, &(0x7f0000fff000/0x1000)=nil, 0x1000) 59.615112ms ago: executing program 4 (id=16): r0 = socket(0x18, 0x2, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xe8, 0x0) r2 = fcntl$dupfd(r1, 0x3, 0xffffffffffffffff) dup(r2) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0x200007, 0x7, 0x101, 0x7, 0x7, 0x10001, 0x10, [{0x0, 0x7, 0x4, 0x35}, {0x7, 0xfffffffc, 0x8, 0xfffffff8}, {0x9, 0xf86, 0x0, 0xaf9}, {0x1, 0x800, 0x8, 0x400}, {0x401, 0x4, 0xe, 0x3}, {0x2, 0x6, 0x3, 0x99}, {0xddf, 0x1, 0x40000005, 0x101}, {0x7, 0x7ff, 0x14, 0x8}, {0x5, 0x7fffffff, 0x1, 0x9}, {0xfffffffe, 0x7, 0xc8, 0x88}, {0x3, 0x50001, 0x9, 0xaec}, {0x7ff, 0x9, 0x3, 0x4}, {0xb8c, 0x4, 0x5, 0x6}, {0x29a71717, 0xfffffffa, 0x2, 0x6}, {0x4, 0x80000004, 0x6}, {0x0, 0x132e, 0x2, 0xfe}]}) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r3, 0x7fff) setsockopt(r3, 0x6, 0x4, &(0x7f0000000040)="d2674561", 0x4) syz_emit_ethernet(0x36, &(0x7f0000000140)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x0, 0x6, 0x0, @broadcast, @local={0xac, 0x14, 0x0}}, @tcp={{0x2, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x8201, 0x0, 0xfffc}}}}}}) poll(&(0x7f0000000240)=[{r0, 0x2}], 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002e40)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r5, &(0x7f0000002fc0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002f80)=[@rights={0x10, 0xffff, 0x1, [0xffffffffffffffff]}], 0x10, 0x5}, 0x406) sendto(r5, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000140)={{0x0, 0x0, 0x0, 0x0, 0x0}, 0x4}, 0x38, 0x2000, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') unveil(&(0x7f00000000c0)='./file0/file0/..\x00', &(0x7f0000000100)='c\x00') r6 = socket(0x2, 0x4001, 0x0) shutdown(r6, 0x2) recvmmsg(r6, &(0x7f00000002c0)={{0x0, 0x0, 0x0, 0x0, 0x0}, 0x2}, 0x38, 0x41, 0x0) execve(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) symlink(&(0x7f0000000080)='./file0/file0/..\x00', &(0x7f0000000140)='./file0/file0/..\x00') 0s ago: executing program 2 (id=3): r0 = socket$inet(0x2, 0x4800, 0x13) r1 = socket(0x18, 0x1, 0x0) setsockopt(r1, 0x1000000000029, 0x3e, &(0x7f0000000040), 0x0) bind$inet(r0, &(0x7f0000000040)={0x10, 0x2, 0x2, 0xffffffff}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x9719eec28eff38ce, &(0x7f0000000000)={0x10, 0x2, 0x2, 0xe0000001}, 0x10) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.147' (ED25519) to the list of known hosts. panic: kernel diagnostic assertion "pr->ps_threadcnt == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_exit.c", line 888 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 219930 53070 32767 0x10 0 0 syz-executor *107317 47513 0 0x14000 0x200 1K reaper db_enter() at db_enter+0x25 panic(ffffffff834bcf5b) at panic+0x1e5 __assert(ffffffff834f9fdc,ffffffff8349b644,378,ffffffff8351a711) at __assert+0x29 process_zap(ffff80003abc9360) at process_zap+0x31d reaper(ffff800045ffdc90) at reaper+0x2b0 end trace frame: 0x0, count: 10 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "pr->ps_threadcnt == 0" failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_exit.c", line 888 ddb{1}> show kasan No such command ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff834bcf5b) at panic+0x1e5 __assert(ffffffff834f9fdc,ffffffff8349b644,378,ffffffff8351a711) at __assert+0x29 process_zap(ffff80003abc9360) at process_zap+0x31d reaper(ffff800045ffdc90) at reaper+0x2b0 end trace frame: 0x0, count: -5 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80002a1f4060 rbx 0xffff80002999ee07 