last executing test programs: 1.794031492s ago: executing program 3 (id=4): open(&(0x7f0000000040)='./file1\x00', 0x200, 0x104) r0 = socket(0x18, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) r2 = kqueue() kevent(r2, &(0x7f00000001c0)=[{{r1}, 0xfffffffffffffffb, 0x45, 0x40000000, 0x9, 0x400080000000006}], 0x1006, 0x0, 0x5, 0x0) r3 = socket(0x18, 0x1, 0x0) fcntl$dupfd(r3, 0x2, 0xffffffffffffffff) r4 = kqueue() kevent(r4, &(0x7f00000001c0), 0x1006, 0x0, 0x5, 0x0) acct(0x0) acct(&(0x7f0000000280)='./file1\x00') 704.625422ms ago: executing program 3 (id=19): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DIOCXBEGIN(r0, 0xc0104451, &(0x7f0000000140)={0x1, 0x408, &(0x7f0000000dc0)=[{0x1, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x3}]}) 694.84932ms ago: executing program 5 (id=21): mknod(&(0x7f0000000040)='./file0\x00', 0x6000, 0xe02) r0 = open(&(0x7f0000000380)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7949) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000240)='#!', 0x2}], 0x1) 674.927254ms ago: executing program 5 (id=24): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5900) close(0xffffffffffffffff) r0 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) ioctl$VNDIOCSET(r0, 0xc0384600, &(0x7f0000000140)={&(0x7f0000000180)='./file0\x00', 0x567, 0x0}) 651.618625ms ago: executing program 5 (id=27): r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) ioctl$DIOCXCOMMIT(r0, 0xc0104452, &(0x7f00000011c0)={0x1, 0x408, &(0x7f0000000300)=[{0x2, './file0\x00', 0x1}]}) 593.267511ms ago: executing program 3 (id=30): pipe(&(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000000740)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000480)=""/241, 0xf1}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) dup2(r1, r0) execve(0x0, 0x0, 0x0) 589.099941ms ago: executing program 5 (id=32): r0 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000500), 0x800, 0x0) mknod(0x0, 0x2000, 0x1e60) fcntl$setown(r0, 0x6, 0x0) 493.495651ms ago: executing program 4 (id=38): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000140)={0x4, &(0x7f0000000600)=[{0x40, 0xff, 0x23, 0x6}, {0x24, 0x0, 0x2, 0x2}, {0x3, 0x9, 0xff, 0x6}, {0x9b1e, 0x4, 0xf4, 0x6}]}) syz_emit_ethernet(0x2a, &(0x7f0000000200)=ANY=[]) 469.196583ms ago: executing program 4 (id=41): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x205b92) r0 = open(&(0x7f0000000040)='./file0\x00', 0x20, 0x0) ioctl$FIONBIO(r0, 0x82907003, &(0x7f0000000140)=0x1) 400.338408ms ago: executing program 4 (id=43): setitimer(0x0, &(0x7f0000000280)={{0x0, 0x4}, {0x3, 0x7}}, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x615, 0x0) ktrace(&(0x7f0000000000)='./file0\x00', 0x4, 0x538, 0x0) setitimer(0x0, 0x0, &(0x7f0000000080)) 397.915336ms ago: executing program 7 (id=44): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x7fff) syz_emit_ethernet(0x46, &(0x7f0000000580)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3d, 0x38, 0x67, 0x0, 0x0, 0x6, 0x0, @multicast1, @local={0xac, 0x14, 0x0}}, @tcp={{0x2, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0xfff8, 0x0, 0xfffc, {[@generic={0x2, 0x10, "a26e7082b98f3c380db37ff8b0ca"}]}}}}}}}) 397.070429ms ago: executing program 5 (id=45): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f00000000c0)={0x3, &(0x7f0000000440)=[{0x80, 0x6d, 0x6, 0x92e1}, {0x3c, 0xf0, 0x24, 0x904}, {0x10e, 0x22, 0x80, 0x3c}]}) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) syz_emit_ethernet(0x4e, &(0x7f0000000240)=ANY=[]) 391.997264ms ago: executing program 3 (id=46): openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x19, 0x0) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) r1 = socket$inet(0x2, 0x8003, 0x0) dup(r1) unveil(0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r2 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) close(r2) r3 = socket(0x2, 0x1, 0x0) connect$unix(r3, &(0x7f0000000000), 0x10) setsockopt$sock_int(r2, 0xffff, 0x1023, &(0x7f00000004c0)=0x200, 0x4) shutdown(r2, 0x1) 363.190845ms ago: executing program 4 (id=47): r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r1 = socket(0x18, 0x1, 0x0) ioctl$FIONREAD(r1, 0x8020699d, &(0x7f00000001c0)) 339.297246ms ago: executing program 7 (id=48): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x4, 0x0, 0x48, 0x3fb}, {0x61, 0xf0, 0xff}, {0x6, 0x80, 0xb6, 0xfffffffe}]}) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000080)={'tap', 0x0}) syz_emit_ethernet(0x1000e, &(0x7f0000000080)=ANY=[]) 262.784502ms ago: executing program 2 (id=50): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000000)={0x5, &(0x7f0000000100)=[{0x6c, 0xfb, 0xfd, 0x3}, {0x2d, 0x0, 0x2, 0x9}, {0x4, 0x9, 0x4, 0x1006}, {0x87, 0x28, 0x9, 0x102}, {0x9b9e, 0x2, 0xf4, 0x6}]}) syz_emit_ethernet(0x22, &(0x7f0000000480)={@broadcast, @random="ca0f00", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x12, 0x14, 0x66, 0xf, 0xff, 0xff, 0x0, @broadcast, @rand_addr=0xdfffffff}}}}}) 261.583699ms ago: executing program 1 (id=51): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x20, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x2, 0x8, 0x5, 0x1}, {0x48, 0xf0, 0x3, 0x4}, {0x6, 0x24, 0x0, 0xfffff802}]}) syz_emit_ethernet(0x36, &(0x7f0000000140)={@local, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x28, 0x68, 0x0, 0x5, 0x6, 0x0, @remote={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}}, @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xa7}}}}}}) 258.225487ms ago: executing program 4 (id=52): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x1000000029, 0xc, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r0, 0x1000000029, 0x9, 0x0, 0x0) 247.36861ms ago: executing program 5 (id=53): r0 = syz_open_pts() syz_open_pts() syz_open_pts() fchflags(r0, 0x0) 225.715719ms ago: executing program 0 (id=54): r0 = socket$inet6(0x18, 0x1, 0x6) bind$inet6(r0, &(0x7f00000000c0)={0x1c, 0x18, 0x1, 0x4, '\x00', 0x6}, 0x1c) r1 = socket$inet6(0x18, 0x1, 0x6) bind$inet6(r1, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000000000000000000000000001", 0x7}, 0x1c) 222.864323ms ago: executing program 1 (id=55): ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r0 = socket(0x2, 0x2, 0x0) ioctl$FIONREAD(r0, 0xc0206921, &(0x7f00000001c0)) ioctl$FIONREAD(r0, 0x80206913, &(0x7f00000001c0)) 220.956357ms ago: executing program 2 (id=56): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) r0 = socket(0x1, 0x2, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$FIONREAD(r0, 0x80146952, &(0x7f00000001c0)) 217.970501ms ago: executing program 3 (id=57): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x9, 0xff, 0x10000, 0x0, 0x0, 0x3, 0x8, 0x2, 0x0, 0x2000004, 0x6}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x8000, 0xba) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x209, 0x40009, 0x4, 0x0, 0x8000000a, 0x2, 0x8, 0x2, 0x0, 0x2000004, 0x2}) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) closefrom(r2) 202.936188ms ago: executing program 2 (id=58): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x0, 0x8}, {0x3}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x33}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x3414, 0x0, 0x37) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sysctl$kern(&(0x7f00000000c0)={0x1, 0x5a}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x3414, 0x0, 0x37) 198.939048ms ago: executing program 1 (id=59): r0 = socket(0x2, 0x2, 0x0) ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f0000000100)={0x10, 0x0, {[0xfffefbfffffffff6, 0x1, 0x2, 0x5, 0x2, 0x0, 0x8, 0x0, 0xfffffffffffffffc, 0x4, 0x5, 0x3, 0xffffffffffffffff, 0x4, 0x8000000, 0x20000000001000a8, 0x8000002, 0xce7], [0x1, 0x80000001, 0xfffffffffffffffb, 0x8000fffffffc, 0x100, 0x7b97, 0x200001fe, 0x2000404, 0x6, 0xffffffffffffffc1], [0x100000101, 0x2, 0x40000000, 0x6, 0xfffffffffbffefff, 0x11006, 0xfffffffffffffffe], [0x100, 0x8, 0x401, 0x100000000, 0xffffffffffefffff, 0x6], [{0x0, 0x5, 0x0, 0x9}, {0xfffc, 0x0, 0x4e, 0x3}, {0x1, 0x10000, 0x5bec, 0x814}, {0x3, 0x800001, 0x4, 0x80000003}, {0xd, 0xfffffffe, 0x0, 0xa000000}, {0x1, 0x2003, 0x3fffe, 0x4}, {0x1, 0x20000, 0x4, 