rdx 0 rcx 0xffff800045ffdc90 rax 0xffff80002999dff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x9dcf77231b058cdb r11 0x1bef00bc6a5eb9e7 r12 0xffff80002999ec08 r13 0 r14 0 r15 0x1 rip 0xffffffff811ec255 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a1f4050 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (reaper) tid=107317 pid=47513 tcnt=1 stat=onproc flags process=14000 proc=200 runpri=32, usrpri=51, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045fff4c0,0xffff800045ffd240 process=0xffff800045ffb9c0 user=0xffff80002a1ef000, vmspace=0xffffffff839dfdc0 estcpu=1, cpticks=7, pctcpu=0.0, user=0, sys=0, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 9056 72134 64653 32767 2 0x10 0 syz-executor 20436 378390 55445 32767 2 0x10 0 syz-executor 20436 16575 55445 32767 3 0x10 0x4000080 fsleep syz-executor 53070 219930 46343 32767 7 0x10 0 syz-executor 53070 142999 46343 32767 3 0x10 0x4000080 lockf syz-executor 53070 339794 46343 32767 3 0x10 0x4000080 fsleep syz-executor 56161 258689 38634 32767 2 0x10 0 syz-executor 56161 215333 38634 32767 3 0x10 0x4000080 fsleep syz-executor 59835 96792 33235 32767 2 0x10 0 syz-executor 59835 482308 33235 32767 2 0x10 0x4000000 syz-executor 64020 72599 90906 32767 2 0x10 0 syz-executor 64020 160597 90906 32767 3 0x10 0x4000080 fsleep syz-executor 64020 416198 90906 32767 3 0x10 0x4000080 fsleep syz-executor 90906 408967 24840 32767 3 0x10 0x80 nanoslp syz-executor 64653 303498 48208 32767 3 0x10 0x80 nanoslp syz-executor 7914 259525 55326 32767 2 0x10 0xc80 syz-executor 7914 195087 55326 32767 3 0x10 0x4000080 sbwait syz-executor 7914 442069 55326 32767 3 0x10 0x4000080 sbufrcv syz-executor 7914 252220 55326 32767 3 0x10 0x4000080 fsleep syz-executor 33235 92635 59579 32767 3 0x10 0x80 nanoslp syz-executor 50014 293026 85793 32767 2 0x10 0xc80 syz-executor 46343 131032 8338 32767 3 0x10 0x80 nanoslp syz-executor 55445 173842 46738 32767 2 0x10 0xc80 syz-executor 38634 369190 2139 32767 3 0x10 0x80 nanoslp syz-executor 55326 492656 22931 32767 3 0x10 0x80 nanoslp syz-executor 59579 261040 62539 0 3 0x2 0x80 wait syz-executor 85793 396637 62539 0 3 0x2 0x80 wait syz-executor 24840 160525 62539 0 3 0x2 0x80 wait syz-executor 8338 403518 62539 0 3 0x2 0x80 wait syz-executor 48208 291622 62539 0 3 0x2 0x80 wait syz-executor 46738 410700 62539 0 3 0x2 0x80 wait syz-executor 2139 48868 62539 0 3 0x2 0x80 wait syz-executor 22931 405991 62539 0 3 0x2 0x80 wait syz-executor 62539 258951 7849 0 3 0x2 0x80 kqread syz-executor 7849 253757 17714 0 3 0x100002 0x88 sigsusp ksh 17714 280707 86340 0 3 0x10 0x88 kqread sshd-session 86340 237172 6221 0 3 0x12 0x80 kqread sshd-session 20906 57743 1 0 3 0x100003 0x80 ttyin getty 6221 366106 1 0 3 0 0x88 kqread sshd 33687 406948 86584 73 3 0x1100010 0x80 kqread syslogd 86584 109987 1 0 3 0x100002 0x80 sbwait syslogd 79642 43363 1 0 3 0x100000 0x80 kqread resolvd 76449 108915 12318 77 3 0x100012 0x80 kqread dhcpleased 5333 404454 12318 77 3 0x100012 0x80 kqread dhcpleased 12318 198584 1 0 3 0 0x80 kqread dhcpleased 56408 181125 0 0 2 0x14000 0x40000200 smr 88407 133226 0 0 2 0x14000 0x200 zerothread 73633 216808 0 0 3 0x14000 0x200 aiodoned aiodoned 79016 421837 0 0 3 0x14000 0x200 syncer update 171 358014 0 0 3 0x14000 0x200 cleaner cleaner *47513 107317 0 0 7 0x14000 0x200 reaper 99565 344743 0 0 3 0x14000 0x200 pgdaemon pagedaemon 79029 57623 0 0 3 0x14000 0x200 bored viomb 15737 205491 0 0 3 0x14000 0x40000200 acpi0 acpi0 81458 1909 0 0 3 0x14000 0x40000200 idle1 28317 314398 0 0 3 0x14000 0x200 bored softnet1 94612 480492 0 0 2 0x14000 0x200 softnet0 67695 514626 0 0 3 0x14000 0x200 smrbar systqmp 89148 207037 0 0 3 0x14000 0x200 bored systq 46452 398282 0 0 3 0x14000 0x200 tmoslp softclockmp 38086 391445 0 0 3 0x14000 0x40000200 tmoslp softclock 9343 82633 0 0 3 0x14000 0x40000200 idle0 1 476731 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 53070 (syz-executor) thread 0xffff80003abc6028 (219930) exclusive rwlock uobjlk r = 0 (0xfffff8806b3f9198) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 uvm_fault+0x1e5 #3 upageflttrap+0xa9 #4 usertrap+0x430 #5 recall_trap+0x8 shared rwlock vmmaplk r = 0 (0xfffff8806af5eca0) #0 witness_lock+0x5f1 #1 rw_do_enter_read+0x3e8 #2 uvmfault_lookup+0x122 #3 uvm_fault_check+0x4f #4 uvm_fault+0x106 #5 upageflttrap+0xa9 #6 usertrap+0x430 #7 recall_trap+0x8 Process 7914 (syz-executor) thread 0xffff80003a7b87e8 (195087) exclusive rwlock sbufrcv r = 0 (0xffff8000015a1b70) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 sblock+0xb6 #3 soreceive+0x27d #4 recvit+0x40b #5 sys_recvmmsg+0x410 #6 syscall+0xbd4 #7 Xsyscall+0x128 Process 47513 (reaper) thread 0xffff800045ffdc90 (107317) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83ad5ec0) #0 witness_lock+0x5f1 #1 __mp_acquire_count+0x58 #2 sleep_finish+0x2d8 #3 rw_do_enter_write+0x1dc #4 knote_processexit+0x2b #5 reaper+0x26d #6 proc_trampoline+0x10 Process 67695 (systqmp) thread 0xffff800045ffecf8 (514626) shared rwlock systqmp r = 0 (0xffffffff839cb608) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11047 12018K 12034K 166960K 12138 0 pcb 17 12K 12K 166960K 17 0 rtable 237 6K 7K 166960K 347 0 pf 31 16K 16K 166960K 31 0 ifaddr 42 7K 7K 166960K 44 0 ifgroup 50 2K 2K 166960K 50 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 2K 166960K 29 0 iov 1 4K 8K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1287 81K 81K 166960K 1353 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 5K 166960K 5 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 26 97K 117K 166960K 155 0 proc 59 115K 147K 166960K 498 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 2 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 43 201K 201K 166960K 43 0 exec 0 0K 1K 166960K 362 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 268 181K 181K 166960K 3071 0 UVM aobj 8 2K 2K 166960K 8 0 pinsyscall 47 94K 109K 166960K 1225 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 2 0K 0K 166960K 4 0 NDP 25 1K 2K 166960K 27 0 temp 34 9114K 9120K 166960K 3622 0 kqueue 19 29K 29K 166960K 33 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 34 0 31 1 0 1 1 0 8 0 rtentry 176 111 0 1 5 0 5 5 0 8 0 unpcb 144 43 0 26 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 14 0 9 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 75 0 61 2 0 2 2 0 8 0 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 453 0 0 29 0 29 29 0 8 0 art_table 40 454 0 0 5 0 5 5 0 8 0 art_node 32 111 0 10 1 0 1 1 0 8 0 shmpl 112 5 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1570 0 107 92 0 92 92 0 8 0 ffsino 296 1570 0 107 113 0 113 113 0 8 0 nchpl 144 1786 0 91 63 0 63 63 0 8 0 vnodes 216 1651 0 0 92 0 92 92 0 8 0 namei 1024 5225 0 5225 1 0 1 1 0 8 1 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 25 0 0 2 0 2 2 0 8 0 scxspl 216 6136 0 6136 4 2 2 3 1 8 2 plimitpl 152 39 0 13 1 0 1 1 0 8 0 sigapl 424 444 0 390 7 0 7 7 0 8 0 knotepl 120 508 0 0 16 0 16 16 0 8 0 kqueuepl 224 29 0 14 1 0 1 1 0 8 0 pipepl 344 122 0 95 3 0 3 