0x8}, {0x0, 0x965, 0x0, 0x3}], {0x1ffc, 0x1000001, 0x10000}, {0x8000, 0x109, 0x3, 0x8000000000000002}}}) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$FIONREAD(r0, 0xc0206921, &(0x7f00000001c0)) ioctl$FIONREAD(r0, 0x8040691a, &(0x7f00000001c0)) 197.038374ms ago: executing program 0 (id=60): ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000000c0)={0x10, 0x4000000000, [{&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x200007bffffffffe}, {&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x4}, {&(0x7f00003a4000/0x2000)=nil, &(0x7f0000496000/0x3000)=nil, 0x8000000000b936}, {&(0x7f00000a9000/0x1000)=nil, &(0x7f000072c000/0x3000)=nil, 0x1000}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000704000/0x1000)=nil, 0x6}, {&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000401000/0x1000)=nil, 0x80000000}, {&(0x7f000055e000/0x4000)=nil, &(0x7f00005a9000/0x1000)=nil, 0x20a}, {&(0x7f000021f000/0x1000)=nil, &(0x7f0000012000/0x5000)=nil, 0x5}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0xf978}, {&(0x7f00003bc000/0x3000)=nil, &(0x7f000020e000/0x1000)=nil, 0xd}, {&(0x7f000064b000/0x2000)=nil, &(0x7f000038f000/0x4000)=nil, 0x12b}, {&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000800000/0x1000)=nil, 0x1000009}, {&(0x7f0000108000/0x11000)=nil, &(0x7f0000714000/0x3000)=nil, 0x7fffffffffffffff}, {&(0x7f000024b000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1800000000}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f000051d000/0x3000)=nil, 0x1000039f7}, {&(0x7f00001e1000/0x4000)=nil, &(0x7f0000212000/0x3000)=nil, 0x400000000005}], './file0/file0\x00', 0x1, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc7, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x705, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8007, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xbb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbab0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0xf4ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9775, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23a8]}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$TIOCSETA(r0, 0xc0404469, &(0x7f0000000140)={0x1, 0x0, 0x4, 0xfffffff5, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x008\x00', 0x0, 0x8}) 175.181768ms ago: executing program 2 (id=61): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) open(0x0, 0x800, 0x1f2ee1f15fe0ed07) r0 = socket(0x18, 0x3, 0x0) setsockopt(r0, 0x1000000029, 0x1a, &(0x7f0000000000)="a077965d", 0x4) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@broadcast, @random="1c3a07000200", [], {@ipv6={0x86dd, {0x0, 0x6, "99ffff", 0x18, 0x16, 0x81, @remote={0xfe, 0x80, '\x00', 0x0}, @mcast2, {[], @icmpv6=@ndisc_ns={0x87, 0x0, 0x0, 0x0, @rand_addr="4008a33a67b21fc0b74c00"}}}}}}) 172.979133ms ago: executing program 0 (id=62): ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000001c0)={0x10, 0x9, [{&(0x7f0000ffc000/0x3000)=nil, &(0x7f00000a5000/0x2000)=nil, 0x10}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x3}, {&(0x7f0000301000/0x1000)=nil, &(0x7f0000ff6000/0x8000)=nil, 0xa}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f000012d000/0x3000)=nil, 0x4}, {&(0x7f00001dd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x9}, {&(0x7f0000329000/0x3000)=nil, &(0x7f0000081000/0x4000)=nil, 0x2dc}, {&(0x7f0000110000/0x3000)=nil, &(0x7f00000ce000/0x3000)=nil, 0x9}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f000019e000/0x4000)=nil, 0xffffffff}, {&(0x7f000013a000/0x2000)=nil, &(0x7f0000366000/0x3000)=nil, 0x4}, {&(0x7f0000164000/0x6000)=nil, &(0x7f000026c000/0x3000)=nil, 0x3ff}, {&(0x7f0000312000/0x1000)=nil, &(0x7f00005b1000/0x4000)=nil, 0x4}, {&(0x7f00003ea000/0x4000)=nil, &(0x7f0000168000/0x1000)=nil, 0x2}, {&(0x7f00000c8000/0x4000)=nil, &(0x7f00001f4000/0x3000)=nil, 0x7fffffffffffffff}, {&(0x7f00003f2000/0x3000)=nil, &(0x7f00002e4000/0x3000)=nil, 0x16629c0e}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000160000/0x1000)=nil}, {&(0x7f00000f7000/0x1000)=nil, &(0x7f00000cc000/0x3000)=nil, 0xfffffffffffffff8}], './file0\x00', 0x84}) ioctl$BIOCSETIF(0xffffffffffffff9c, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r0 = socket(0x1, 0x2, 0x0) ioctl$FIONREAD(r0, 0x80206980, &(0x7f00000001c0)) 119.676022ms ago: executing program 2 (id=63): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x7fff) setsockopt$sock_int(r0, 0xffff, 0x1, &(0x7f0000000100)=0x7f, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @random="ede359580600", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x28, 0x0, 0x0, 0x5, 0x6, 0x0, @multicast1, @local={0xac, 0x14, 0x0}}, @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x1e, 0xa7, 0x0, 0x9}}}}}}) 104.97562ms ago: executing program 7 (id=64): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xfe, 0x0) ioctl$BIOCSHDRCMPLT(r0, 0x80044275, &(0x7f0000000200)=0x9) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) write(r0, &(0x7f00000003c0)="f81ad30100060000000100000000", 0xe) 102.355431ms ago: executing program 4 (id=65): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x16, 0x181c, 0xc, 0x2000000000000004}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x29, 0x20009, 0x10004, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0xa000004, 0x8}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x8000, 0xba) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file1\x00', 0x209, 0xf, 0x4, 0x0, 0x8000000a, 0x2, 0x1, 0x2, 0x2, 0x2000004, 0x2}) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) 83.976425ms ago: executing program 7 (id=66): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x9, 0xfffffff1, 0xffff, 0x0, 0x9, 0x3, 0x8, 0x0, 0x1, 0x2000004, 0x6}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0xba) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSDISPLAYIO_USEFONT(r1, 0x80585750, &(0x7f0000000140)={'./file1\x00', 0xffffffff, 0x80000009, 0x10000, 0x0, 0x8, 0x2, 0xb, 0x2, 0x0, 0x3d}) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) 72.177448ms ago: executing program 7 (id=67): openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) socket(0x1, 0x4001, 0x0) r0 = socket(0x18, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1023, &(0x7f0000000040)=0x4, 0xd4) 69.647628ms ago: executing program 0 (id=68): r0 = socket(0x18, 0x2, 0x0) setsockopt(r0, 0x1000000000029, 0x9, &(0x7f0000000080)='\t\x00\x00\x00', 0x4) connect(r0, &(0x7f0000000000)=@in6={0x1c, 0x18, 0x2, 0x8f38, "ffe54a09470300261febf2fc8dc83304", 0x1}, 0x1c) write(r0, &(0x7f00000000c0)="9389af2ab4d1ffd84d59ef02ccf591b28729514cf815e6c544a38332209a0410c0bd409e77392e039c305e667ce28c286812a924cf1c6779785940e784d43baa74cbb496b837b6c4ee78797dfb9001005beec530760d408a50e9c15fe0c618a65e99760a88e894c309fdccab10f5f4073a000200005b92615ffc5a78cb44ad3fc1074ac73cf64dd2e390435ba494664134fccc3e66863018f27559b05717536a0e928733e2dc023c66531bbd74467a2a7b72e545ed3dc03c502a65c1778bb49f9dd231eec6fcc7db6c1c815710dbcb8000"/219, 0xdb) 66.170321ms ago: executing program 1 (id=69): getgroups(0x7, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]) setresgid(r1, 0x0, r0) setresgid(0x0, 0x0, r0) open(&(0x7f0000000040)='./file1\x00', 0x200, 0x104) r2 = socket(0x18, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) r4 = kqueue() kevent(r4, &(0x7f00000001c0)=[{{r3}, 0xfffffffffffffffb, 0x45, 0x2, 0x9, 0x400080000000006}], 0x1006, 0x0, 0x5, 0x0) acct(&(0x7f0000000280)='./file1\x00') 46.124583ms ago: executing program 7 (id=70): r0 = syz_open_pts() syz_open_pts() r1 = open(&(0x7f0000000340)='./file1\x00', 0x200, 0xc) mmap(&(0x7f00004dc000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x100000000000000) r2 = openat$pf(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) r3 = dup(r2) ioctl$DIOCADDQUEUE(r3, 0xc148445d, &(0x7f0000000380)={0x0, 0x9, {'\x00', './file1\x00', './file1\x00', './file2\x00', {{0x80, 0x81}, {0xffffffff, 0xc}, 0x8}, {{0x2}, {0x0, 0xd}, 0x80000000}, {{0x4, 0x2}, {0x10001, 0xfffff001}, 0x3}, {0x0, 0x6, 0x2, 0x8}, 0x0, 0x36a, 0x9, 0x2}}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) flock(r0, 0x1) fcntl$lock(r0, 0x8, 0x0) ioctl$TIOCGFLAGS(r0, 