3 0 8 0 fdescpl 528 428 0 390 3 0 3 3 0 8 0 filepl 160 1507 0 1281 10 0 10 10 0 8 0 lockfpl 104 15 0 10 1 0 1 1 0 8 0 lockfspl 48 8 0 4 1 0 1 1 0 8 0 sessionpl 144 23 0 7 1 0 1 1 0 8 0 pgrppl 48 31 0 7 1 0 1 1 0 8 0 ucredpl 104 128 0 109 1 0 1 1 0 8 0 zombiepl 144 391 0 390 1 0 1 1 0 8 0 processpl 1232 444 0 390 5 0 5 5 0 8 0 procpl 664 469 0 405 6 0 6 6 0 8 0 sockpl 752 152 0 118 4 0 4 4 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 115 0 0 15 0 15 15 0 8 0 mcl2k 2048 18 0 0 3 0 3 3 0 8 0 mextrefs 64 18 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 185 0 0 12 0 12 12 0 8 0 bufpl 272 2244 0 102 143 0 143 143 0 8 0 anonpl 32 5982 0 0 49 0 49 49 0 247 0 amapchunkpl 152 8847 0 7884 40 0 40 40 0 158 2 amappl16 200 1679 0 1664 5 0 5 5 0 8 4 amappl15 192 5 0 5 1 0 1 1 0 8 1 amappl14 184 418 0 417 1 0 1 1 0 8 0 amappl13 176 114 0 104 1 0 1 1 0 8 0 amappl12 168 673 0 636 2 0 2 2 0 8 0 amappl11 160 9 0 8 1 0 1 1 0 8 0 amappl10 152 60 0 50 1 0 1 1 0 8 0 amappl9 144 268 0 268 1 0 1 1 0 8 1 amappl8 136 89 0 88 1 0 1 1 0 8 0 amappl7 128 139 0 128 1 0 1 1 0 8 0 amappl6 120 146 0 145 1 0 1 1 0 8 0 amappl5 112 102 0 95 1 0 1 1 0 8 0 amappl4 104 256 0 241 1 0 1 1 0 8 0 amappl3 96 1437 0 1300 6 2 4 4 0 8 0 amappl2 88 500 0 451 2 0 2 2 0 8 0 amappl1 80 10037 0 9455 14 0 14 14 0 8 0 amappl 88 2400 0 2200 5 0 5 5 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 7 0 0 1 0 1 1 0 8 0 uaddrrnd 24 428 0 390 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 428 0 390 1 0 1 1 0 8 0 vmmpekpl 168 5417 0 5388 2 0 2 2 0 8 0 vmmpepl 168 36547 0 34457 94 0 94 94 0 357 2 vmsppl 488 427 0 390 7 1 6 6 0 8 0 rwobjpl 80 13939 0 12981 22 0 22 22 0 8 0 pdppl 4096 863 0 780 105 12 93 93 0 8 10 pvpl 32 15076 0 0 122 0 122 122 0 265 0 pmappl 256 427 0 390 4 1 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 414 0 15 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff839d8ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83ad56c0) at __mp_lock+0x192 softintr_dispatch(0) at softintr_dispatch+0x125 dosoftint(0) at dosoftint+0x54 Xsoftclock() at Xsoftclock+0x27 __mp_lock(ffffffff83ad56c0) at __mp_lock+0x192 uvm_fault(fffff8806af5eba0,6b3d1f79000,0,1) at uvm_fault+0x1ea upageflttrap(ffff80003c3faf90,6b3d1f79000) at upageflttrap+0xa9 usertrap(ffff80003c3faf90) at usertrap+0x430 recall_trap() at recall_trap+0x8 end of kernel end trace frame: 0x758fc7b94c50, count: 3 ddb{0}> trace x86_ipi_db(ffffffff839d8ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83ad56c0) at __mp_lock+0x192 softintr_dispatch(0) at softintr_dispatch+0x125 dosoftint(0) at dosoftint+0x54 Xsoftclock() at Xsoftclock+0x27 __mp_lock(ffffffff83ad56c0) at __mp_lock+0x192 uvm_fault(fffff8806af5eba0,6b3d1f79000,0,1) at uvm_fault+0x1ea upageflttrap(ffff80003c3faf90,6b3d1f79000) at upageflttrap+0xa9 usertrap(ffff80003c3faf90) at usertrap+0x430 recall_trap() at recall_trap+0x8 end of kernel end trace frame: 0x758fc7b94c50, count: -12 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff834bcf5b) at panic+0x1e5 __assert(ffffffff834f9fdc,ffffffff8349b644,378,ffffffff8351a711) at __assert+0x29 process_zap(ffff80003abc9360) at process_zap+0x31d reaper(ffff800045ffdc90) at reaper+0x2b0 end trace frame: 0x0, count: 10 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff834bcf5b) at panic+0x1e5 __assert(ffffffff834f9fdc,ffffffff8349b644,378,ffffffff8351a711) at __assert+0x29 process_zap(ffff80003abc9360) at process_zap+0x31d reaper(ffff800045ffdc90) at reaper+0x2b0 end trace frame: 0x0, count: -5