0x4004745d, 0x0) r4 = getpid() ktrace(0x0, 0x0, 0x510, r4) setuid(0xffffffffffffffff) r5 = openat$pf(0xffffffffffffff9c, 0x0, 0x20, 0x0) ioctl$DIOCGETSTATUS(r5, 0xc2084415, 0x0) poll(0x0, 0x0, 0x0) open(&(0x7f0000000240)='./file0\x00', 0x205, 0x0) 43.056317ms ago: executing program 0 (id=71): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x9, 0xff, 0x10000, 0x0, 0x0, 0x3, 0x8, 0x2, 0x0, 0x2000004, 0x6}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x8000, 0xba) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x209, 0x40009, 0x4, 0x0, 0x8000000a, 0x2, 0x8, 0x2, 0x0, 0x2000004, 0x2}) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) closefrom(r0) 16.498644ms ago: executing program 1 (id=72): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) ioctl$DIOCXROLLBACK(r0, 0xc0104453, &(0x7f0000002340)={0x0, 0x408, &(0x7f00000007c0)}) sysctl$net_inet_ip(&(0x7f0000000100)={0x4, 0x2, 0x0, 0x1b}, 0x4, 0x0, 0x0, &(0x7f0000000440)="23363f6bf38294f7df4b2cc1e9619f829de90fb3159f3c959cc15973d1e806e0d294e98cccfd5ee7041cffd8ae7c993cf172c1cbee05b80004000000000000378e38025a52e02a3860ef0e89e6e984a3b9c7962da827861657fabf1af0c1082aab18756cddf820d20d9b9d02698cd5ac1622ada400bac20e78e430756ae3459c560007d90612c753ba04882fcd3ac94f5afceef7b9fa9a545d8160eba7d82279000000000000c0d66a4e7aa848738cf77cf35f800b916ac81dbf16ac550e7166bc0851fb091fcafeb3510fb8580e1dcf3de412423b1c40d87150a7a46afa40319234f5cd0c12564c7dfbedb91898345e07606ae6cd24468d9c015d9180f5a4c9bf4547e2c4d1a5a330e3217a3fbe283f5a00f8ae5c6384cf8583625340fda23c795d560e9d4cbb1116732bd3b66f49682e67aae3699b636551b475dc6254961b71db08f25163301f56d7b2eba274e3d9577465c0cabd6d1c01191e940000000000000034ffa03c825caaface191b97b4eaa2bb3ce9b38a876b896a8cbc098f1995ba749a6d2fe1f778e0e4e60d95da5c22e65deeb3d3b702abb0c46bf7a7cf06375c39691d0ed8c22491392e955b0f2e10ccecd80af74c4b833c84f2033c72bc6a500a2954fabd6a5a40caf51b0179d4ec809ac43a7806f64a1f48cffef9f8068c23351cb1981015e26985e9a4c3036c4cc434182636a946d42e40e0373e7981c0a26ceab63d0b90562a5f83dd1c2fc328446ae48cb98632ce4fcfd9d547133ab053b1dcf059633d315bbe30880561850db7f0a4d839c2672cbcf6acc1026c9cfed57002a6e6199c937bac34553ce3e51237d52db5abb163d31b4e306fce5c698b49d15461490c18c547a1f0538634ccb80caeae7fd5c87855423c4526676c5c", 0x280) chdir(&(0x7f0000000040)='./file0/file0/../../file0\x00') mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5900) ioctl$WSDISPLAYIO_GETEMULTYPE(0xffffffffffffffff, 0x80184902, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DIOCGETQUEUES(r1, 0xc148445e, &(0x7f0000000140)={0x2, 0x6, {'\x00', './file0/file0/../../file0\x00', './file0/file0/../../file0\x00', './file2\x00', {{0x4, 0x8}, {0x6, 0x5}, 0x7}, {{0x3, 0x80000001}, {0x4, 0xfb}, 0x5}, {{0x1, 0x4}, {0x2, 0x8}, 0x7}, {0x9, 0x7, 0x140843b, 0x28000000}, 0x0, 0x5, 0xfffffffc, 0x0, 0x40}}) ioctl$DIOCXBEGIN(r1, 0xc0104451, &(0x7f0000000080)={0x3, 0x408, &(0x7f0000001bc0)=[{0x1, './file0/file0/../../file0\x00', 0x1}, {0x1, './file0\x00', 0x5}, {0x1, './file1\x00', 0x5}]}) sysctl$net_inet_ip(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sysctl$kern(&(0x7f0000000400)={0x1, 0x34}, 0x2, 0x0, 0x0, 0x0, 0x0) 8.561005ms ago: executing program 0 (id=73): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x9, 0xff, 0x10000, 0x0, 0x0, 0x3, 0x8, 0x2, 0x0, 0x2000004, 0x6}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x8000, 0xba) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x209, 0x40009, 0x4, 0x0, 0x8000000a, 0x2, 0x8, 0x2, 0x0, 0x2000004, 0x2}) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) closefrom(r2) 1.787769ms ago: executing program 2 (id=74): mknod(&(0x7f0000000100)='./bus\x00', 0x2000, 0xd02) r0 = open(&(0x7f0000000240)='./bus\x00', 0x2, 0x111) ioctl$VNDIOCSET(r0, 0x80086476, &(0x7f0000000040)={0x0, 0xffffffffffffffba, 0x0}) 0s ago: executing program 1 (id=75): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$DIOCGETSTATE(0xffffffffffffffff, 0xc1084413, &(0x7f0000000040)={{0x9, './file0\x00', [{[@v6=@remote={0xfe, 0x80, '\x00', 0x0}, @v4=@broadcast], [0x9, 0x40], 0x0, 0x2}, {[@v6=@local={0xfe, 0x80, '\x00', 0x0}, @v4=@broadcast], [0x46], 0x4}], {{0x248, 0x48, 0xfb, 0x7ff}, 0xe, 0x409, 0xfff00000, 0x0, 0x8, 0x17, 0x16}, {{0x0, 0x7, 0x1, 0x8}, 0x8001, 0xc86, 0x4cdf, 0x6, 0x800, 0xf0}, @v6=@empty, 0x4, 0xb, 0x2, 0x85d3, 0x6, [[0xfffffff7, 0x7], [0x2, 0x34c]], [[0xfc000002, 0x401], [0x9, 0x3]], 0x9, [0xf, 0x79], 0x1, 0x18, 0x16, 0x1, 0x0, 0x40, 0xb, 0x83, 0x5, 0x6, 0x1, 0xce57}}) r1 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x5, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) semctl$IPC_SET(r1, 0x0, 0x1, 0x0) r2 = openat$bpf(0xffffffffffffff9c, 0x0, 0x80, 0x0) ioctl$BIOCSETF(r2, 0x80104267, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x6, 0x0, 0xfc}, 0x80000000, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x1, 0x200023, 0x0, 0x0, 0x0, 0x0, 0x40002}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCSETA(r0, 0xc1084425, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x0, "210d0000000200000006000000000200007fffff", 0x7effdffe, 0x7ff}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.50' (ED25519) to the list of known hosts. pckbd_enable: command error panic: kernel diagnostic assertion "rn != NULL" failed: file "/syzkaller/managers/main/kernel/sys/net/pipex.c", line 459 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x25 panic(ffffffff83484810) at panic+0x1cf __assert(ffffffff834c428b,ffffffff8341930f,1cb,ffffffff8347b5ba) at __assert+0x29 pipex_unlink_session_locked(ffff8000ffff50c0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff8000015f3800) at pipex_destroy_all_sessions+0xd9 pppacclose(6381,1,2000,ffff80002a77c548) at pppacclose+0x16f spec_close(ffff80003c901a70) at spec_close+0x417 VOP_CLOSE(fffff280669f66e0,1,fffff28007ffd750,ffff80002a77c548) at VOP_CLOSE+0x129 vn_closefile(fffff28077e03268,ffff80002a77c548) at vn_closefile+0x11d fdrop(fffff28077e03268,ffff80002a77c548) at fdrop+0x121 closef(fffff28077e03268,ffff80002a77c548) at closef+0x190 fdfree(ffff80002a77c548) at fdfree+0x115 exit1(ffff80002a77c548,0,0,1) at exit1+0x576 sys_exit(ffff80002a77c548,ffff80003c901dd0,ffff80003c901d20) at sys_exit+0x1a end trace frame: 0xffff80003c901dc0, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: kernel diagnostic assertion "rn != NULL" failed: file "/syzkaller/managers/main/kernel/sys/net/pipex.c", line 459 ddb> trace db_enter() at db_enter+0x25 panic(ffffffff83484810) at panic+0x1cf __assert(ffffffff834c428b,ffffffff8341930f,1cb,ffffffff8347b5ba) at __assert+0x29 pipex_unlink_session_locked(ffff8000ffff50c0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff8000015f3800) at pipex_destroy_all_sessions+0xd9 pppacclose(6381,1,2000,ffff80002a77c548) at pppacclose+0x16f spec_close(ffff80003c901a70) at spec_close+0x417 VOP_CLOSE(fffff280669f66e0,1,fffff28007ffd750,ffff80002a77c548) at VOP_CLOSE+0x129 vn_closefile(fffff28077e03268,ffff80002a77c548) at vn_closefile+0x11d fdrop(fffff28077e03268,ffff80002a77c548) at fdrop+0x121 closef(fffff28077e03268,ffff80002a77c548) at closef+0x190 fdfree(ffff80002a77c548) at fdfree+0x115 exit1(ffff80002a77c548,0,0,1) at exit1+0x576 sys_exit(ffff80002a77c548,ffff80003c901dd0,ffff80003c901d20) at sys_exit+0x1a syscall(ffff80003c901dd0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b3052ca26e0, count: -16 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80003c901850 rbx 0x1 rdx 0 rcx 0 rax 0xffff80002a77c548 r8 0x101010101010101 r9 0x8080808080808080 r10 0xf7b731fda54eef74 r11 0xe50551cc0acddc6a r12 0 r13 0 r14 0 r15 0x1 rip 0xffffffff8111c835 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c901840 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb> show proc PROC (syz-executor) tid=222707 pid=69160 tcnt=0 stat=onproc flags process=1008 proc=2000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80002a77c548 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a77d4d8,0xffff80002a77ca88 process=0xffff8000ffffba98 user=0xffff80003c8fc000, vmspace=0xfffff2806cabeb90 estcpu=36, cpticks=7, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 16735 293801 10471 0 2 0 syz-executor 73025 192451 89823 0 2 0 syz-executor 73025 357436 89823 0 2 0x4000000 syz-executor 2012 331464 13064 0 2 0 syz-executor 2012 431137 13064 0 3 0x4000080 fsleep syz-executor 65122 173374 46782 0 2 0 syz-executor 65122 317810 46782 0 3 0x4000080 fsleep syz-executor 22500 172327 0 0 3 0x14200 acct acct 26972 242085 88579 0 3 0x100082 sbwait arp 88579 117843 76230 0 3 0x10008a sigsusp sh 13064 300280 7784 0 3 0x82 nanoslp syz-executor 76230 90055 7784 0 3 0x82 wait syz-executor 46782 371740 7784 0 3 0x82 nanoslp syz-executor 80875 239191 7784 0 3 0x82 nanoslp syz-executor 71694 42077 7784 0 3 0x82 nanoslp syz-executor 46217 339106 7784 0 2 0x2 syz-executor 10471 161032 7784 0 2 0x2 syz-executor 89823 391560 7784 0 3 0x82 nanoslp syz-executor 7784 342881 8429 0 3 0x82 kqread syz-executor 8429 292626 43749 0 3 0x10008a sigsusp ksh 43749 231819 51055 0 3 0x98 kqread sshd-session 51055 504165 37287 0 3 0x92 kqread sshd-session 38701 497527 1 0 3 0x100083 ttyin getty 37287 523538 1 0 3 0x88 kqread sshd 45857 352442 20267 73 3 0x1100090 kqread syslogd 20267 319289 1 0 3 0x100082 sbwait syslogd 71140 233468 1 0 3 0x100080 kqread resolvd 48955 408265 60063 77 2 0x100012 dhcpleased 69516 70514 60063 77 3 0x100092 kqread dhcpleased 60063 68749 1 0 3 0x80 kqread dhcpleased 43800 457177 0 0 3 0x14200 bored smr 53581 252116 0 0 2 0x14200 zerothread 44602 466938 0 0 3 0x14200 aiodoned aiodoned 74658 216878 0 0 3 0x14200 syncer update 85075 447271 0 0 3 0x14200 cleaner cleaner 86833 193090 0 0 3 0x14200 reaper reaper 90080 114579 0 0 3 0x14200 pgdaemon pagedaemon 32089 373757 0 0 3 0x14200 bored viomb 68307 200880 0 0 3 0x40014200 acpi0 acpi0 15174 240026 0 0 3 0x14200 bored softnet0 22973 165047 0 0 3 0x14200 bored systqmp 39732 468338 0 0 3 0x14200 bored systq 29784 245607 0 0 3 0x40014200 tmoslp softclock 34084 188859 0 0 3 0x40014200 idle0 1 452293 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11030 12105K 12305K 166960K 12188 0 pcb 17 12K 12K 166960K 20 0 rtable 228 7K 7K 166960K 340 0 pf 30 12K 20K 166960K 69 0 ifaddr 40 7K 7K 166960K 45 0 ifgroup 50 2K 2K 166960K 56 0 sysctl 3 1K 9K 166960K 7 0 counters 34 17K 18K 166960K 39 0 ioctlops 0 0K 4K 166960K 38 0 iov 0 0K 16K 166960K 4 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1293 81K 81K 166960K 1394 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 17 61K 85K 166960K 199 0 proc 58 59K 83K 166960K 492 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 2 0 in_multi 89 6K 6K 166960K 91 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 3 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 43 201K 201K 166960K 43 0 exec 0 0K 1K 166960K 367 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 202 136K 141K 166960K 3404 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 40 80K 92K 166960K 1300 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 11 0K 1K 166960K 28 0 temp 35 9102K 9118K 166960K 4261 0 kqueue 14 22K 24K 166960K 34 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 36 0 32 1 0 1 1 0 8 0 rtentry 136 104 0 1 4 0 4 4 0 8 0 unpcb 144 44 0 29 1 0 1 1 0 8 0 syncache 336 5 0 5 1 0 1 1 0 8 1 tcpcb 736 24 0 20 1 0 1 1 0 8 0 arp 96 17 0 0 1 0 1 1 0 8 0 ipq 40 1 0 0 1 0 1 1 0 8 0 ipqe 40 1 0 0 1 0 1 1 0 8 0 inpcb 328 85 0 78 1 0 1 1 0 8 0 nd6 112 22 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1072 6 0 5 1 0 1 1 0 8 0 pfstlim 224 1 0 1 1 0 1 1 0 8 1 pfanchor 1288 7 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 414 0 0 26 0 26 26 0 8 0 art_table 40 415 0 0 5 0 5 5 0 8 0 art_node 32 104 0 10 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1654 0 193 92 0 92 92 0 8 0 ffsino 256 1655 0 193 92 0 92 92 0 8 0 nchpl 144 1914 0 223 63 0 63 63 0 8 0 rtmask 32 1 0 0 1 0 1 1 0 8 0 vnodes 216 1762 0 0 98 0 98 98 0 8 0 namei 1024 5520 0 5518 1 0 1 1 0 8 0 kstatmem 264 29 0 6 2 0 2 2 0 8 0 scsiplug 72 1 0 1 1 0 1 1 0 8 1 scxspl 216 6377 0 6377 3 0 3 3 1 8 3 plimitpl 152 31 0 15 1 0 1 1 0 8 0 sigapl 424 498 0 454 6 0 6 6 0 8 0 knotepl 120 4729 0 4681 2 0 2 2 0 8 0 kqueuepl 184 35 0 25 1 0 1 1 0 8 0 pipepl 304 124 0 97 3 0 3 3 0 8 0 fdescpl 448 484 0 454 4 0 4 4 0 8 0 filepl 120 1600 0 1390 7 0 7 7 0 8 0 lockfpl 104 25 0 23 1 0 1 1 0 8 0 lockfspl 48 13 0 11 1 0 1 1 0 8 0 sessionpl 144 23 0 15 1 0 1 1 0 8 0 pgrppl 48 31 0 15 1 0 1 1 0 8 0 ucredpl 104 99 0 88 1 0 1 1 0 8 0 zombiepl 144 456 0 454 1 0 1 1 0 8 0 processpl 1152 498 0 454 4 0 4 4 0 8 0 procpl 664 578 0 531 5 0 5 5 0 8 0 sosppl 176 1 0 1 1 0 1 1 0 8 1 sockpl 552 165 0 139 3 0 3 3 0 8 1 mcl64k 65536 24 0 24 1 0 1 1 0 8 1 mcl16k 16384 12 0 12 1 0 1 1 0 8 1 mcl12k 12288 15 0 15 1 0 1 1 0 8 1 mcl9k128 9344 8 0 8 1 0 1 1 0 8 1 mcl8k 8192 28 0 28 1 0 1 1 0 8 1 mcl4k 4096 2604 0 2549 15 0 15 15 0 8 7 mcl2k 2048 125 0 125 3 0 3 3 0 8 3 mtagpl 96 5 0 4 1 0 1 1 0 8 0 mbufpl 256 5123 0 4969 16 0 16 16 0 8 2 bufpl 280 2338 0 102 160 0 160 160 0 8 0 anonpl 24 84861 0 81787 21 0 21 21 0 186 1 amapchunkpl 152 9419 0 9019 19 0 19 19 0 158 0 amappl16 200 1219 0 1203 4 0 4 4 0 8 2 amappl15 192 3 0 2 1 0 1 1 0 8 0 amappl14 184 409 0 407 1 0 1 1 0 8 0 amappl13 176 134 0 123 1 0 1 1 0 8 0 amappl12 168 730 0 702 2 0 2 2 0 8 0 amappl11 160 5 0 5 1 0 1 1 0 8 1 amappl10 152 58 0 48 1 0 1 1 0 8 0 amappl9 144 272 0 272 1 0 1 1 0 8 1 amappl8 136 105 0 104 1 0 1 1 0 8 0 amappl7 128 151 0 139 1 0 1 1 0 8 0 amappl6 120 152 0 149 1 0 1 1 0 8 0 amappl5 112 95 0 88 1 0 1 1 0 8 0 amappl4 104 269 0 253 1 0 1 1 0 8 0 amappl3 96 1800 0 1706 3 0 3 3 0 8 0 amappl2 88 521 0 469 2 0 2 2 0 8 0 amappl1 80 10405 0 9837 13 0 13 13 0 8 0 amappl 88 2716 0 2578 4 0 4 4 0 92 0 uvmvnodes 80 97 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 253 0 253 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 484 0 454 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 484 0 454 1 0 1 1 0 8 0 vmmpekpl 168 5762 0 5737 2 0 2 2 0 8 0 vmmpepl 168 39393 0 37650 80 0 80 80 0 357 0 vmsppl 368 483 0 454 4 0 4 4 0 8 0 rwobjpl 40 14134 0 13194 11 0 11 11 0 8 1 pdppl 4096 974 0 908 90 22 68 76 0 8 2 pvpl 32 222534 0 213998 75 0 75 75 0 265 2 pmappl 216 483 0 454 2 0 2 2 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 355 0 22 10 0 10 10 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace db_enter() at db_enter+0x25 panic(ffffffff83484810) at panic+0x1cf __assert(ffffffff834c428b,ffffffff8341930f,1cb,ffffffff8347b5ba) at __assert+0x29 pipex_unlink_session_locked(ffff8000ffff50c0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff8000015f3800) at pipex_destroy_all_sessions+0xd9 pppacclose(6381,1,2000,ffff80002a77c548) at pppacclose+0x16f spec_close(ffff80003c901a70) at spec_close+0x417 VOP_CLOSE(fffff280669f66e0,1,fffff28007ffd750,ffff80002a77c548) at VOP_CLOSE+0x129 vn_closefile(fffff28077e03268,ffff80002a77c548) at vn_closefile+0x11d fdrop(fffff28077e03268,ffff80002a77c548) at fdrop+0x121 closef(fffff28077e03268,ffff80002a77c548) at closef+0x190 fdfree(ffff80002a77c548) at fdfree+0x115 exit1(ffff80002a77c548,0,0,1) at exit1+0x576 sys_exit(ffff80002a77c548,ffff80003c901dd0,ffff80003c901d20) at sys_exit+0x1a syscall(ffff80003c901dd0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b3052ca26e0, count: -16 ddb> machine ddbcpu 1 No such command ddb> trace db_enter() at db_enter+0x25 panic(ffffffff83484810) at panic+0x1cf __assert(ffffffff834c428b,ffffffff8341930f,1cb,ffffffff8347b5ba) at __assert+0x29 pipex_unlink_session_locked(ffff8000ffff50c0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff8000015f3800) at pipex_destroy_all_sessions+0xd9 pppacclose(6381,1,2000,ffff80002a77c548) at pppacclose+0x16f spec_close(ffff80003c901a70) at spec_close+0x417 VOP_CLOSE(fffff280669f66e0,1,fffff28007ffd750,ffff80002a77c548) at VOP_CLOSE+0x129 vn_closefile(fffff28077e03268,ffff80002a77c548) at vn_closefile+0x11d fdrop(fffff28077e03268,ffff80002a77c548) at fdrop+0x121 closef(fffff28077e03268,ffff80002a77c548) at closef+0x190 fdfree(ffff80002a77c548) at fdfree+0x115 exit1(ffff80002a77c548,0,0,1) at exit1+0x576 sys_exit(ffff80002a77c548,ffff80003c901dd0,ffff80003c901d20) at sys_exit+0x1a syscall(ffff80003c901dd0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7b3052ca26e0, count: -16